Hacking Swagger-UI - from XSS to account takeovers

We have reported more than 60 instances of this bug across a wide range of bug bounty programs including companies like Paypal, Atlassian, Microsoft, GitLab, Yahoo

Swagger-ui appears to require 'unsafe-eval' in CSP Headers · Issue #5817 · swagger-api/swagger-ui · GitHub

What To Hunt As Beginner, PDF, Denial Of Service Attack

all tools on

SSRF and Account Takeover via XSS in ERPNext (0-day)

👩‍💻IW Weekly #43: $27200 bounty from Facebook, API Misconfigurations, E2E encryption bypass, AzureAd tenant takeover, Billion dollar vulnerability and much more…

Bug Bounty Quick Wins: How to exploit XSS Issues on Swagger Instances., Jayesh Madnani posted on the topic

How I was able to steal users credentials via Swagger UI DOM-XSS, by Mohamed reda

Untitled, PDF, Web Service

Hacking Swagger-UI - from XSS to account takeovers

The Bug Bounty Hunter – Telegram