i am well aware of the impact of reflected, dom and stored XSS. Recently i discovered what Universal XSS is and i am a bit confused by it. i know it executes locally in the browser, but is it possible to retrieve the browser's cache? cookies? credentials stored in the browser?

Example 1: we have an open redirect on a website example.com/redirect=XSSpayload

With this example the hacker can steal the victims information (tokens or whatever - doesn't really matter).

Example 2: we have an open redirect on a website example.com/redirect=UXSSpayload

In this scenario the payloads executes in the browser instead of executing in the vulnerable website itself. but... does this make sense? isn't the same to make a redirect to the hacker's website and then trigger the uxss or whatever xss you want? (:-/)

Hope someone can help me with this as i'm a bit confused thinking of these scenenarios.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.