I'll start off by saying this is a purely academic question; I'm trying to fill some gaps in my knowledge.
If a website is vulnerable to XSS, and the target host is another machine that can browse to that webpage, does that then mean that the target is exploitable even if it can't communicate with the pentester's machine (or the outside world)? If so, what sort of attack would be utilised? Is this where XST is employed?
Hope that makes sense. Thank you.