Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Finding XSS

Santosh | Last updated: Nov 05, 2015 10:38AM UTC

Hello , In most of the scans using Burp for XSS , I can see only HTTP 302 responses for the different XSS payloads, is there a best way to find XSS using Burp for more complex application.

Liam, PortSwigger Agent | Last updated: Nov 05, 2015 10:45AM UTC

Hi Santi Thanks for your message. Just to clarify, do you mean that Burp Scanner is finding XSS vulnerabilities, and you are having trouble replicating them? Or that is is failing to find known vulnerabilities in an application you are testing?

Burp User | Last updated: Nov 10, 2015 03:17AM UTC

Thanks for your mail. I'm seeing HTTP 302 responses for most of the XSS payloads , not sure if its finding XSS vulnerabilities as I do not see in "Issues" found. Is there a best way to replicate XSS vulnerabilities using Burp .

Liam, PortSwigger Agent | Last updated: Nov 10, 2015 12:28PM UTC

Hi Santi The scanner will automatically follow redirects by default, so redirects should not cause any issues. If no XSS vulnerabilities appear in the "Issues" tab, then Burp Scanner has not found any XSS vulnerabilities. We would always recommend manual testing to complement automated scanning. There are many categories of critical bugs that can only be found through human understanding and experience. For these reasons, fully automated testing by any scanner will provide incomplete coverage.

Liam, PortSwigger Agent | Last updated: Nov 10, 2015 12:37PM UTC

Hi Santi If you are wanting to manually validate XSS issues, we would recommend using Burp Repeater - https://support.portswigger.net/customer/en/portal/articles/1965737-Methodology_XSS.html. We will be producing a more comprehensive set of tutorials for demonstrate how to use Burp Suite to test for XSS issues in the near future, so do look out for those.

Burp User | Last updated: Nov 10, 2015 01:19PM UTC

Hello If I send my POST to Intruder scan with XSS payloads at different insertion points I get either HTTP 200 or HTTP 302 as response so in such cases how can I identify if there is a XSS vulnerabilities with the XSS payloads I used.

Burp User | Last updated: Dec 24, 2015 09:34AM UTC

Do we now have more comprehensive set of tutorials for demonstrate how to use Burp Suite to test for XSS issues ?

Liam, PortSwigger Agent | Last updated: Dec 24, 2015 09:37AM UTC

Hi Santi The new XSS tutorial section will appear in the Support Center in January. We will provide you with a link to the new section when it is published.

Burp User | Last updated: Jan 23, 2016 02:58PM UTC

Do we now have more comprehensive set of tutorials for demonstrate how to use Burp Suite to test for XSS issues

PortSwigger Agent | Last updated: Jan 25, 2016 09:18AM UTC

These tutorials are being finalized and will be published soon.

PortSwigger Agent | Last updated: Feb 19, 2016 09:36AM UTC

Yes - see the XSS section here: https://support.portswigger.net/customer/en/portal/articles/2326039-the-burp-methodology-

Burp User | Last updated: Mar 02, 2016 06:51AM UTC

Wanted to check if the said XSS tutorials are ready to be consumed ?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.