exploiting-cross-site-script-inclusion-xssi - Exploiting Cross-Site Script Inclusion (XSSI)
Identify and exploit Cross-Site Script Inclusion vulnerabilities to read sensitive data from static scripts, dynamic JS, JSONP responses, and non-JS files cross-origin.
Tags
Updated: 2026-06-30Capabilities
Typical Inputs
Typical Outputs
What this skill does
- find script and JSONP endpoints
- detect dynamic JavaScript via cookie diffing
- read global variables from included scripts
- hijack JSONP callback functions
- override built-in prototypes for data capture
- include non-JS files as scripts
- test UTF-7 charset escape variants
- generate XSSI vulnerability reports
Inputs
- Target endpoint URLs
- Proxy history logs
- Victim session cookies
- Authorization scope document
Outputs
- XSSI vulnerability findings
- Exfiltrated sensitive data evidence
- Vulnerability assessment report
Requirements
- Authorized engagement scope covering cross-origin data disclosure
- Attacker-controlled web page hosting
- Burp Suite with DetectDynamicJS extension
- Modern and legacy browser test matrix
- Out-of-band data collection endpoint