The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Cross-site scripting (reflected)

jvlavl | Last updated: Dec 26, 2018 11:38AM UTC

Hi, I'm surveying my website now I see via Burp suite a message Cross-site scripting (reflected) HIGH on two files namely a css and a js file. My question is is it possible to open a reverse shell using these extensions? The value of the portal request parameter is copied into the HTML document as plain text between tags. The payload a780y<script>alert(1)</script>oh3uy was submitted in the portal parameter. This input was echoed unmodified in the application's response. I have tested the <script>alert(1)</script> part and that does return a popup. Is it possible to open an reverse using these methods? if yes can you help me achieve this? Rgds, John

PortSwigger Agent | Last updated: Dec 28, 2018 10:52AM UTC