Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

DOM XSS - How do I prove this Vulner is ture

james | Last updated: Oct 27, 2022 02:41AM UTC

Dears I confuse this Vulner . I read Dynamic analysis,but I don't konw how to prove this DOM XSS exist. please help me what step can I do first? Data is read from input.value and passed to jQuery.append. The source element has id ContentPlaceHolder1_HidF_FileUpload and name ctl00$ContentPlaceHolder1$HidF_FileUpload. The following value was injected into the source: Upload The previous value reached the sink as: undefined<tr class="Table_Left_CSS1 Font5" ><td id="utou_tr_en" style="width: 40%;" >English</td><td style="width: 60%;white-space:nowrap;"><input type="file" style="display:none;" id="FUp_TOU_en" onchange="upload(this,'U_en');" /><input type="button" value="l1m2o5brqf%2527%2522`'"/l1m2o5brqf/><l1m2o5brqf/\>xxco3wzagu&" onclick='$("#FUp_TOU_en").click();' class="C_Button_1" /><span id="lab_U_en" style="width: 170px;font-size:14px;display: inline-block;overflow:hidden;text-overflow:ellipsis;white-space:nowrap; "></span><input class="" onclick="delpath('FUp_TOU_en','U$en');ReturnEventFalse(event);" type="button" style="background-color: transparent;background-image:url('../Image/Cancel.png');width:18px;height:18px;border-style:none;" /></td></tr><tr class="Table_Left_CSS1 Font5" style="background-color:#FFFFFF" ><td id="utou_tr_es" style="width: 40%;" >Espa.ol</td><td style="width: 60%;white-space:nowrap;"><input type="file" style="display:none;" id="FUp_TOU_es" onchange="upload(this,'U_es');" /><input type="button" value="l1m2o5brqf%2527%2522`'"/l1m2o5brqf/><l1m2o5brqf/\>xxco3wzagu&" onclick='$("#FUp_TOU_es").click();' class="C_Button_1" /><span id="lab_U_es" style="width: 170px;font-size:14px;display: inline-block;overflow:hidden;text-overflow:ellipsis;white-space:nowrap; "></span><input class="" onclick="delpath('FUp_TOU_es','U$es');ReturnEventFalse(event);" type="button" style="background-color: transparent;background-image:url('../Image/Cancel.png');width:18px;height:18px;border-style:none;" /></td></tr> The stack trace at the source was: at Object.tTtlm (<anonymous>:1:194952) at Object.ZdJxm (<anonymous>:1:489575) at HTMLInputElement.get (<anonymous>:1:542806) at HTMLInputElement.get [as value] (<anonymous>:1:717720) at Object.val (https://192.168.31.161/Lib/JavaScript/jquery.min.js?ver=V4.4.0:2:84064) at HTMLOptionElement.<anonymous> (https://192.168.31.161/GroupManagement/JS_AddGroupData.js?ver=V4.4.0:40:90) at Function.each (https://192.168.31.161/Lib/JavaScript/jquery.min.js?ver=V4.4.0:2:3642) at Object.each (https://192.168.31.161/Lib/JavaScript/jquery.min.js?ver=V4.4.0:2:1778) at LoadLanguage (https://192.168.31.161/GroupManagement/JS_AddGroupData.js?ver=V4.4.0:30:46) at ResetLoad (https://192.168.31.161/GroupManagement/JS_AddGroupData.js?ver=V4.4.0:17:5) at HTMLInputElement.onclick (https://192.168.31.161/GroupManagement/AddGroupData.aspx:434:224) at _0x2c55d2 (<anonymous>:1:244861) at Object.OFsDZ (<anonymous>:1:105121) at _0x191273 (<anonymous>:1:248754) at Object.wtRYA (<anonymous>:1:220543) at _0x4f7f04 (<anonymous>:1:790364) The stack trace at the sink was: at Object.dMSbX (<anonymous>:1:203448) at _0x1c2020 (<anonymous>:1:642927) at Object.apply (<anonymous>:1:745801) at LoadLanguage (https://192.168.31.161/GroupManagement/JS_AddGroupData.js?ver=V4.4.0:51:22) at ResetLoad (https://192.168.31.161/GroupManagement/JS_AddGroupData.js?ver=V4.4.0:17:5) at HTMLInputElement.onclick (https://192.168.31.161/GroupManagement/AddGroupData.aspx:434:224) at _0x2c55d2 (<anonymous>:1:244861) at Object.OFsDZ (<anonymous>:1:105121) at _0x191273 (<anonymous>:1:248754) at Object.wtRYA (<anonymous>:1:220543) at _0x4f7f04 (<anonymous>:1:790364) This was triggered by a click event on an element with an id of ContentPlaceHolder1_but_CallCountry_Back and a name of ctl00$ContentPlaceHolder1$but_CallCountry_Back with the following HTML: <input type="submit" name="ctl00$ContentPlaceHolder1$but_CallCountry_Back" value="Back" onclick="Res

Liam, PortSwigger Agent | Last updated: Oct 27, 2022 06:29AM UTC

Have you tried using DOM Invader? - https://portswigger.net/burp/documentation/desktop/tools/dom-invader

james | Last updated: Oct 28, 2022 02:22AM UTC

Yes I have ,but DOM Invader not show any exploit. when I use DOM Invader don't show error message ,so can I say this is a false positive??

Liam, PortSwigger Agent | Last updated: Oct 28, 2022 10:41AM UTC