Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Burp Scanner

Richard | Last updated: May 24, 2019 01:19PM UTC

I must be doing something wrong. How do I run Burp's Scanner as a point and click vulnerability scanner without it leaving XSS pop-ups in the site's production code? I had planned on reviewing the overall results of the scan and doing manual testing. I happened to be manually testing for command injection when I kept getting the traditional XSS pop ups on a window. When I looked at the source of the page there were multiple javascript alert functions already present in the code. The only thing I could figure was that the burp scanner identified the XSS vulnerability and had placed the <script>alert(1)</script> javascript in the site's code. Did I miss something? Does Burp's scanner modify/change code during scanning?

PortSwigger Agent | Last updated: May 24, 2019 02:14PM UTC