Reflected Cross Site Scripting (Awards 3500$ bounty)

2 min readFeb 20, 2023

Hello, Hunters. You are here because you are struggling or want to advance in your career. Believe me, things take time. Be consistent, continue to learn, and never deceive yourself. If you follow this three mantras, you will undoubtedly achieve success.

For better Career Opportunity Connect with me 1:1 click on 👉🏻(TOPMATE)

Without wasting time let ‘s Start:

The “Shopify Github Integration” tool makes it easier to link a GitHub account to a Shopify store. A vulnerable URL,, is used during the Github connection process.

Shops Used to Test :

Relevant Request IDs: x-request-id: 1cdb077b2d319acccd1237c1142cf89b

Steps To Reproduce:

  1. Visit the next URL
  2. After Decoding Above url : “}}});};alert(1337);if(1==2){k=new Promise(function(){if(1==2){v={e: 1&setup_action=install”

Payload used (alert(1337))

3. Enter an owner or staff credentials.

4. The XSS will fire.


There are several impacts.

  • The attacker could use Javascript in order to do phishing attacks.
  • Steal data.
  • Reflected JS

Thank you for reading !! hope you get to learn some tricks.

Subscribe to the Shuttlertech YouTube channel for more of this type of content and to watch live POCs & To advance your career connect with me 1:1 over topmate .
To encourage me to write more, follow me on medium and click the clap icon.




Senior Cyber Security Analyst| YouTuber| Freelancer| Cyber Security Trainer | Penetration Tester| Cyber Forensics Investigator