Testing for stored XSS with Burp Suite - Port Swigger
Summary: PortSwigger's guide describes stored XSS as occurring when an application receives data from an untrusted source and includes it in later HTTP responses unsafely, with the exploit executing only when a user visits a particular location, such as a blog comment that runs when a victim views the post. The manual testing method uses Burp to identify linked input and output points by browsing in Burp's browser, reviewing requests in the Intercept tab, filtering Proxy > HTTP history for responses containing unique values, and grouping the two messages in Repeater.
Key Takeaway: A stored XSS payload sits in your application and fires for every user who reaches that page, so a single unvalidated comment field can reach your whole user base rather than one visitor.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026