> For the complete documentation index, see [llms.txt](https://n3t-hunt3r.gitbook.io/pentest-book/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n3t-hunt3r.gitbook.io/pentest-book/web-application-pentesting/xss-cross-site-scripting/server-side-xss-less-than-dynamic-pdf-greater-than.md). # Server Side XSS \ ### Server Side XSS (Dynamic PDF) If a web page is creating a PDF using user controlled input, you can try to **trick the bot** that is creating the PDF into **executing arbitrary JS code**.\ So, if the **PDF creator bot finds** some kind of **HTML** **tags**, it is going to **interpret** them, and you can **abuse** this behaviour to cause a **Server XSS**. Please, notice that the ` ``` #### SVG Any of the previous of following payloads may be used inside this SVG payload. One iframe accessing Burpcollab subdomain and another one accessing the metadata endpoint are put as examples. ``` ``` #### Path disclosure ``` ``` #### Load an external script The best conformable way to exploit this vulnerability is to abuse the vulnerability to make the bot load a script you control locally. Then, you will be able to change the payload locally and make the bot load it with the same code every time. ``` ')"/> ``` #### Read local file ``` ``` ``` ``` #### Get external web page response as attachment (metadata endpoints) ``` ``` #### Bot delay ``` ``` #### Port Scan ``` ``` #### [SSRF](https://github.com/carlospolop/hacktricks/blob/master/pentesting-web/ssrf-server-side-request-forgery.md) This vulnerability can be transformed very easily in a SSRF (as you can make the script load external resources). So just try to exploit it (read some metadata?). ### References {% embed url="" %} {% embed url="" %} {% embed url="" %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://n3t-hunt3r.gitbook.io/pentest-book/web-application-pentesting/xss-cross-site-scripting/server-side-xss-less-than-dynamic-pdf-greater-than.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.