ndmmxiaomayi SG Nope. XSS doesn't download anything... it's either loaded via IFRAME or scripts. It depends on the technical skills of the attacker.