Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Burp Scanner Found Dom Based Open Redirect

Shvuo | Last updated: Jun 17, 2020 07:38PM UTC

Hello, My Burp Scanner Found DOM Based Open Redirect. I tried to execute this open redirect several time but i don't get any result . can you tell me , is it False Positive ? =function(e){var t=window.location.href.indexOf("#");window.location.replace(window.location.href.slice(0,t>=0?t:0)+"#"+e)},m=function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};a()(l.b,"Hash history needs a DOM") Is there any possibility to execute the DOM Based Open Redirect ? Thank you

Liam, PortSwigger Agent | Last updated: Jun 18, 2020 11:18AM UTC

Hi Shuvo, it looks like this is a DOM redirection, albeit quite limited. If the attacker controls the "e" variable then they can redirect to a URL on the same domain via the hash e.g. from google.com to google.com#something.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.