Finding XSS on Apple.com and Building a Proof of Concept to Leak Your PII

Explore a conference talk from #NahamCon2022 featuring @zseano, who demonstrates the process of discovering and exploiting a cross-site scripting (XSS) vulnerability on .apple.com. Learn about initial reconnaissance techniques, fuzzing for XSS, achieving a working exploit, and building a proof of concept to potentially leak personally identifiable information (PII). Follow along as the speaker walks through each step of the bug bounty process, from initial discovery to crafting a compelling report. Gain insights into the mindset and methodology of successful bug hunters, and discover how to approach high-profile targets like Apple's domain.

Intro
Initial Recon & starting to fuzz for XSS
Achieving XSS
Working XSS - now what?
Back to recon
Building a proof of concept
Bounty?