Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Open redirection (DOM-based)

TeetingBurp | Last updated: Jun 20, 2021 03:35PM UTC

I am trying to analyze and understand Open redirection (DOM-based) that has been reported by Burp. It mentions Sink and Source and says:- the application may be vulnerable to DOM-based open redirection. Data is read from location.pathname and passed to location.replace. and then generates the basic GET request and its response and in the Dynamic analysis, it shows a POC. Question : 1. Where can I find the stack trace at the source? 2. Where can I find the stack trace at the sink? 3. How and from where Burp finds it and why it doesn't elaborate the same? My response body shows literally nothing on location.pathname and location.replace so how can I debug this further to see if this is actually an issue or just a false positive?

Michelle, PortSwigger Agent | Last updated: Jun 21, 2021 01:27PM UTC