| name | xss-data-exfiltration |
| description | Generate JavaScript payloads for XSS data exfiltration during authorized penetration testing. Use this skill whenever you need to extract sensitive data (cookies, page content, internal ports) from a compromised browser context through various channels (images, XHR, fetch, beacon, location). This is for security testing only - ensure you have explicit authorization before using these techniques. |
XSS Data Exfiltration
This skill helps you create JavaScript payloads to exfiltrate data from compromised browser contexts during authorized penetration testing. It supports multiple exfiltration channels to bypass different security controls.
When to Use This Skill
Use this skill when:
- You've identified an XSS vulnerability and need to extract sensitive data
- You need to test what data can be exfiltrated from a compromised page
- You're conducting authorized security assessments
- You need to bypass specific security controls (CSP, firewalls, etc.)
⚠️ Authorization Required: Only use these techniques on systems you own or have explicit written permission to test.
Exfiltration Methods
The skill supports 7 different exfiltration channels:
| Method | Description | Best For |
|---|
EXFIL_BY_IMG | Image tag requests | Bypasses some WAFs, simple |
EXFIL_BY_RQ_GET | XMLHttpRequest GET | Reliable, standard |
EXFIL_BY_RQ_POST | XMLHttpRequest POST | Larger payloads, POST data |
EXFIL_BY_FETCH_GET | Fetch API GET | Modern browsers, no-cors |
|
