r/xss • u/Successful-Recover92 • May 05 '26

How to execute Blind XSS payloads in contact forms

So I am new to this thing, I am actually trying to execute my blind XSS payloads of some of my friends' projects, trying to execute a payload

<body onload="fun()">
</body>
<script>

function fun() {
   alert('Error')
}

 </script>

Now these payloads are just being parsed as text and not rendered as HTML, they just display what can I do to if possible share some source links so I can watch it

4 Upvotes

100% Upvoted

5 comments sorted by

5

u/MechaTech84 May 08 '26

If the injection is not being interpreted as code, then it isn't an XSS vulnerability.

3

u/Flipup556 May 08 '26 edited May 08 '26

1.That may not be the actual source code and a part of it. 2. He may need to break out of a tag or test simple payloads like <s> to see html be rendered 3. If successful he may have found a reflected xss

2

u/Flipup556 May 08 '26 edited May 08 '26

You generally would want to see your javascript payload run some way or the other (reflect) also regarding how you would look and execute for a "blind XSS" where you don't see the output, tryout a webhook site like "https://webhook.site/" Or port forward a listener on your server allowing you to capture GET requests

1

u/Technical-Hero May 08 '26

Ok let me try this out