Tools

A production-grade XSS keylogger that handles network errors gracefully and logs each keystroke with confirmation — d...

Use an XSS injection to exfiltrate the victim's session cookie to your server — achieving full account takeover witho...

Inject hidden username and password fields into the DOM — browsers auto-fill them with saved credentials. A delayed f...

Many apps store JWTs, API keys, and user data in localStorage and sessionStorage. This XSS payload silently exfiltrat...

Replace the entire page with a cloned login form via XSS — the URL stays legitimate, the victim trusts it, and creden...

Attach a keydown event listener through an XSS payload to silently capture everything the victim types — passwords, s...

When the injection point is inside innerHTML, script tags don't fire — but img onerror does. This one-liner exfiltrat...

When inline script injection is blocked, host your payload externally and load it via a script src tag — bypassing le...

When WAFs and filters block raw XSS strings, Base64-encode your payload and use eval(atob()) or btoa(eval(atob())) to...

Understanding the fundamental JavaScript payload structure used in Cross-Site Scripting attacks — the foundation befo...