Hacking Swagger-UI - from XSS to account takeovers

We have reported more than 60 instances of this bug across a wide range of bug bounty programs including companies like Paypal, Atlassian, Microsoft, GitLab, Yahoo

APIsec Resource Library

Pratik Dabhi (@impratikdabhi) / X

Web API Pentesting - HackTricks

Swagger API. API Hacking, by ghostlulz

How I was able to steal users credentials via Swagger UI DOM-XSS, by Mohamed reda

Hacking Swagger-UI - from XSS to account takeovers

Found +6 DomXSS at different programs (Hacking Swagger-UI), by Adham sayed (doosec101)

How I Found 3 XSS Types (Reflected, Blind Stored && DOM XSS) In One Program and Got $$$$, by Mustafa Adam Qamar El-Din

Deserialized web security roundup: 'Catastrophic cyber events', another T-Mobile breach, more LastPass problems

SSRF and Account Takeover via XSS in ERPNext (0-day)

Hacking Swagger-UI - from XSS to account takeovers

Hacking Swagger-UI - from XSS to account takeovers