The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Open redirection (DOM-based)

flyingheap | Last updated: Jun 10, 2023 08:06PM UTC

When Burp scans an application, it reports "The application may be vulnerable to DOM-based open redirection: Data is read from document.location.pathname and passed to the 'open()' function of an XMLHttpRequest object via the following statements: var action = theForm.action || document.location.pathname, fragmentIndex = action.indexOf('#'); path = action.substr(0, queryIndex); domain = path.substr(0, slashAfterDomain); action = domain + encodeURI(path) + query; xmlRequest.open("POST", action, true); Is this false positive? How to create a valid POC for it? Thanks in advance.

Dominyque, PortSwigger Agent | Last updated: Jun 12, 2023 08:59AM UTC