>Home>Labs>New labs>Creators>Ranking>Learn>Business>Pricing
ES
Sign inCreate account
Home·Academy·Topics·stored xss
Topic · 3 articles

stored xss

Persistent XSS stored in the database. Every visitor receives the payload.

Quick answer

What is stored xss?

Persistent XSS stored in the database. Every visitor receives the payload.

Articles

3

Beginner

1

Intermediate

2

Advanced

0

Beginner level

1
Free€1.200

Stored XSS in template names — from the most boring field to domain takeover

A template title field, unsanitized, in a session with permissions over domains. A real €1,200 bounty. How to find XSS where nobody looks.

12 minxssstored-xssaccess-delegation
Read article

Intermediate level

2
With account€1200

Stored XSS €1200 — sanitizer bypass via SVG href javascript: with entity encoding

Walkthrough of a real €1200 report: stored XSS in POE bypassing a sanitizer fix via SVG with href=`javascript:` and HTML entity encoding over the filtered characters.

12 minxssstored-xsssvg
Read article
Free

Stored XSS via SVG with href javascript: in chat — reclassification of Self-XSS

An SVG payload uploaded as an attachment. Filter bypassed. Rendered inline in the main context. Any chat participant is exposed on click.

11 minxssstored-xsssvg
Read article

Practice stored xss with real labs

Apply the techniques in safe environments based on real bug bounty reports.

See stored xss labs
All topicsAcademy
hunters training
711

hunters training

labs from real reports
55

labs from real reports

completions
1,205

completions

in bounties practiced
$213,970

in bounties practiced

46 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy
BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.

Create free accountSee the labs

No card · free Academy · cancel anytime