Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Cross-Site Scripting (Stored) Issue Inconsistency

Gabe | Last updated: Sep 14, 2017 02:07PM UTC

Hello, I ran a scan of an application and a Cross-Site Scripting (Stored) issue was reported at an Informational level. One of the parameters of the PUT request accepted a payload of j5kts<script>alert(1)</script>jveob, which was then returned in a subsequent GET request. After not changing anything about the application or the scanning options, I ran the scan of that endpoint (both PUT and GET), but the Cross-Site Scripting issue was not reported. My questions are: Is this something that's typical with this sort of issue? Please don't quote the other responses I've seen where you say you have tests built in to catch this issue. "It's not happening on my machine", is not an acceptable answer. How can I debug what is being scanned more easily to verify the issue is either present or not? I am able to manually store javascript alerts in other fields and parameters on this application. Why is it not showing up when scanning those endpoints as well? Thanks very much!

PortSwigger Agent | Last updated: Sep 14, 2017 02:15PM UTC