Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

DOM XSS - How to actually inject the source ?

Iordache | Last updated: Mar 19, 2019 08:16PM UTC

Hello, so, I am struggeling to understand something and I cannot find an answer. If anybody could help me I would be very appreciative. A dynamic analysis of a JS code rendered this Data is read from input.value and passed to element.innerHTML. The source element has id [ID_HERE] and name [NAME_HERE]. The following value was injected into the source: [SOME_OTHER_VALUE_HERE] The previous value reached the sink as: <yacjxnqfk6/\> The stack trace at the source was: /* stack trace */ The stack trace at the sink was: /* stack trace */ The XSS was triggered by a DOMContentLoaded event. So, the analysis is correct, if I inject somehow the payload inside the source element, it can be exploited. But how can I actually inject it ?? It is not like I can pass the value in a GET / POST parameter so I can modify anything. And also, what is with the value in the [SOME_OTHER_VALUE_HERE] ? Is this a false positive because I cannot actually modify the generated source or am I something missing ?

PortSwigger Agent | Last updated: Mar 20, 2019 12:46PM UTC