Blind XSS.

A stored XSS variant where the payload fires in a context the attacker cannot directly see, typically an internal admin panel or back-office tool. It belongs to the Attacks & Threats category of cybersecurity.

A stored XSS variant where the payload fires in a context the attacker cannot directly see, typically an internal admin panel or back-office tool.

Blind XSS is a subclass of stored XSS in which the malicious script does not execute in the attacker's own browser, but in a different, usually privileged, context — a customer-support ticket view, a fraud-review console, an internal dashboard, or a backup report. The attacker submits a payload through a public form (contact, registration, support request) and waits for an internal user to render the saved data. Detection relies on out-of-band callbacks: the payload exfiltrates data to a tracker such as XSS Hunter, Burp Collaborator, or a custom DNS/HTTP server, revealing where the script ran. Defenses are identical to stored XSS plus strong CSP on admin tools.

Defences for Blind XSS typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Out-of-band XSS.