Is it possible to get password from a site with stored XSS? I have a forum where I can put JavaScript not directly but inside HTML (like <div onclick="alert()">CLICK</div>). Is it possible to exploit this to get passwords?

  • maybe, but it's a lot easier to just steal the cleat tokens from the cookie. on a lot of sites, a token can be used to change the password, so then you would know the password. also, sometimes functionality that "remembers you" in a sign-in box can populate the password field in a way JS can read in the clear. then again, if you have xss, you can simply replace the sign-in <form> action url with one of yours...
    – dandavis
    Commented May 29, 2016 at 15:24

1 Answer 1


There is no way to get the password directly

You can not get the user password directly from the forum. Simply because you cannot access the browser using javascript. So you will not be able to get the saved passwords in the browser. This would be a huge security failure

There are 2 ways to access an account from a XSS vulnerabilty

  • As we saw, it isn't possible to directly get the passwords while the user click on your link. But, think an other way. A first way is to extract the users cookies. Using AJAX, you can send POST and GET request in the background. The user will not be informed in this request. Given this, you can send the cookies (get them with document.cookies using JavaScript) to an address you control. You can then inject those cookies in your browser and enter the victim account.
  • The second way refer to fake a login page. When clicking on your link, the user will think he has been disconnected while he just arrived on your fake page, which is still on the correct domain. This my answer about it there. You can there alter the page with your own source code, and send the ID to your server when the victim click on the connect button.

Not the answer you're looking for? Browse other questions tagged .