Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Having doubt

Arish | Last updated: Sep 05, 2021 04:18PM UTC

In many of the websites, if I enter invalid credentials and capture it with burpsuite the response shows the entire html source, in that if I add any script tag with alert it executed in some websites but not in all.Is this a xss vulnerability?if not why it is executed some of the websites?

Uthman, PortSwigger Agent | Last updated: Sep 06, 2021 09:09AM UTC

Hi Arish, This is beyond the scope of our support service but your post will remain up for a member of the community to contribute. It looks like some of the sites you are testing have some type of XSS protection enabled. You can learn more about XSS by checking out the topic in our free Web Security Academy. It may also be beneficial to read some research carried out by our security researchers: - https://portswigger.net/web-security/cross-site-scripting - https://portswigger.net/research/cross-site-scripting-research You may also find these additional resources helpful: - https://www.netsparker.com/blog/web-security/content-security-policy/ - https://www.google.co.uk/about/appsecurity/learning/xss/

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.