i am well aware of the impact of reflected, dom and stored XSS. Recently i discovered what Universal XSS is and i am a bit confused by it. i know it executes locally in the browser, but is it possible to retrieve the browser's cache? cookies? credentials stored in the browser?
Example 1: we have an open redirect on a website example.com/redirect=XSSpayload
With this example the hacker can steal the victims information (tokens or whatever - doesn't really matter).
Example 2: we have an open redirect on a website example.com/redirect=UXSSpayload
In this scenario the payloads executes in the browser instead of executing in the vulnerable website itself. but... does this make sense? isn't the same to make a redirect to the hacker's website and then trigger the uxss or whatever xss you want? (:-/)
Hope someone can help me with this as i'm a bit confused thinking of these scenenarios.