Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Link Manipulation (DOM-based)

Pedro | Last updated: Jan 29, 2019 05:16PM UTC

Hello, I'm scanning a website using Burp and I got the following issue, which I'm trying to replicate. However, I'm not really understanding what was injected and the supposed response. Could anybody help me clear this up? Thanks! PS: Sensitive data was replaced with (...) -------------------------------------------------------------------------------------------------------- Data is read from location.pathname and passed to element.setAttribute.href. The following value was injected into the source: ///(...)/(...)/(...)///wf380ayvhy%27%22%60'%22/wf380ayvhy/%3E%3Cwf380ayvhy//%3Es2mj7etijz& The previous value reached the sink as: ///(...)/(...)/(...)///wf380ayvhy%27%22%60'%22/wf380ayvhy/%3E%3Cwf380ayvhy//%3Es2mj7etijz&edit/ The stack trace at the source was: at Object.get pathname [as pathname] (<anonymous>:1:69939) at i.currentUrl (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:7:27478) at Ne.get (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15953) at Ne.evaluate (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:17103) at i.currentUrl (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:18946) at i.r (https://s(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:87347) at i.t._render (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:32655) at i.<anonymous> (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64072) at Ne.get (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15953) at new Ne (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15871) at https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64040 at i.pn.$mount (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64154) at i.pn.$mount (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:86816) at init (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:22422) at https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52545 at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52812) at h (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53397) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52926) at pn.__patch__ (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:57174) at pn.t._update (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:31651) at pn.<anonymous> (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64062) at Ne.get (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15953) at new Ne (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15871) at https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64040 at pn.$mount (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64154) at pn.$mount (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:86816) at pn.t._init (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:30152) at new pn (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:27467) at Object.170 (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:7:15203) at n (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:1:110)

Burp User | Last updated: Jan 29, 2019 05:17PM UTC

The sink stack trace is here due to size limitation. -------------------------------------------------------------------------------------------------------- The stack trace at the sink was: at HTMLAnchorElement.setAttribute (<anonymous>:1:79724) at ar (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:41219) at rr (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:40966) at Array.nr (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:40532) at g (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53641) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52941) at h (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53397) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52926) at h (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53397) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52926) at h (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53397) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52926) at h (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53397) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52926) at i.__patch__ (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:56893) at i.t._update (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:31651) at i.<anonymous> (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64062) at Ne.get (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15953) at new Ne (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15871) at https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64040 at i.pn.$mount (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64154) at i.pn.$mount (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:86816) at init (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:22422) at https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52545 at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52812) at h (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53397) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52926) at pn.__patch__ (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:57174) at pn.t._update (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:31651) at pn.<anonymous> (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64062)

Liam, PortSwigger Agent | Last updated: Jan 29, 2019 05:26PM UTC

Pedro, this is essentially an informational issue. Burp is telling you that you can change the pathname of the anchor.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.