Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Cross-site scripting (DOM-based)

Adrián | Last updated: Dec 22, 2019 11:04PM UTC

Hi team, I got he following issue on my app: "The application may be vulnerable to DOM-based cross-site scripting. Data is read from window.location.hash and passed to $()." "Data is read from window.location.hash and passed to $() via the following statement: $('a[href="' + window.location.hash + '"]').click();" I tried to exploit it using https://URL#javascript:alert(document.domain); but it was not successful. Could you please tell me how that issue can be exploited? Or it's a false positive. Thanks in advance

Hannah, PortSwigger Agent | Last updated: Dec 31, 2019 01:43PM UTC