How I Found Security Vulnerabilities in Dutch Government.

I saw several bug bounty hunters posting about their Dutch Government security findings and the cool t-shirt they received. That definitely caught my attention.

Starting With the Scope: I started exploring publicly available sources to find valid, in-scope targets the Dutch_Gov_Scope on GitHub, which contains a collection of Dutch Government domains.

https://github.com/zzzteph/Dutch_Gov_Scope

https://gist.github.com/testerzs/cf3085ec0bad6b1d661887d4f44e3574

https://gist.github.com/sushilphuyal/22ae920445ab01a3d41453f0383a0cf8

Building My Target List: I cloned the GitHub repositories combined the domain lists and removed duplicates: cat git1 git2 git3 | sort -u > all_subdomains_1.txt

Using HTTPX, removed unreachable hosts. httpx -l all_subdomains_1.txt -o httpx_alive_2.txt

I used Wayback Machine data to collect historical URLs. This produced a much larger collection of URLs and parameters. cat httpx_alive_2.txt | waybackurls | tee endpoint_3.txt

Live domains + Historical URLs + Parameters I passed all the endpoints to gf to filter for potential XSS parameters. cat endpoint_3.txt | gf xss > gf_XSS_4.txt

I used qsreplace to replace the parameter values with an XSS payload. cat gf_xss_4.txt | qsreplace '">' | tee qsxss_5.txt

Now is the time to use tool called freq, which sends multiple HTTP requests using the crafted payload. cat qsxss_5.txt | freq | tee -a possible-xss_6.txt

This generated a large number of potential XSS results. However, there were also plenty of false positives, so I manually reviewed the results one by one.

After filtering false positives, I identified a parameter vulnerable to Reflected XSS. The payload executed successfully BOOM💥

I created a POC and reported the Reflected XSS to the NCSC.

Reproduced the issue, and informed the responsible organization. confirmed it was fixed. I received appreciation for the responsible disclosure.

The biggest lesson was that recon is all about adapting. When one approach doesn't work, try different techniques, change your methodology, and keep exploring until you uncover something interesting.