If a certain web application is vastly vulnerable to XSS attacks, is it possible for the attacker to gain a reverse shell using an certain XSS payload without uploading any mallicous files to the web server? or should the owner of the web server only worry about the vulnerability impacting the end users of the web application?

closed as unclear what you're asking by tim, ThoriumBR, Steve, Serge Ballesta, Bacon Brad Sep 27 '17 at 0:21

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    There is no way that I know of to get a shell with only an XSS vulnerability. Typically the XSS vuln is the first step in the kill-chain, but you'd need to have another vector to attack to get RCE. – DKNUCKLES Sep 25 '17 at 19:08
  • 6
    Try to understand that XSS happens entirely on the client. An XSS payload has an effect on the user (in their browser) but it in no way implies that the server itself is vulnerable. – Arminius Sep 25 '17 at 20:01

The answer is no... at least not how you're thinking of it working. XSS attacks actually happen on the client's browser. You could use an XSS to attack the site administrator.

I mean, theoretically, the answer is yes, but not as you likely envision it happening. There are a lot of IFs involved, but only if you could store a XSS attack on that web application; if victim has disabled their client's default security controls and allows the browser to make calls back to a server you control. However, the default controls in place in modern browsers that would likely prevent this from being successful.

That said, this is basically one of the methods drive-by malware is delivered. Target users with administrative privileges and you gain access to their machines.

You don't need a full reverse shell to compromise the application. If you know the application well, your XSS attack, could in fact be a CSRF attack that targets admin user rights to perform administrative actions on the server on your behalf.


You can not gain reverse shell only by performing XSS attack. But that same attack can be done on the owner/admin of that website or server.

Here is an example OWASP XENOTIX XSS EXPLOIT FRAMEWORK V3: XSS Reverse Shell.

Not the answer you're looking for? Browse other questions tagged or ask your own question.