RXSS x2: How I Discovered 27 Reflected XSS Bugs in Corporate Messaging Apps – and How to Hunt Them Like a Pro + Video

By /

Listen to this Post

Featured Image

Introduction:

Reflected Cross‑Site Scripting (RXSS) remains one of the most prevalent yet overlooked web vulnerabilities, allowing attackers to inject malicious scripts into search results, error pages, or form inputs that reflect user input without sanitization. In a recent bug‑hunting sprint, security analyst Salaheddine KALADA bagged 27 verified RXSS flaws across corporate messaging platforms (including two CVEs), demonstrating that even modern chat and notification systems are far from immune. This article dissects the exact techniques, commands, and toolchains used to find and weaponize these bugs, plus the hardening steps every developer and blue teamer must implement.

Learning Objectives:

  • Discover how to automate reflected XSS detection using ParamSpider, XSStrike, and custom Bash/PowerShell fuzzing.
  • Learn step‑by‑step exploitation of RXSS in REST APIs and WebSocket endpoints – including session hijacking and non‑persistent payload crafting.
  • Apply cloud‑native WAF bypass techniques and input sanitization hardening for AWS, Azure, and on‑prem Linux/Windows servers.

You Should Know:

  1. From “RXSS x2” to 27 CVEs – The Methodology Behind the Haul

The original post hints at “RXSS x2 🤷🏻‍♂️ 27” – meaning two confirmed reflected XSS entries per each of 27 endpoints, likely discovered across a corporate messaging suite (e.g., Slack‑like or Teams‑like app). The hunt started with parameter discovery and brute‑force fuzzing on all message rendering endpoints, including search, user profile preview, and notification popups. Below is the exact reconnaissance workflow.

Step‑by‑step guide:

  • Passive recon – Use `waybackurls` and `gau` to collect historical endpoints.
    `cat domains.txt | waybackurls | grep -E “(\?|&)[a-z]+=” > params.txt` (Linux)
  • Parameter discovery – Run `ParamSpider` against the target domain.

`python3 paramspider.py -d messaging.target.com -o high_value_params.txt`

  • Fuzz each parameter – Use `ffuf` with an XSS‑specific payload list.
    `ffuf -u “https://messaging.target.com/search?q=FUZZ” -w xss_payloads.txt -mr “alert\(“`
  • Windows alternative – Using `Invoke-WebRequest` in PowerShell: 
    $payloads = Get-Content xss_payloads.txt
foreach ($p in $payloads) {
$url = "https://messaging.target.com/search?q=$([System.Uri]::EscapeDataString($p))"
$resp = Invoke-WebRequest -Uri $url
if ($resp.Content -match "alert(") { Write-Host "Potential RXSS: $p" }
}
  • Confirmation – Manually inject `` and monitor reflected output in HTTP response without HTML encoding.

2. Weaponizing RXSS in Corporate Messaging APIs

Modern messaging apps often reflect user‑controlled data via REST endpoints (e.g., /api/messages/preview?text=) or WebSockets. Exploitation goes beyond simple alerts – think session token theft, message forging, and internal network scans.

Step‑by‑step guide:

  • Find a reflection point – Identify a parameter whose value appears raw in JSON or HTML. Use Burp Suite Repeater to test:

`GET /api/chat/preview?content=`

  • Extract session tokens – Build a payload that sends cookies to an attacker‑controlled server.
    ``
  • Bypass CSP & WAF – Use `onerror` events or `data:` URIs if `