Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Small Bug - onload instead of onerror

Alex | Last updated: Dec 15, 2015 04:30PM UTC

Burp is generating the following attack string: GET /asdf/cf941%3cimg%20src%3da%20onload%3dalert(1)%3e HTTP/1.1 URL decoded: <img src=a onload=alert(1)> When it should be using the following attack string: GET /asdf/cf941%3cimg%20src%3da%20onerror%3dalert(1)%3e HTTP/1.1 URL Decoded: <img src=a onerror=alert(1)> Even though this site is returning a 200 (the content for /a is HTML), onload does not fire, but onerror does. Unless I'm missing something, switching onload to onerror here should be a small improvement to this check.

PortSwigger Agent | Last updated: Dec 16, 2015 10:34AM UTC

Thanks for this report. We'll look into fixing Burp to generate the most useful proof-of-concept here.

PortSwigger Agent | Last updated: Dec 22, 2015 10:10AM UTC

This issue has been fixed in today's Burp release (1.6.33). Thanks again for your feedback, and let us know if you identify any other issues.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.