The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

How to inject data into source

Croushore, | Last updated: Sep 17, 2020 08:25PM UTC

I saw someone else posted the same question, however the answer provided didn't clarify what "injecting into the source" really means. Aside from adding something to the URL that gets reflected in the DOM of the page, how does one go about "injecting into the source"? Burp identified an issue where data read from location.hash is passed to document.cookie via the following value which was injected into the source: #cxxbde9dct=cxxbde9dct%27%22`'"/cxxbde9dct/><cxxbde9dct/\>k3xpf61her& The GET request for the page is: GET /?PromoID=NEWS0611Ld HTTP/1.1 Host: blah.com Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en-US,en-GB;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36 Connection: close Cache-Control: max-age=0 Referer: https://qa2.blah.com/newsletter/june-2011-b Cookie: ADRUM_BTs=R:0|s:f; ASP.NET_SessionId=bnovsgroev2g35cneasnqgir; ADRUM_BT1=R:0|i:32111|e:75; ADRUM_BTa=R:0|g:f208ea2e-f5fb-4564-8692-16777c933c82|n:esulab_6b58d87a-3a2f-4bad-83cd-274bccb826ab; SSLB=1; SSID_QA2=CADq2B04AAAAAACBFlhftRLCIYEWWF8BAAAAAAAAAAAAgRZYXwCtwoydAAEWDRMAgRZYXwEAebMAAfZRFwCBFlhfAQBhwQABLywaAIEWWF8BAN6wAAGe0xYAgRZYXwEA; SSSC_QA2=411.G6870265975426650805.1|40332.1248534:45278.1495966:45945.1528310:49505.1715247; SSRT_QA2=gRZYXwABAA; nam=id=DEGSDQB1H; lsession=id=DEGSDQB1H; blahID=xxxx%1eM%1ez%1aJKI%14J%1eN%1aF%1bP%1aP%14R%1e%7d%18FMRI%7b+PJ%7cJ%7cJN Looking at the request I don't see where '#cxxbde9dct=cxxbde9dct%27%22`'"/cxxbde9dct/><cxxbde9dct/\>k3xpf61her&' was injected anywhere. Can someone please clear this up as I'm sure I'm not the only one really struggling to understand this. Anyone can inject anything into the source of a page using their web dev tools. If you can't save it so it's server to another user, it does nothing.

Hannah, PortSwigger Agent | Last updated: Sep 18, 2020 07:13AM UTC