Using Burp to Manually Test for Stored XSS - Port Swigger
Summary: PortSwigger's tutorial walks through generating a proof-of-concept stored XSS exploit against a version of Mutillidae from OWASP's Broken Web Application Project, using Burp Proxy to capture a request, Repeater to inject a payload such as "><script>alert(document.domain)</script>, and a second request to simulate the victim. The page notes it has not been updated for a while and its information may no longer be accurate.
What's compelling: Stored XSS executes in the browser of any user who views the affected content, letting an attacker steal session tokens or login credentials, act as the victim, and log keystrokes - and the tutorial's own alert(document.domain) payload shows exactly which domain that arbitrary JavaScript runs on.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026