Loading module…
img onerror or fetch may work. Strict CSP that disallows inline scripts and restricts destinations can mitigate it."}},{"@type":"Question","name":"What is the difference between reflected, stored, and blind XSS?","acceptedAnswer":{"@type":"Answer","text":"Reflected XSS appears immediately in the response. Stored XSS is saved on the server and shown to other users. Blind XSS is a stored XSS that executes in a context the attacker cannot see, requiring out-of-band detection."}},{"@type":"Question","name":"How do you prevent blind XSS?","acceptedAnswer":{"@type":"Answer","text":"Sanitize all user input with output encoding appropriate for the context (HTML, JS, URL). Use a strict CSP. Separate admin interfaces and escape content when displayed to admins."}},{"@type":"Question","name":"What is an example of a real-world blind XSS vulnerability?","acceptedAnswer":{"@type":"Answer","text":"In 2023, a blind XSS was found in a popular customer support platform where ticket comments were displayed unsanitized to agents. Attackers stole session cookies by injecting payloads."}},{"@type":"Question","name":"What is the role of a webhook in blind XSS?","acceptedAnswer":{"@type":"Answer","text":"A webhook provides an HTTP endpoint that captures incoming requests. Attackers use services like Webhook.site to receive data from blind XSS payloads without needing their own public server."}},{"@type":"Question","name":"Can blind XSS be used for privilege escalation?","acceptedAnswer":{"@type":"Answer","text":"If the payload executes in an admin's browser, the attacker can perform actions on behalf of that admin, such as creating accounts, changing settings, or accessing sensitive data."}},{"@type":"Question","name":"What is XSS Hunter and why is it useful?","acceptedAnswer":{"@type":"Answer","text":"XSS Hunter (now deprecated) was a service that provided unique subdomain and payload generation to detect blind XSS. Modern alternatives include Interact.sh and Burp Collaborator."}},{"@type":"Question","name":"How do you test for blind XSS in a web application?","acceptedAnswer":{"@type":"Answer","text":"Submit payloads to all input fields (forms, comments, URL parameters) and monitor your listener for callbacks. Try different HTML contexts: attributes, scripts, events."}},{"@type":"Question","name":"What is the impact of blind XSS?","acceptedAnswer":{"@type":"Answer","text":"Impact includes theft of session cookies, credential harvesting, defacement, and unauthorized actions. If the victim is an admin, full compromise of the application is possible."}},{"@type":"Question","name":"What is the difference between self-XSS and blind XSS?","acceptedAnswer":{"@type":"Answer","text":"Self-XSS requires the victim to copy/paste malicious code into their own browser console. Blind XSS does not require user interaction; it executes automatically when the victim views the content."}},{"@type":"Question","name":"Can blind XSS be exploited in mobile applications?","acceptedAnswer":{"@type":"Answer","text":"If a mobile app renders web content without proper sanitization (e.g., WebView), blind XSS can occur. The payload would execute in the WebView context."}},{"@type":"Question","name":"What encoding is needed for blind XSS payloads?","acceptedAnswer":{"@type":"Answer","text":"Payloads may need URL encoding for HTTP parameters, HTML entity encoding for contexts where angle brackets are escaped. However, many blind XSS vulnerabilities occur where no encoding exists."}},{"@type":"Question","name":"How do you exfiltrate data if JavaScript is blocked?","acceptedAnswer":{"@type":"Answer","text":"Even if JavaScript is blocked for script tags, event handlers like onerror or onload can execute code. If those are blocked, use Loading module…