Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Detection of Cross Site Scripting

Karthik | Last updated: Apr 15, 2015 05:59AM UTC

I recently used Burp Suite to perform a XSS scan. A reflected XSS vulnerability was reported. When I reviewed the request and response I noticed that the supplied input is exactly echoed in the output. Case 1 Two inputs below Input and Output: f1466'style='behavior:url(#default#time2)'onbegin='alert(1)'31b9b Input and Output: 508e9"-alert(1)-"dcc3a Case 2 Input : <script>alert(123)</script> Output : alert(123) In both the case, there were no scripts getting executed, like an alert message or prompt. Just the input appeared in the output When there is no script getting executed (visibly) , how can this be harmful ? could you please clarify my doubts ?

PortSwigger Agent | Last updated: Apr 15, 2015 08:36AM UTC