skills.rest
securityfortech
securityfortechOFFICIAL
Explore all skills by this author →
WebsiteGitHub

xss-stored

Detects and exploits stored cross-site scripting vulnerabilities in web applications.

6|1|Updated Mar 9, 2026
Search Tags:#vulnerability#xss#injection#web security#pentest#stored xss
One-click install
npx skills add https://github.com/securityfortech/hacking-skills --skill xss-stored-securityfortech
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: xss-stored
Source: https://github.com/securityfortech/hacking-skills/tree/main/skills/web/injection/xss-stored
Command: npx skills add https://github.com/securityfortech/hacking-skills --skill xss-stored-securityfortech

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and helps exploit Stored Cross-Site Scripting (XSS) vulnerabilities, where malicious input is permanently stored on the target server and impacts multiple users.

Core Features & Use Cases

  • Identify Injection Points: Detects common areas where user input is stored and re-displayed (e.g., comments, profiles, file uploads).
  • Payload Delivery: Provides payloads for cookie exfiltration, BeEF hooks, and phishing.
  • Use Case: An attacker can inject a script into a public comment section that steals the session cookies of any administrator who views that comment, leading to account takeover.

Quick Start

Use the xss-stored skill to test for stored XSS in the user profile's bio field.

Frequently Asked Questions about xss-stored

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect stored XSS vulnerabilities in web applications?▼

Stored XSS vulnerabilities are detected by injecting malicious scripts into persistent input fields like comments, profiles, and file uploads to verify if the payload executes when the stored data is re-displayed to users.

What payloads are used for stored cross-site scripting exploitation?▼

Stored cross-site scripting exploitation utilizes payloads designed for cookie exfiltration, session hijacking, BeEF hooks, and phishing to take over user accounts when infected pages are viewed.

Do I need Burp Suite or OWASP ZAP to test for persistent XSS?▼

Burp Suite or OWASP ZAP are required to effectively test for persistent XSS, as these tools provide the necessary interception and bypass capabilities for successful payload delivery and vulnerability validation.

What is the difference between stored XSS and other web injection attacks?▼

Stored XSS differs from other web injection attacks because the malicious input is permanently saved on the target server, allowing it to impact any multiple users who view the infected page.

Can persistent XSS vulnerabilities lead to full account takeover?▼

Persistent XSS vulnerabilities can lead to full account takeover by injecting scripts into public areas like comment sections that automatically steal the session cookies of administrators viewing the content.

Related Skills

Explore More Software Engineering Skills→
giosuetedeschi-specgiosuetedeschi-spec

Burp Suite Web Application Testing

Intercept and modify HTTP traffic to test web application security.

Community
Advanced
zaiyemeiyou404zaiyemeiyou404

ctf-web-encoding-bypass

Bypass web application defenses and extract data from CTF challenges.

Community
Advanced
zebbernzebbern
4.5k

Red Team Tools and Methodology

Automate red-team reconnaissance and vulnerability discovery workflows.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

vuln-dom-xss

Trace attacker-controlled JavaScript sources to dangerous execution sinks.

Community
Advanced