[FrogSquad4]

I want to know how to upload a shell to a site with XSS. I have the admin login credentials, I don't know if that helps or not. I need a little help if someone could explain how to do that or link me to a tutorial. I did a little google researching and can't find one the seems to be very good.

[Gee4rce]

Assuming you mean a php shell or in general a server shell,
this will not work through XSS. XSS is a client-side vulnerabillity while you are looking for a server side shell.
Look up this tutorial, that's one method on how to upload a shell: https://hackforums.net/showthread.php?tid=1983985.

Or this one by Hax0r, sadfully the image links are outdated though: https://hackforums.net/showthread.php?tid=1736613

There are other methods, basically you can check this tutorial list and check for tuts that include shell uploading: https://hackforums.net/showthread.php?tid=2390363

Cheers, Gee.

[[BLANK]]

With just pure XSS the best you could do is get the victim to connect to a beef type service by injecting java script. That could lead you to getting a shell possibly. https://null-byte.wonderhowto.com/how-to...3-0161812/

If you have admin credentials can you access the admin panel? Because if you can access the admin panel and modify the web content you could replace a current resource with the shell code. http://www.securitytube.net/video/7082

[The Beep Beep Sheep]

Shell uploads are typically done through Local/Remote file inclusion. But as you have the admin login that's not necessary. I'm going with Gee, read that article.