The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Potential False Positive DOM Based XSS - 2

Ozgur | Last updated: Apr 14, 2018 09:07AM UTC

Hi, Burp reported this below lines as Dom Based XSS vulnerability with Severity: High, Confidence: Firm. I didn't find a way to exploit this lines within a scenario since document.body.classList.add function is used only for creating body tags within class name. (E.g. on the inspector result is <body class="PAYLOAD">). Since this function is escaped characters like " and > there is no way to get outside of the " characters and class attribute. How can this type of XSS vulnerability be exploited, or is it a false positive? var parts = location.search.split('='); var part = parts[1]; document.body.classList.add(part); Best regards, Ozgur

PortSwigger Agent | Last updated: Apr 16, 2018 08:10AM UTC