Testing for blind XSS - Port Swigger
Summary: PortSwigger describes blind cross-site scripting as a form of stored XSS where the data exit point is inaccessible to the attacker, for example because of a lack of privileges. Its testing method uses Burp Suite to inject an XSS payload that may trigger an out-of-band interaction with the Burp Collaborator server, which Burp monitors to confirm the attack succeeded.
What you should know: The payload may only fire after a delay, such as when an administrator eventually views the page holding the stored payload, so a test that shows nothing at first can still be a live compromise waiting on a privileged viewer.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026