My First Reflected XSS Finding in a Private Program 🚀🔥

Hey hackers 👋

Today I want to share a small but exciting story about how I found my first reflected XSS vulnerability in a private bug bounty program 😄

I am still a beginner researcher and currently exploring targets on the **Cybecomolho** platform. I usually test applications manually to understand how things work instead of only depending on tools.

One day, I opened a healthcare company target in a private program. Honestly, at first I felt a little hopeless because the application looked simple and secure 😅

But still, I continued checking the application carefully.

Starting with the Search Parameter 🔍

The first thing I noticed was a search functionality in the website URL.

Something like:

/search?q=test

So I started checking how the request and response were behaving.

I inserted simple test values and observed the reflection in the response page. Then I opened the page source code to understand exactly where my input was getting reflected.

At that moment, I got an idea 💡

I thought:

“What if this reflection can break HTML context?”

So I tried a basic payload using an image tag.

<img src=x onerror=alert(1)>

BOOM 💥

The payload executed successfully and the alert popped up instantly.

It was a reflected XSS vulnerability 🎯

Reporting the Issue 📝

I quickly created a proper report with:

• Vulnerable endpoint
• Payload used
• Steps to reproduce
• Impact
• Screenshot proof

I submitted the report to the program.

And guess what? 😳

Within around 2 minutes of researching the application, I got the valid bounty confirmation and received ₹1000 INR 💰🔥

Maybe the money was low…

But at that moment, my happiness and confidence were very high ❤️

Because for the first time, my manual testing skills worked successfully on a real private target.

That feeling was priceless for me ✨

What I Learned 📚

Some important lessons from this finding:

• Never ignore simple search parameters
• Always check reflections carefully
• Viewing source code helps a lot
• Simple payloads still work sometimes
• Manual testing is powerful

You do not always need advanced payloads or automation. Sometimes basic observation is enough.

What’s Next 🚀

After this finding, I started preparing my own XSS automation tool for OpenBugBounty and future testing.

I will write another detailed post about that tool soon 😄

Thanks for reading ❤️

Happy hacking and keep learning 🔥