JSONP / callback parameter
?callback= or ?jsonp= that wraps JSON in attacker-controlled function names. Often still live on /api/v1 while the SPA uses /api/v2.
Tags: jsonp, xss, cors
Typical severity: P3-P4
What it becomes
Legacy JSONP with a reflected callback and cookies is an XSS/CORS-bypass gadget on old APIs.
Where to look
old analyticsmaps APIsautocompleteCDN copies of unused endpoints
Chains
- XSS — callback=alert(1)// or callback=<script> if content-type is HTML.
- Data theft with cookies — JSONP is a CORS bypass: a foreign page includes the script and reads the padded JSON in a stolen-callback function.
Notes
- Even with an alphanumeric allowlist, a global gadget function on the target origin can be invoked.
- Check historical URLs with gau/waymore; JSONP dies slowly.