Discovered a cookie-persisted version of this at a large multi-national (Global Fortune 100). It affected almost all of their SSO pages. They all had multiple X

Discovered a cookie-persisted version of this at a large multi-national (Global Fortune 100). It affected almost all of their SSO pages. They all had multiple XSS issues, and then they read from a cookie and then wrote that value to the page inside some Javascript(!), so I was able to persist the XSS on the user's machine indefinitely (until they cleared their cookies). The result was the ability to capture user credentials at any of their login portals, and the "infection" mechanism would have just been the victim clicking on a link to one of their login portals. The company has a bug bounty that awards "schwag", which I knew going in. So now I have two of the same really dumb t-shirts.