skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

xss-stored

Guide stored and blind XSS exploitation during authorized penetration tests.

253|37|Updated Feb 22, 2026
Search Tags:#xss#penetration testing#web security#vulnerability exploitation#stored xss#blind xss
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill xss-stored
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: xss-stored
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/xss-stored
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill xss-stored

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit stored (persistent) and blind Cross-Site Scripting (XSS) vulnerabilities in web applications, which can impact other users or administrators.

Core Features & Use Cases

  • Stored XSS Identification: Detects input that is saved and rendered unsafely on subsequent page loads.
  • Blind XSS Exploitation: Aids in exploiting XSS that fires in contexts the attacker cannot directly observe, such as admin panels.
  • Payload Generation: Provides various payloads for different rendering contexts and bypasses.
  • Use Case: A penetration tester finds a comment section where user input is stored and displayed to all visitors. They use this Skill to inject a payload that steals admin session cookies when an administrator views the comment.

Quick Start

Use the xss-stored skill to test for stored XSS in the user profile's 'bio' field by submitting a canary payload.

Frequently Asked Questions about xss-stored

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is the difference between stored and blind XSS vulnerabilities?▼

Stored XSS persists malicious input in the application's storage to execute when other users view the page, whereas blind XSS fires in hidden contexts like admin panels and requires callback infrastructure to detect execution.

How do I exploit stored XSS in an HTML body or JavaScript context?▼

Exploit stored XSS by identifying unsafely rendered storage points and generating tailored payloads for HTML body, attribute, and JavaScript contexts to achieve execution upon subsequent page loads.

How do I set up callback infrastructure for blind XSS exploitation?▼

Set up blind XSS exploitation by using callback infrastructure like XSS Hunter to inject payloads into unseen admin panels, capturing execution callbacks and session details when the payload fires.

Can I bypass Content Security Policy when injecting persistent XSS payloads?▼

Yes, this Skill assists with CSP bypasses and sanitization challenges by generating diverse payloads adapted to specific rendering contexts to evade active Content Security Policy restrictions.

Does this Skill support generating payloads for file upload contexts?▼

Yes, the Skill generates diverse exploitation payloads specifically designed for file upload contexts, alongside standard HTML body, attribute, and JavaScript rendering environments.

Related Skills

Explore More Software Engineering Skills→
xijunwwxijunww
1

payload-research

Craft and analyze XSS, SQLi, SSTI, and command injection web vulnerability payloads.

Community
Advanced
CharlesKozelCharlesKozel

pentest-coordinator

Coordinate pentest campaigns with a ReAct loop for recon, exploitation, and privilege escalation.

Community
Advanced
AeonDaveAeonDave
15

mitmproxy

Intercepts, inspects, modifies and replays HTTP/HTTPS web traffic via Python-enabled scripting.

Community
Intermediate
xalgordxalgord
846

dom-xss

Detect and analyze DOM-based XSS vulnerabilities in client-side applications.

Community
Advanced