Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Maybe not a bug, xss reported by Burp

Luca | Last updated: Feb 14, 2019 09:21PM UTC

I came across an xss found by the scanner and reported as Certain. test74666'%3balert(1)%2f%2f901vivg94 I was not able to reproduce it manually until I put a ) between the ' and the ; -> %3b. I'm wondering why Burp doesn't report it - so to speak - correctly. Thanks in advance.

PortSwigger Agent | Last updated: Feb 15, 2019 08:29AM UTC

The Burp XSS test has quite a lot of logic to understand different contexts, but it focuses on determining whether something is exploitable or not, rather than generating a working PoC. This is where a manual tester can add value. Presumably the injection was into a context like: bc. function('data[INJECTION HERE]');

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.