The two conditons must be met by the stored xss

1. must be reflected in page
2. must be stored in database

Follow same methodology as reflected xss (1) to find parameters.

In stored xss apart from parameters we also try to find xss in the below fileds

• [ ] we enter our payloads in every possible input field that we come across the website.
  • Comments
  • Profile bio
  • Username
  • Display name
  • Job title
  • File upload name
  • Support tickets
  • Chat systems
  • Notifications
  • Email templates
  • Admin dashboards
  • Blog comments
  • Product reviews
  • Forum posts
  • Feedback sections
  • Contact forms
  • Inbox messages
• [ ] Try this payload first on every input field “”” Mikey’”><ScrIpT>confirm(1)</ScrIpT>// ‘’’
• [ ] check whether basic tags were allowing or not like <script> <img> <svg>
• [ ] Inject code that matches the context you're in.

• [ ] enter each tag and check which tag is being allowed and which one is getting blocked
• [ ] try different combinations from this github link [ TAGS_COMBINATION.mdrix4uni/xss-payloads-generator]

if our special characters are being encoded into html entities then we can ignore that parameter

⚠️ Before ignoring a parameter, inspect ALL reflections (View Source + DOM + every rendering location). Ignore only if every occurrence of the input is consistently HTML-encoded or safely escaped in all contexts.

<script> tag is ignored = try case sensitive

alert is being filtered = use confirm(1) , prompt(1)

If our tags are being allowed but methods are being filtered then use these different types of methods

GitHub - rix4uni/xss-payloads-generator · GitHub