Skip to content
surge-sh-xss-payloads

Use Surge.sh: Free hosting for XSS payloads

Surge.sh flies under the radar of many, but it’s pretty common among static-site developers. I find it to be the best place for hosting my XSS payloads. It’s free, easy, they provide SSL, and you can deploy scripts in few seconds.

Table of Contents

What is Surge.sh?

Let’s say that you have found a nice little XSS, and you’ve managed to write a nice JavaScript payload to perform a full account takeover. The problem is, you need somewhere to host the payload. It can’t be over plain HTTP because otherwise you will face mixed-content errors. You can use Ngrok, but that means you need to keep your home computer on until your bug gets triaged which is not ideal. If you post it to Github pages then everyone can see notifications when you add the script, which gives away your PoC and tells the world which host is vulnerable.

I have been searching for the perfect way to do this for a long time, and I’ve finally found it. Surge.sh! This blog post will show you how to set up surge.sh to deploy your JavaScript payloads in seconds.

Step 1: Installation

  • First you will need to install NodeJS, which you can download here: https://nodejs.org/en/
  • Run the following command to install the surge CLI tool
npm install --global surge

That’s it, you’ve installed surge.

Step 2: Deploying Your Payload

Create an empty directory and navigate to it:

mkdir mypayload
cd mypayload

Create your JavaScript payload (or any static website).

echo "alert(1)" > payload.js

Run “surge” to deploy all files in the current directory, which should just be payload.js if you have been following along.

surge

The first time you run surge, it will ask for your email and a password. Once you’ve set that up it won’t ask you again.

The surge command usually takes a few seconds. Once it’s done, your payload will be accessible at the subdomain that you specified. In this case, I just used the automatically chosen one, which happened to be kind-wrench.surge.sh.

I should say that Surge isn’t just for XSS payloads, it is very good at hosting full static sites.

If you enjoyed this, follow me on my socials!

You might be interested in reading these too:
,
How I passed CEHv10 Post Exam Write-up
In this post I’d like to share my exam experience and to point out some of the best resources to help you prepare for and pass the Certified Ethical Hacker certification offered by EC-Council.
Top 10 Things to Do after Kali Linux Installation
Kali Linux, by default, probably doesn't have everything you need to get you through day-to-day penetration testing with ease. With a few tips, tricks, and applications, we can quickly get started using Kali like a
Protect MacOS Against Keyloggers & Ransomware
While MacOS computers have been spared from some of the most famous malware attacks, there is no shortage of malicious programs written for them. Keep your computer safe from some of the most common types
,
Fuzz Parameters, Directories & More with Ffuf
The art of fuzzing is a vital skill for any penetration tester or hacker to possess. The faster you fuzz, and the more efficiently you are at doing it, the closer you are to achieving
Set Up Pi-Hole®: Block ads for devices inside your network
If you are looking for a little toy project to pass some time during these days then this project may be for you. In this tutorial, we will install Pi-hole on a Raspberry Pi to
,
Top 5 Most Common Mobile App Security Flaws
Whether you’re a pentester looking to gain some experience in mobile hacking or a developer aiming to build secure apps, familiarizing yourself with some of the common security mistakes developers make will serve you well.