When we identify an XSS vulnerability, we usually use a simple alert(1) payload to demonstrate the successful execution of XSS. Although this can effectively prove the execution of JavaScript, it cannot highlight the type of actions that malicious attackers might actually perform on vulnerable web applications. Developing weaponized XSS payloads can better demonstrate the next steps that malicious attackers might take. @Xiaonil