Aller au contenu
XSS · Cross-Site Scripting

One comment.
One compromised account.

A script hidden in an internal forum is enough to steal a manager's session. No suspicious click. No download. No alert. The browser runs the code the moment the page opens.

Stored XSSCookie theftSession hijackingOWASP A03
intranet.monentreprise.com/forum/equipe-rh
HR Forum
Intranet — HR Team Forum
SL
Sophie Laurent — HR Manager
MC

Marc Charpentier

2h ago · HR Generalist

Great meeting this morning! The new onboarding process is really well thought out.

NB

Nadia Bertin

1h ago · Payroll Manager

Agreed with Marc. The checklist shared yesterday is very useful for new hires.

?

Unknown account

5 min ago · External access

External access

Great article! Very useful for the team.

Step 1 of 4

An internal forum open to everyone

Every comment is stored and then shown to all team members

The vector: any free-text input field

Forums, comment sections, search fields, contact forms. Anywhere a user can write text that's later shown to others, an XSS flaw can exist if the data isn't handled properly.

Key figures

#0

OWASP Top 10

Injection (incl. XSS)

0

Clicks required

for Stored XSS

Potential victims

per stored comment

< 0s

To steal a cookie

via a silent fetch()

🎯

Concrete impact for your organization

A stolen session grants access to the account with no password, no alert, often without the victim even noticing. A single script injected into an internal tool (intranet, ticketing, chat) is enough to compromise dozens of accounts within hours.

Technical demo

Try it yourself

This simulation lets you inject a real XSS payload and watch its behavior in a controlled environment. Intended for technical teams and trainers.

Interactive demo

Inject an XSS payload

Controlled simulation

No injection simulated

Choose a payload or type your own, then click Simulate

Stored vs Reflected

A stored XSS persists in the database — every visitor becomes a victim. A reflected XSS only exploits the session of whoever clicks a rigged link.

How to protect against it

  • Escape HTML server-side before rendering
  • Strict Content Security Policy (CSP)
  • Cookies marked HttpOnly