I'll start off by saying this is a purely academic question; I'm trying to fill some gaps in my knowledge.

If a website is vulnerable to XSS, and the target host is another machine that can browse to that webpage, does that then mean that the target is exploitable even if it can't communicate with the pentester's machine (or the outside world)? If so, what sort of attack would be utilised? Is this where XST is employed?

Hope that makes sense. Thank you.

  • You might need to define your expectations for 'exploitable' on the target-side.
    – schroeder
    Oct 6, 2014 at 23:21
  • Really, at this stage I'm just curious as to what information could be relayed from that target, through the vulnerable server, to the attacking machine.
    – shemly4000
    Oct 6, 2014 at 23:30
  • do you assume you have control over the web server? or just that you can execute a XSS attack?
    – schroeder
    Oct 7, 2014 at 17:10

1 Answer 1


I'm a bit confused about your question, but it seems like a framework like BeEF might do what you are talking about.

This is an interesting project that allows you to drop a hook into a site that contains an XSS vulnerability and then gives you a dashboard that displays who has loaded the page.

From here you can target specific users with all types of stuff. In your case, if you wanted to exploit their machine, you could display something to a user that prompted them to download some sort of file that contained whatever you wanted.

Take a look at this demo if you have 10 minutes. Shows some pretty cool stuff.

  • Thanks -- this is certainly interesting. To clear up my original question a little, the situation I'm picturing is::: (A) ---> (XSS-vulnerable Server) <--- (C) Where A is the attacking machine and C is the target to be exploited; A and C have no direct method of communicating as C is on a private network.
    – shemly4000
    Oct 6, 2014 at 23:38
  • And you want to do something on C's machine? Not necessarily only in the browser? Oct 6, 2014 at 23:39
  • Well, it was my (probably incorrect) understanding that in order for A (running BeEF for instance) to be able to exploit C, a direct connection would have to be made between the two. I guess the question I'm asking is what's possible when C can connect to the server and the server alone.
    – shemly4000
    Oct 6, 2014 at 23:43
  • @shemly4000 your attack vector is the browser because that's how you are interacting. You could, as Abe said, try to coerce the target to download a payload from the server via XSS, but mostly this vector is about browser and web attacks. Credentials, session keys, DoS, injecting ads or other content, etc.
    – schroeder
    Oct 7, 2014 at 17:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .