PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Blind XSS : setup your self-hosted XSS Hunter with the PwnMachine

yeswehack.com | vulnerability | #bug-bounty | #xss | #tooling | #blind-xss | #self-hosted | #pwnmachine | #xss-hunter
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A step-by-step tutorial for self-hosting XSS Hunter Express on PwnMachine: configuring DNS, patching for volumes and SSL, and exposing it via Traefik for blind XSS campaigns.
Published
Collected

Related coverage

blog · yeswehack.com
PwnMachine: quick update about fix and new features
An update on PwnMachine, YesWeHack's self-hosted hunting environment: the web interface now handles file upload/download from any volume, and custom Docker images import from a Git repository.
blog · yeswehack.com
PwnMachineV2: a new version of the self hosted pwning environment for Bug Bounty
YesWeHack released PwnMachine v2, a self-hosted hunting environment with a full web interface, Docker tooling, Traefik for HTTP routing and SSL, and PowerDNS for rebinding and SSRF tests.
vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
vulnerability · bishopfox.com
Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898
A critical unauthenticated SQL injection in Metabase's password reset endpoint (CVE-2026-72898, CVSS 10.0) allows arbitrary SQL against the application database; active exploitation is confirmed.
vulnerability · bishopfox.com
Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)
CVE-2026-58113 is a zero-interaction XSS in Siemens Teamcenter’s login redirect that let Bishop Fox silently reassign workflow delegation on a victim’s…
vulnerability · hackerone.com
How Bug Bounty Uncovered A 5-Year-Old Vulnerability In Hours
After acquiring PullRequest, HackerOne added its assets to its own bug bounty and got nearly two dozen reports within 48 hours, including a blind XSS in a rating form that had lurked for five years.
Back