Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Burp Scanner

Richard | Last updated: May 24, 2019 01:19PM UTC

I must be doing something wrong. How do I run Burp's Scanner as a point and click vulnerability scanner without it leaving XSS pop-ups in the site's production code? I had planned on reviewing the overall results of the scan and doing manual testing. I happened to be manually testing for command injection when I kept getting the traditional XSS pop ups on a window. When I looked at the source of the page there were multiple javascript alert functions already present in the code. The only thing I could figure was that the burp scanner identified the XSS vulnerability and had placed the <script>alert(1)</script> javascript in the site's code. Did I miss something? Does Burp's scanner modify/change code during scanning?

PortSwigger Agent | Last updated: May 24, 2019 02:14PM UTC

Burp's active scanner absolutely does inject payloads during scanning. This is the way all dynamic scanners work, it is necessary to detect XSS and other flaws with confidence. Burp does not actually modify the site's source code; it sounds like you've got stored XSS which is causing this effect. We advise running Burp against a development version of the site, to avoid polluting production data like this.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.