Reflect XSS with Content-Type: text/xml
#TheFutureIsBright #BugBounty #bugbountytips Broken Crystals by https://brightsec.com
Reflect XSS on the https://brokencrystals.com/api/metadata with POST based request. Entry point after requesting returns XML based response with content-type: text / xml.
XML Child field reflects in the response and do not filter dangerous characters in correct way. What means it is vulnerable to reflect XSS
Lab: https://brokencrystals.com