HACKR.GG
Cross-Site Scripting

Stored XSS — Persistent Cross-Site Scripting

The most dangerous XSS variant. Your payload gets saved to the server and fires for every user who visits — no link-click required.

Beginner45 min11 lessons3 hands-on
Start free →I have an account
Free account. No credit card.

You'll be able to

  • ✓Exploit stored XSS in comment fields, profiles, and rich-text inputs
  • ✓Understand why stored XSS is higher impact than reflected
  • ✓Chain stored XSS with CSRF to perform admin actions
  • ✓Find stored XSS sinks by reading JavaScript source

Lessons

  1. 1The Samy Worm — 1 Million Friends in 20 Hours
  2. 2How Stored XSS Works
  3. 3Where Stored XSS Hides
  4. 4Lab Sim — SoleMate Shoe Blog
  5. 5Lab Sim — SVG File Upload
  6. 6Lab Sim — Forum Comment Thread
  7. 7Your Turn: Plant a Stored PayloadHANDS-ON
  8. 8Why Stored XSS Hits Everyone
  9. 9Prevention
  10. 10Lab — SoleMate Shoe BlogHANDS-ON
  11. 11Hands-on Lab: Exploit ChatterboxHANDS-ON
Start free →