Hacking Swagger-UI - from XSS to account takeovers

We have reported more than 60 instances of this bug across a wide range of bug bounty programs including companies like Paypal, Atlassian, Microsoft, GitLab, Yahoo

Bug Bytes #170 - Evasive vulnerabilities, Hacking Swagger UI & Reverse engineering REST APIs - Intigriti

Web API Pentesting - HackTricks

Swagger UI reveals unauthenticated endpoint leaking sensitive data

Hacking Swagger-UI - from XSS to account takeovers

all tools on

How I was able to steal users credentials via Swagger UI DOM-XSS, by Mohamed reda

Pratik Dabhi (@impratikdabhi) / X

tl;dr sec] #135 - BSidesSF, Google's Cloud Forensics Utils, Running Bug Bounty Programs

SSRF and Account Takeover via XSS in ERPNext (0-day)

Found +6 DomXSS at different programs (Hacking Swagger-UI), by Adham sayed (doosec101)

How I was able to steal users credentials via Swagger UI DOM-XSS, by Mohamed reda

Hein Thant (@_heinthant) / X

Unauthorized Access To Admin Panel via Swagger, by M7arm4n

Hacking Swagger-UI - from XSS to account takeovers

Bug Bounty Quick Wins: How to exploit XSS Issues on Swagger Instances., Jayesh Madnani posted on the topic