Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Confirmed false-negative related to AngularJS XSS

Nicolas | Last updated: Jan 17, 2020 12:13PM UTC

Hi! Creating a new ticket given that the previous one 1) doesn't in my cases 2) isn't very clear https://support.portswigger.net/customer/en/portal/questions/17690810-false-negative-in-angularjs-xss- Burp Suite will not detect client-side template injections (aka a false-negative) when the 'ng-app' attribute is located _before_ the tags loading AngularJS Javascript files. https://docs.angularjs.org/api/ng/directive/ngApp DETECTED: <html><head> <script src="/js/angular-1.0.0.min.js"></script> <body ng-app> NOT DETECTED: <html><head ng-app> <script src="/js/angular-1.0.0.min.js"></script> <body>

Ben, PortSwigger Agent | Last updated: Jan 17, 2020 01:39PM UTC