Discover if a JavaScript payload ran successfully or not

user_18122300 0
Viewed 39

I am using Lua with the HTTP library and I am creating a script that will test for XSS This is the payload i'm using

<image/src/onerror=prompt(8)>

Now the script will do an HTTP request to the website and adding the payload after the query like this ip/?query=<image/src/onerror=prompt(8)>

How can I tell if the prompt was successful and the payload is working?

Are there any hints in the source code or the HTTP request so i can now that the site is vulnerable to XSS?

lua http javascript
1 Answers

No.

Just doing a request and retrieving the resulting HTML source won't have executed the JavaScript (client-side) prompt(8) invocation.

You would need to use a browser to see if the code gets executed; in your case, probably a scriptable browser runner such as Playwright or Puppeteer.

AKX_516850
Related