Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Cross-site scripting (DOM-based) - Data is read from location and passed to $()

rajauzairabdullah | Last updated: Nov 03, 2022 10:58AM UTC

Static Analysis: Data is read from location and passed to $() via the following statement: window._gaq.push(['_trackEvent', 'Cookies', 'Learn more link clicked', $(location).attr('href')]) Vulnerable Code: $link.on('click', function () { window._gaq.push(['_trackEvent', 'Cookies', 'Learn more link clicked', $(location).attr('href')]); }); Burp Pro shared DOM- Bases XSS in an active report, I need help to understand what to do here.

rajauzairabdullah | Last updated: Nov 03, 2022 10:59AM UTC

i just want to know, is there any possibility to execute DOM Based XSS ?

Liam, PortSwigger Agent | Last updated: Nov 03, 2022 12:00PM UTC

Have you tried using DOM Invader? - https://portswigger.net/burp/documentation/desktop/tools/dom-invader - https://portswigger.net/burp/documentation/desktop/tools/dom-invader/dom-xss

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.