xss-stored

What problem does it solve?

This Skill helps penetration testers identify and exploit stored (persistent) and blind Cross-Site Scripting (XSS) vulnerabilities in web applications, which can impact other users or administrators.

Core Features & Use Cases

• Stored XSS Identification: Detects input that is saved and rendered unsafely on subsequent page loads.
• Blind XSS Exploitation: Aids in exploiting XSS that fires in contexts the attacker cannot directly observe, such as admin panels.
• Payload Generation: Provides various payloads for different rendering contexts and bypasses.
• Use Case: A penetration tester finds a comment section where user input is stored and displayed to all visitors. They use this Skill to inject a payload that steals admin session cookies when an administrator views the comment.

Quick Start

Use the xss-stored skill to test for stored XSS in the user profile's 'bio' field by submitting a canary payload.