Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Burp not working correctly if WAF uses connection reset

Christian | Last updated: Dec 13, 2016 10:25AM UTC

Hi, I am currently expecting a strange issue with Burp, which affects the active scanner. I have used the active scanner against a web application which is protected by some kind of WAF. The WAF works like this: if the request contains "alert(" (without quotes), then reset connection I have analysed the requests with the "Flow" extension and it looks like that a few XSS payloads are actually working, e.g.: randomstring"> or javascript:/*</script><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+((new(Image)).src=([]+/\/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\.burpcollaborator.net/).replace(/\\/g,[]))//'> However, no XSS issues are reported within the active scanner. I assume that everything should work fine if a connection reset is handled as a "blank page" instead of an "error". I am happy to provide a testcase if needed This issue might be related to: https://support.portswigger.net/customer/portal/questions/16696410-scanner-ignore-errors-and-continue Many thanks, Christian

PortSwigger Agent | Last updated: Dec 13, 2016 11:23AM UTC