Mastering Blind XSS

Blind XSS (BXSS) is a stealthy form of cross-site scripting where payloads are stored in places you can't see immediately, such as logs, admin panels, email templates, file metadata and other backend systems, and only execute later when those systems render the data. Because there's no instant feedback, it requires specialized tools and techniques.

Before hunting for Blind XSS, you need the right toolset configured and ready.

The first step in any hunt is finding the right targets. Use custom dorks to locate various submission forms across the web that may be vulnerable to Blind XSS.

Before injecting payloads, you need a system to generate them and listen for their callbacks. This involves a Blind XSS server and a payload manager.

Use Burp Suite's Match and Replace feature to automatically inject Blind XSS payloads into every request you make.

These are example HTTP request headers with Blind XSS payloads. Replace YOUR-COLLAB.DOMAIN with your actual callback server.

For manual testing, use a User-Agent switcher browser extension to quickly inject payloads while browsing.

Use one-liner tools and scripts to scale your Blind XSS testing across many targets automatically.

A clever technique is embedding XSS payloads in image metadata. When the application displays the metadata, your payload executes.

For highly-secured targets with strong input filtering, use encoded payloads. Create a single HTML file with dozens of payloads, each encoded differently (double URL encoding, triple URL encoding, HTML entities, etc.).