As per my understanding, while exploiting an XSS (in GET request) the attacker will craft the malicious link with a JS payload and will send it to the victim. When the victim clicks on the link the script will send the cookie to the attackers server.

How can I exploit an XSS vulnerability if the parameter is going in the body. How exactly should I create a payload (link or file) and send it to the victim?

  • 2
    Aren't you essentially asking on how to make the user submit a POST request with attacker controlled data and then show the resulting page to the user? Have you tried using a <form method=POST ... and make the use click on the submit button or similar? Dec 18, 2017 at 6:22

1 Answer 1


You can not craft a link that contains a POST body. So you will have to go a somewhat different route.

You will need to create your own page that contains the payload:

<form action="http://target.com" method="post" onload="this.submit()">
  <input type="hidden" value="payload" name="fieldname">

Or you can achieve the same effect just using the JavaScript fetch API. Then you need to trick the victim into visiting this page.

This will be a little bit harder since the URL will be different and perhaps look a bit fishy. If you want to avoid that, you can go looking for open redirect vulnerabilities and leverage them to take the victim to your page.

Of course, if the payload is stored on the server, and displayed on a page that can be visited later, this is much simpler - just make the victim visit that page. This is what is called stored XSS.

  • 1
    As per my understanding this would also require the page vulnerable to CSRF. Since posting cross-domain form with CSRF protection is not possible.
    – Rahul
    Nov 22, 2019 at 16:44
  • @Rahul The vulnerable page may even be stateless and without authentication, so CSRF is sort of a separate issue.
    – Anders
    Nov 22, 2019 at 18:06
  • 1
    Can you point towards such example ?
    – Rahul
    Nov 22, 2019 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.