Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

XSS DOM-Based

Mike | Last updated: Jun 19, 2018 04:14PM UTC

Hi, I'm a relative n00b trying to understand DOM-based XSS from the following issue reported by Burp. I'm trying to figure out if this is false-positive or not. Having difficulty putting together a POC, identifying the sources and sinks. Data is read from window.location.pathname and passed to $() via the following statements: var href=window.location.pathname; href=href.substr(href.lastIndexOf('/') + 1); var li=$('a[href^="' + href + location.hash + '"]').parent('li.chapter').first(); Thanks, Mike

PortSwigger Agent | Last updated: Jun 19, 2018 04:17PM UTC

Hi Mike, We think that this code is not exploitable, because the fixed string 'a[href^="' is included before the tainted data. To confirm this, please try the POC in Edge. Other browsers URL encode location.hash so would not be exploitable. If vulnerable, a simple payload like this should trigger it: #<script>alert(1)</script> Please let us know if you need any further assistance.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.