# Tips for bug bounty beginners from a real life experience

Unsanitized User-Agent in YOURLS redirect logging allowed time-based blind SQLi, chained to stored XSS in admin referer stats to steal admin cookies.

- Payout: $1,500
- Severity: high
- Program: YNAB
- Credited: Renaud Martinet
- Disclosed: 2019-01-08
- Write-up quality: 7/10
- Original: https://renaudmarti.net/posts/first-bug-bounty-submission/
- Library page: https://bugbountylibrary.com/r/blog%3Arenaudmarti-net-posts-first-bug-bounty-submission
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:php technique:blind technique:chained technique:source-review vuln:sqli vuln:xss

**Target:** YOURLS 1.4.3 URL shortener (ynab.me)
**Root cause:** yourls_get_user_agent() only strips tags and a character allowlist before interpolating the User-Agent directly into an INSERT statement; the referer stats page then echoes stored referer values into an <a href> without escaping.
**Steps:**
1. Enumerate subdomains, find http://ynab.me/admin running old YOURLS 1.4.3
2. Confirm SQLi: `curl http://ynab.me/contactus -H "User-Agent: test' or SLEEP(10) or '"` delays 10s
3. Confirm stored XSS filter bypass via referer: `javascript://%e2%80%a8alert(document.cookie);` (U+2028 sneaks past clean_url)
4. Chain: inject a new log row via SQLi in User-Agent: `curl http://yourls.local/ozh -H "User-Agent: test', '', ''), ('', NOW(), 'ozh', concat(char(60),'script',char(62),'alert(document.cookie);',char(60),'/script',char(62)), '', '', '') #"`
5. Admin visits stats page for the short URL; injected <script> executes on load, leaking cookies
**How found:** Spidered main site with Burp, enumerated subdomains with amass, spotted /admin on ynab.me via Burp's URL list. Confirmed ownership via whois, read YOURLS GitHub issues for prior SQLi/XSS hints, then source-reviewed for unsanitized input in SQL queries and found the User-Agent INSERT. After the referer XSS payload was too ugly to click, realized the SQLi could write the referer column directly, bypassing the filter.
**Exploitation:** Attacker needs a valid short URL (found via site:ynab.me) so YOURLS logs the hit. SQLi in the User-Agent INSERT lets them write an arbitrary referer row containing a <script> tag, bypassing the referer sanitizer. When an admin views the stats page, the script executes and exfiltrates admin session cookies, enabling admin panel takeover.
**Escalation:** Chained low-impact blind SQLi (only analytics data readable) with stored XSS to escalate to admin account takeover via cookie theft.
**Insight:** When a filter blocks a payload in one input, look for a second injection point (here SQLi) that writes to the same storage column, bypassing the filter entirely. Also: U+2028 (%e2%80%a8) is treated as a line terminator by JS but often survives URL sanitizers that only strip %0a/%0d.