XSS — Stored Keylogger with Error Handling
A production-grade XSS keylogger that handles network errors gracefully and logs each keystroke with confirmation — designed for stored XSS contexts where pe...
Categories
tools
XSS — Stealing Session Cookies
Use an XSS injection to exfiltrate the victim’s session cookie to your server — achieving full account takeover without knowing their password.
XSS — Stealing Browser-Saved Passwords
Inject hidden username and password fields into the DOM — browsers auto-fill them with saved credentials. A delayed fetch sends those credentials to your ser...
XSS — Stealing Local & Session Storage Secrets
Many apps store JWTs, API keys, and user data in localStorage and sessionStorage. This XSS payload silently exfiltrates all of it to your server.
XSS — Page-Replacement Phishing
Replace the entire page with a cloned login form via XSS — the URL stays legitimate, the victim trusts it, and credentials go directly to your server.
XSS — Keylogging via XSS
Attach a keydown event listener through an XSS payload to silently capture everything the victim types — passwords, search queries, form inputs — and stream ...
XSS — Escaping innerHTML: Cookie Steal via img onerror
When the injection point is inside innerHTML, script tags don’t fire — but img onerror does. This one-liner exfiltrates localStorage without needing a script...
XSS — Moving the Payload to an External Resource
When inline script injection is blocked, host your payload externally and load it via a script src tag — bypassing length limits and WAF rules that filter in...
XSS — Encoded & Obfuscated Payloads
When WAFs and filters block raw XSS strings, Base64-encode your payload and use eval(atob()) or btoa(eval(atob())) to execute it — bypassing signature-based ...
XSS — Basic JavaScript Payload
Understanding the fundamental JavaScript payload structure used in Cross-Site Scripting attacks — the foundation before moving to advanced XSS techniques.
payloads
XSS — Stored Keylogger with Error Handling
A production-grade XSS keylogger that handles network errors gracefully and logs each keystroke with confirmation — designed for stored XSS contexts where pe...
XSS — Stealing Session Cookies
Use an XSS injection to exfiltrate the victim’s session cookie to your server — achieving full account takeover without knowing their password.
XSS — Stealing Browser-Saved Passwords
Inject hidden username and password fields into the DOM — browsers auto-fill them with saved credentials. A delayed fetch sends those credentials to your ser...
XSS — Stealing Local & Session Storage Secrets
Many apps store JWTs, API keys, and user data in localStorage and sessionStorage. This XSS payload silently exfiltrates all of it to your server.
XSS — Page-Replacement Phishing
Replace the entire page with a cloned login form via XSS — the URL stays legitimate, the victim trusts it, and credentials go directly to your server.
XSS — Keylogging via XSS
Attach a keydown event listener through an XSS payload to silently capture everything the victim types — passwords, search queries, form inputs — and stream ...
XSS — Escaping innerHTML: Cookie Steal via img onerror
When the injection point is inside innerHTML, script tags don’t fire — but img onerror does. This one-liner exfiltrates localStorage without needing a script...
XSS — Moving the Payload to an External Resource
When inline script injection is blocked, host your payload externally and load it via a script src tag — bypassing length limits and WAF rules that filter in...
XSS — Encoded & Obfuscated Payloads
When WAFs and filters block raw XSS strings, Base64-encode your payload and use eval(atob()) or btoa(eval(atob())) to execute it — bypassing signature-based ...
XSS — Basic JavaScript Payload
Understanding the fundamental JavaScript payload structure used in Cross-Site Scripting attacks — the foundation before moving to advanced XSS techniques.
xss
XSS — Stored Keylogger with Error Handling
A production-grade XSS keylogger that handles network errors gracefully and logs each keystroke with confirmation — designed for stored XSS contexts where pe...
XSS — Stealing Session Cookies
Use an XSS injection to exfiltrate the victim’s session cookie to your server — achieving full account takeover without knowing their password.
XSS — Stealing Browser-Saved Passwords
Inject hidden username and password fields into the DOM — browsers auto-fill them with saved credentials. A delayed fetch sends those credentials to your ser...
XSS — Stealing Local & Session Storage Secrets
Many apps store JWTs, API keys, and user data in localStorage and sessionStorage. This XSS payload silently exfiltrates all of it to your server.
XSS — Page-Replacement Phishing
Replace the entire page with a cloned login form via XSS — the URL stays legitimate, the victim trusts it, and credentials go directly to your server.
XSS — Keylogging via XSS
Attach a keydown event listener through an XSS payload to silently capture everything the victim types — passwords, search queries, form inputs — and stream ...
XSS — Escaping innerHTML: Cookie Steal via img onerror
When the injection point is inside innerHTML, script tags don’t fire — but img onerror does. This one-liner exfiltrates localStorage without needing a script...
XSS — Moving the Payload to an External Resource
When inline script injection is blocked, host your payload externally and load it via a script src tag — bypassing length limits and WAF rules that filter in...
XSS — Encoded & Obfuscated Payloads
When WAFs and filters block raw XSS strings, Base64-encode your payload and use eval(atob()) or btoa(eval(atob())) to execute it — bypassing signature-based ...
XSS — Basic JavaScript Payload
Understanding the fundamental JavaScript payload structure used in Cross-Site Scripting attacks — the foundation before moving to advanced XSS techniques.
infosec
GuardianLeaks on pentest-ground.com — Web App Pentest Walkthrough
Step-by-step web-app pentest of GuardianLeaks — SQLi to a full credential dump, SSRF into cloud metadata, an easy-to-miss stored XSS, and an exposed Werkzeug...
DVGA on pentest-ground.com — GraphQL Pentest Walkthrough
Step-by-step: unauthenticated GraphQL introspection to full RCE on DVGA — 2 criticals, one HIGH SSRF, full kill chain.
pentest-ground.com — Web App Pentest Walkthrough
Step-by-step: SQLi, Werkzeug RCE and Broken Access Control on a Flask app — 3 criticals, full kill chain.
pentest
GuardianLeaks on pentest-ground.com — Web App Pentest Walkthrough
Step-by-step web-app pentest of GuardianLeaks — SQLi to a full credential dump, SSRF into cloud metadata, an easy-to-miss stored XSS, and an exposed Werkzeug...
DVGA on pentest-ground.com — GraphQL Pentest Walkthrough
Step-by-step: unauthenticated GraphQL introspection to full RCE on DVGA — 2 criticals, one HIGH SSRF, full kill chain.
pentest-ground.com — Web App Pentest Walkthrough
Step-by-step: SQLi, Werkzeug RCE and Broken Access Control on a Flask app — 3 criticals, full kill chain.
Walkthroughs
DVWA Full Web Assessment — pentest-ground.com
Full BlackOps web assessment of DVWA running on pentest-ground.com:4280. 20 confirmed findings across RCE, LFI/RFI, SQLi, XSS, CSRF, and broken access contro...
meta
Welcome to SweshInfoSec
Security research walkthroughs, VAPT findings, and bug bounty reports — documented with BlackOps.
iot-pentest
Test
Test Sub