{"id":26224,"date":"2015-09-07T16:05:30","date_gmt":"2015-09-07T10:35:30","guid":{"rendered":"https:\/\/2thenew.xyz\/blog\/?p=26224"},"modified":"2016-12-19T15:17:46","modified_gmt":"2016-12-19T09:47:46","slug":"using-sleepy-puppy-a-cross-site-scripting-payload-management-framework","status":"publish","type":"post","link":"https:\/\/2thenew.xyz\/blog\/using-sleepy-puppy-a-cross-site-scripting-payload-management-framework\/","title":{"rendered":"Sleepy Puppy Tutorial : An XSS Payload Management Framework"},"content":{"rendered":"

Sleepy Puppy is a payload management framework for Cross Site Scripting that enables security engineers to simplify the process of capturing, managing, and tracking XSS propagations.<\/p>\n

Delayed XSS (a variant of stored XSS)<\/strong><\/span><\/h3>\n

Delayed XSS testing is testing that can be used to extend the scope of attack beyond the immediate effect of particular payload. With delayed XSS, one can inject a payload on an application and it may get reflected back in a separate application on a different origin.<\/p>\n

\"pasted
\nSource: www.techblog.netflix.com<\/strong><\/h6>\n

 <\/p>\n

An XSS payload is injected into the App #1 Server. This payload gets stored in the database and will be reflected in second application App #2 Server. We can\u2019t access the vulnerable application, but the vulnerability could still be exploited by an attacker on a user. These types of vulnerabilities can be more dangerous since the victims are likely to be privileged types of users eg. administrators.<\/p>\n

We will configure an environment on localhost and let’s understand how the Sleepy Puppy framework will be used to test the traversal of XSS payload injected in the application.<\/p>\n

Pre-Requisites:<\/strong><\/span><\/h3>\n