Stored XSS — HackXpert Labs

💾 Stored XSS

Your payload is saved and fires later, for whoever loads the page next. Ask who that is before you decide what the payload should do.

13 labs and targetsfree accountlesson included

How cross-site scripting actually works — taught by The XSS Rat

What it is

XSS happens when input you control ends up in the page without being neutralised for the context it lands in. Context is the whole game: inside HTML, inside an attribute, inside a script block and inside a URL all need different escaping, and a filter built for one of them is useless in the others.

How I attack it

Find where your input is reflected, then view source and look at exactly what surrounds it.
Break out of that context first - close the attribute, close the tag, close the string - before you even think about a payload.
If the output is encoded, check whether it is encoded for the right context. HTML-encoding inside a script block stops nothing.
Stored beats reflected on impact. Ask who else loads that page, and what their session can do.