I am trying to detect the presence of a blind/stored XSS vulnerability of an input field. The vulnerability does not trigger on page 'A' where the payload is injected.

It is likely due to the fact that the vulnerable field stores the value somewhere else which would only trigger the payload on another page e.g. page 'B'.

I am doing a black box testing.

How can I efficiently test that such a XSS vulnerability indeed exist?

  • Welcome to the Security Stack Exchange! To your immediate question, are you familiar with the idea of stored XSS? Commented Dec 1, 2021 at 6:42
  • hihi :) I have a general idea of how it works? I guess stored XSS happens when the payload is injected into the database, and when another user visits the website and the payload is delivered to the user when the server retrieves the payload from the database.
    – Seng Wee
    Commented Dec 1, 2021 at 6:51

1 Answer 1


The usual approach - aside from just manually looking on all possible "page B"s for the injected content - is to inject content that will cause a unique, identifiable request to an external web server that you control, or at least can check the logs of. For example, you can inject <script src="//mysite.us/x/111"> into one possible location for XSS, and <script src="//mysite.us/x/112"> into another, keeping track of which URL went where. Then you crawl the rest of the site, and check the logs for "mysite.us" (example domain, obviously) to see which URL(s) get requested. You can then correlate those unique URLs to the injection attempts you made, to know what the exploitable vector is.

Some tools, such as the paid versions of Burp Suite, can automate this process for you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .