Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Is this a false positive? (sql / xpath injection)

Liz | Last updated: Feb 19, 2020 03:27PM UTC

Google brought me here. This previous post from 2015 seems similar to what I'm experiencing: https://forum.portswigger.net/thread/probable-bug-sql-injection-avoidable-false-positive-d1e55f31 Basically I have two vulnerabilities showing up, one for xpath and one for sql injection. We don't use XML or xpath for anything, but the string 'xpath' happens to appear in our session token cookie in one of the responses, ex: Set-Cookie: XSRF-TOKEN=eyJpdiI6Indwemc3K2pcL3B4Qm9PZkVESFNZMzhnPT0iLCJ2YWx1ZSI6IjhtbnZjYlIrYzhtd1RcL1RmRVhtVVFrOHBtM0xFaEtUVDNUNHdZdytWXC85TXRRanBwQWJUZTVsa0xPaThvc3IySiIsIm1hYyI6IjgwYmQ0NjBjMTI0MmNmOTEwZGI2YjQzOTNjMjc3ZjkyNDYzODhkMGQ3MDdjMzE3OGIwMTMzNzNhYTg5ZTNiNGYifQ%3D%3D; expires=Sun, 16-Feb-2020 21:53:42 GMT; Max-Age=7200; path=/; secure; httponly Note 'xPaTh' buried in the base 64 encoded string. Similarly on a SQL injection test, the word "FAiL" is buried in the base 64 encoded token Set-Cookie: XSRF-TOKEN=eyJpdiI6IldTM1pDMmZiU1JJazBXY2RaV3ppMnc9PSIsInZhbHVlIjoicWdnVXVuTVB5QXpKbHNXdlp3NUtkUnVlWlpCdE1ocytRRVwvVEExc0tETTBHZ0Q1WnlldnV4dDRyWTNqTmdoMFAiLCJtYWMiOiI4Njc2ZTQzOTJhNmE1ZTU1MWZhOTE1Njg3NjEyOTI5ZGNjZWZmY2NkYTM0NzcwNDBlNWQwNDcwNTdiNDQ0NjVlIn0%3D; expires=Fri, 14-Feb-2020 21:05:53 GMT; Max-Age=7200; path=/; secure; httponly and is being flagged as a High as well. Just looking for reassurance that these are in fact, false positives.

Uthman, PortSwigger Agent | Last updated: Feb 20, 2020 02:57PM UTC