Dancer in the Dark - Synthesizing and Evaluating Polyglots for Blind Cross-Site Scripting

Oct 14, 2026

Upload by Asher

Cross-Site Scripting (XSS) remains a major security risk in web applications, yet most automated analysis and detection methods depend on observable code or application feedback. For blind XSS (BXSS), inputs propagate from a public frontend to an internal backend without external evidence. The paper presents a comprehensive BXSS study, validating vulnerabilities via blind code execution, synthesizing polyglots with Monte Carlo tree search, and measuring effectiveness on real-world client-side issues and large-scale Tranco website analyses.

LanguageEnglish

CategoryPresentations

FormatPDF

Pages18

Reading Time6 min

AccessFree to download

Abstract

1 Introduction

Dancer in the Dark: Synthesizing and Evaluating Polyglots for Blind Cross-Site Scripting arXiv :2502 .08467v1 [ cs .CR] 12 Feb 2025 Robin Kirchner ∗†, Jonas Möller‡, Marius Musch†, David Klein†, Konrad Rieck‡, Martin Johns† † Technische Universität Braunschweig, Germany ‡ Technische Universität Berlin, Germany {robin.kirchner, m.musch, david.klein, [m.johns}@tu-braunschweig.de](m.johns}@tu-braunschweig.de)[ ](m.johns}@tu-braunschweig.de){jonas.moeller.1, [rieck}@tu-berlin.de](rieck}@tu-berlin.de) Abstract Cross-Site Scripting (XSS) is a prevalent and well known security problem in web applications. Numerous methods to automatically analyze and detect these vulnerabilities exist. However, all of these methods require that either code or feedback from the application is available to guide the detection process. In larger web applications, inputs can propagate from a frontend to an internal backend that provides no feedback to the outside. None of the previous approaches are applicable in this scenario, known as blind XSS (BXSS) . In this paper, we address this problem and present the first comprehensive study on BXSS. As no feedback channel exists, we verify the presence of vulnerabilities through blind code execution. For this purpose, we develop a method for synthesizing polyglots, small XSS payloads that execute in all common injection contexts. Seven of these polyglots are already sufficient to cover a state-of-the-art XSS testbed. In a validation on real-world client-side vulnerabilities, we show that their XSS detection rate is on par with existing taint tracking approaches. Based on these polyglots, we conduct a study of BXSS vulnerabilities on the Tranco Top 100 ,000 websites. We discover 20 vulnerabilities in 18 web-based backend systems. These findings demonstrate the efficacy of our detection approach and point at a largely unexplored attack surface in web security. 1 Introduction Web applications are ubiquitous—so are their security problems. In particular, the vulnerability class of Cross-Site Scripting (XSS) remains one of the major security issues on the Web. Over the past decade, XSS has been studied extensively, with a focus on approaches to detect these flaws in existing applications. This detection relies on the identification of insecure data flows from attacker-controlled inputs into security-sensitive sinks. The actual techniques to pursue this goal vary, but they all rely on the availability of observable evidence of such data flows. This can be as simple as the ∗Corresponding author re-identification of an input string in the application’s HTML, in the case of manual bug hunting, and as sophisticated as fully automatic taint analysis. This poses a problem for an often overlooked component of large web applications: the backend. Similar to the use of web technologies in its public frontend, the same application often employs web interfaces for its internal backends. These interfaces, inaccessible from the public internet behind a firewall, serve various internal application functions, including administration of the application, usage analysis, and back-office tasks such as supply chain management and accounting. Not different from public web applications, internal web tools are also susceptible to security problems in general and XSS in particular. As these backend systems process data generated by the application’s public counterpart, there is a high likelihood of data from potentially malicious, attackersupplied inputs flowing into the backend’s web code. This situation opens the door for XSS attacks on internal application components. However, current XSS detection techniques fall short in finding such flaws, as no evidence of problematic data flows can be obtained. All effects of the public-to-internal flows remain within the constraints of the internal systems. Testing tools operating from the outside are literally “blind”to any side effects caused by injection attempts. I

FAQs

What makes blind XSS (BXSS) different from traditional XSS testing?

BXSS lacks observable feedback channels from the system-under-test, so detection cannot rely on evidence of data-flow effects. Verification is done by injecting and executing JavaScript code blindly.

How do the authors detect BXSS vulnerabilities without feedback?

They synthesize polyglots—small XSS payloads that execute across common injection contexts—and then confirm vulnerabilities through blind code execution outcomes.

How effective are the generated polyglots compared with existing approaches?

Validation on real-world client-side vulnerabilities shows their detection rate matches taint tracking approaches. In comparisons with precise payload generation, the polyglots trigger 147 vulnerabilities versus 145, and outperform a manually crafted “Ultimate Polyglot”.

Oct 14, 2026

Upload by Asher