Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

DOM Based XSS based from static analysis

Ken | Last updated: Aug 17, 2021 04:56AM UTC

Hi, I'm new to web app pentesting and I came across this finding through static analysis during the active scan. Data is read from document.location.pathname and passed to document.write() via the following statements: var url = document.location.pathname; document.write('<base href="' + url.substring(0, url.lastIndexOf("/")+1) + '" />' ); So on the url I tried adding an basic XSS payload: https://url/path/<xss-here> but it didn't worked due to the payload was converted into HTML entity. From my understanding since the xss payload was filtered this one is a false positive right?

Hannah, PortSwigger Agent | Last updated: Aug 17, 2021 09:45AM UTC

Hi Have you checked out our Academy lab topic on DOM-based XSS? You can find it here: https://portswigger.net/web-security/cross-site-scripting/dom-based

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.