Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

DOM-based XSS

The | Last updated: Jun 07, 2019 09:36AM UTC

Hey, I've got an dynamic analysis from one of request intercepted thru burp proxy: "Data is read from input.value and passed to jQuery. The source element has name form_type. The following value was injected into the source: company The previous value reached the sink as: .jq-change-form[value="pu2smtu1t2%2527%2522`'"/pu2smtu1t2/><pu2smtu1t2/\>v35wawh6yy&"] The stack trace at the source was: at Object.UPGTj (<anonymous>:1:406183) at Object.tPCmp (<anonymous>:1:882309) at HTMLInputElement.get (<anonymous>:1:886853) at HTMLInputElement.get [as value] (<anonymous>:1:1059386) at e.fn.init.val (https://test01.firm-dev.com/js/main_lib/jquery-1.11.0.min.1559890976.js:4:9114) at HTMLDocument.<anonymous> (https://test01.firm-dev.com/js/history/address_form.1559890976.js:92:109) at j (https://test01.firm-dev.com/js/main_lib/jquery-1.11.0.min.1559890976.js:2:27136) at Object.fireWith [as resolveWith] (https://test01.firm-dev.com/js/main_lib/jquery-1.11.0.min.1559890976.js:2:27949) at Function.ready (https://test01.firm-dev.com/js/main_lib/jquery-1.11.0.min.1559890976.js:2:29783) at HTMLDocument.K (https://test01.firm-dev.com/js/main_lib/jquery-1.11.0.min.1559890976.js:2:30128) The stack trace at the sink was: at Object.rzeQd (<anonymous>:1:1299326) at Object.efryG (<anonymous>:1:1313524) at Object.apply (<anonymous>:1:1319855) at changeFormType (https://test01.firm-dev.com/js/history/address_form.1559890976.js:113:5) at HTMLDocument.<anonymous> (https://test01.firm-dev.com/js/history/address_form.1559890976.js:92:5) at j (https://test01.firm-dev.com/js/main_lib/jquery-1.11.0.min.1559890976.js:2:27136) at Object.fireWith [as resolveWith] (https://test01.firm-dev.com/js/main_lib/jquery-1.11.0.min.1559890976.js:2:27949) at Function.ready (https://test01.firm-dev.com/js/main_lib/jquery-1.11.0.min.1559890976.js:2:29783) at HTMLDocument.K (https://test01.firm-dev.com/js/main_lib/jquery-1.11.0.min.1559890976.js:2:30128) This was triggered by a DOMContentLoaded event." where from I understand that the place where 'company' is placed is vulnerable place for my payload and ".jq-change-form[value="pu2smtu1t2%2527%2522`'"/pu2smtu1t2/><pu2smtu1t2/\>v35wawh6yy&"]" is the function where payload is processed - right? So I need an API endpoint, method and proper request to application server to check that vulnerability, are my assumption right?

Liam, PortSwigger Agent | Last updated: Jun 10, 2019 10:01AM UTC