I have started my bug bounty adventure with Yandex – a company which owns the largest search engine in Russia.
Their key services (more paid) are: Yandex.Passport, Yandex.Mail, Yandex.Disk, Yandex.Maps, Yandex.Calendar, Moi Krug, Yandex’s home page and search results page, so I gave it a try. I was lucky enough to find a XSS in Http Cookie Header in mail.yandex.ru.
The vulnerable cookie variable was “yandexuid”, so it could be malformed to look like:
yandexuid=XXX<script>alert(document.cookie)</script> (where XXX is your ID)
After refreshing your mailbox an alert window popped up.
Damn, it’s addictive.
[March 17th 2013] - bug was reported [April 24th 2013] - bug was fixed