Simple Data Exfiltration Through XSS

This blog post documents a stored XSS vulnerability in a document management app and a step-by-step proof-of-concept for data exfiltration: the injected script loads a remote payload, uses the victim's privileged session to fetch a sensitive page, base64-encodes and splits the content into filename-sized chunks, then exfiltrates those chunks via repeated requests for non-existent image/JS filenames to an attacker server; the author also describes server-side capture and reconstruction commands.