HexBrain

Slack · Report #6002

Stored XSS in Slack.com

Validstatus
5upvotes
9 Mar 2015disclosed

How it was found

Steps:

Go to your respective URL Mine is https://dezignburg.slack.com/account/photo

now Change your photo using Facebook

But before that create a Album in your Facebook naming it as "><img src=x onerror=alert(document.cookie)>

And you will get this error: http://prntscr.com/37eecd

If you need a video just tell me

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original