Scenario : There is a persistent XSS on a page with the username information. The username is present three times in the page, is visible only once and the visible one is correctly escaped.
How would you hide the payload so that it is not visible when the username is displayed ?
- My first idea was to change the text displayed inside the payload.
- Second idea using invisible characters :
Bob">& nbsp;& nbsp;[...]PAYLOAD
and if the payload cannot be executed on a specific page, how would you hide the payload ?
How would you prevent your payload to execute more than once ?