The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

DOM Based XSS based from static analysis

Ken | Last updated: Aug 17, 2021 04:56AM UTC

Hi, I'm new to web app pentesting and I came across this finding through static analysis during the active scan. Data is read from document.location.pathname and passed to document.write() via the following statements: var url = document.location.pathname; document.write('<base href="' + url.substring(0, url.lastIndexOf("/")+1) + '" />' ); So on the url I tried adding an basic XSS payload: https://url/path/<xss-here> but it didn't worked due to the payload was converted into HTML entity. From my understanding since the xss payload was filtered this one is a false positive right?

Hannah, PortSwigger Agent | Last updated: Aug 17, 2021 09:45AM UTC