---
id: 1360
title: "How a Cross-Site Scripting Vulnerability Led to Account Takeover"
source_domain: hackerone.com
source_url: "https://www.hackerone.com/blog/how-cross-site-scripting-vulnerability-led-account-takeover"
published_at: "2024-11-04 17:50"
tags: ["bug-bounty", "account-takeover", "web-security", "xss", "vulnerability", "hackerone", "session-hijacking"]
phying_url: "https://phying.com/item/1360"
lang: en
---

# How a Cross-Site Scripting Vulnerability Led to Account Takeover

## Summary

XSS tops bug bounty reports at roughly 20% of HackerOne findings. The article covers reflected, stored, and DOM-based XSS, how session cookie theft enables account takeover, and defenses like CSP.

## Intelligence Metadata

- **Sources:** hackerone.com
- **Published:** 2024-11-04 17:50
- **Original:** https://www.hackerone.com/blog/how-cross-site-scripting-vulnerability-led-account-takeover
- **Phying News:** https://phying.com/item/1360