# The $12,000 Intersection between Clickjacking, XSS, and Denial of Service

Bustabit chat link handling allowed javascript: URI XSS via /external endpoint plus clickjacking, and a malformed %0t URL crashed clients for DoS.

- Payout: $12,000
- Severity: high
- Program: Bustabit
- Credited: Sam Curry
- Disclosed: 2018-07-04
- Write-up quality: 7/10
- Original: https://samcurry.net/the-12000-intersection-between-clickjacking-xss-and-denial-of-service/
- Library page: https://bugbountylibrary.com/r/blog%3Asamcurry-net-the-12000-intersection-between-clickjacking-xss-and-denial-of-service
- Tags: domain:web impact:ato impact:dos kind:research platform:research sev:high technique:chained technique:fuzzing vuln:clickjacking vuln:dos vuln:open-redirect vuln:xss

**Target:** Chat hyperlink rendering and /external redirect endpoint
**Root cause:** The /external endpoint forwarded javascript: URIs without scheme validation, and the client-side link handler crashed on malformed percent-encoding like %0t.
**Steps:**
1. Post a URL in chat; observe it becomes `https://www.bustabit.com/external?url=<url>`
2. Test same-domain bypass with `https://www.bustabit.com//attacker.com/hacked` producing `//attacker.com/hacked`
3. Send `https://www.bustabit.com/%0t` to crash the client via failed URL decode
4. Pass a `javascript:` URI to `/external?url=javascript:...` to execute JS in app context
5. Confirm the site is iframeable and build a clickjacking overlay to trigger the XSS click
**How found:** Noticed chat auto-hyperlinked URLs through an /external redirect; probed for scheme injection and same-domain bypass with double slashes; accidentally discovered the %0t crash while fuzzing payloads, then tested javascript: URI against the external endpoint.
**Exploitation:** Attacker posts or DMs a crafted link; victim clicks it (or is clickjacked via iframe overlay), executing JS that reads the websocket session from localStorage and exfiltrates it to an attacker server, enabling session takeover. Separately, a %0t link crashes victim clients so they cannot cash out bets.
**Escalation:** Chained clickjacking to force the XSS click without user suspicion, then used XSS to steal localStorage websocket session for account takeover.
**Insight:** Redirect/forwarder endpoints that wrap user URLs are prime spots to inject alternate schemes (javascript:, data:) and to test double-slash protocol-relative bypasses of same-domain filters; also fuzz malformed percent-encodings since client-side URL decoders often throw uncaught and crash the app.