Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Link Manipulation (DOM-based)

Pedro | Last updated: Jan 29, 2019 05:16PM UTC

Hello, I'm scanning a website using Burp and I got the following issue, which I'm trying to replicate. However, I'm not really understanding what was injected and the supposed response. Could anybody help me clear this up? Thanks! PS: Sensitive data was replaced with (...) -------------------------------------------------------------------------------------------------------- Data is read from location.pathname and passed to element.setAttribute.href. The following value was injected into the source: ///(...)/(...)/(...)///wf380ayvhy%27%22%60'%22/wf380ayvhy/%3E%3Cwf380ayvhy//%3Es2mj7etijz& The previous value reached the sink as: ///(...)/(...)/(...)///wf380ayvhy%27%22%60'%22/wf380ayvhy/%3E%3Cwf380ayvhy//%3Es2mj7etijz&edit/ The stack trace at the source was: at Object.get pathname [as pathname] (<anonymous>:1:69939) at i.currentUrl (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:7:27478) at Ne.get (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15953) at Ne.evaluate (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:17103) at i.currentUrl (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:18946) at i.r (https://s(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:87347) at i.t._render (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:32655) at i.<anonymous> (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64072) at Ne.get (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15953) at new Ne (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15871) at https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64040 at i.pn.$mount (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64154) at i.pn.$mount (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:86816) at init (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:22422) at https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52545 at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52812) at h (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53397) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52926) at pn.__patch__ (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:57174) at pn.t._update (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:31651) at pn.<anonymous> (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64062) at Ne.get (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15953) at new Ne (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15871) at https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64040 at pn.$mount (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64154) at pn.$mount (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:86816) at pn.t._init (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:30152) at new pn (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:27467) at Object.170 (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:7:15203) at n (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:1:110)

Burp User | Last updated: Jan 29, 2019 05:17PM UTC

The sink stack trace is here due to size limitation. -------------------------------------------------------------------------------------------------------- The stack trace at the sink was: at HTMLAnchorElement.setAttribute (<anonymous>:1:79724) at ar (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:41219) at rr (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:40966) at Array.nr (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:40532) at g (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53641) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52941) at h (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53397) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52926) at h (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53397) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52926) at h (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53397) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52926) at h (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53397) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52926) at i.__patch__ (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:56893) at i.t._update (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:31651) at i.<anonymous> (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64062) at Ne.get (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15953) at new Ne (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:15871) at https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64040 at i.pn.$mount (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64154) at i.pn.$mount (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:86816) at init (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:22422) at https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52545 at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52812) at h (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:53397) at d (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:52926) at pn.__patch__ (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:57174) at pn.t._update (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:31651) at pn.<anonymous> (https://(...).com/static/dist/js/batchDetails.bundle.1548771994.js:13:64062)

Liam, PortSwigger Agent | Last updated: Jan 29, 2019 05:26PM UTC