The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Potential False Positive DOM Based XSS

Ozgur | Last updated: Apr 03, 2018 04:23PM UTC

Hi, Burp reported just this below line as Dom Based XSS vulnerability as Severity: High, Confidence: Tentative. I didn't find a way to exploit this line within a scenario since there is no parameter exists that can be user controllable. When I debug from console currentURL parameter, only real location of url is returned. How can this type of XSS vuln can be exploited, or is it a false positive? var currentURL = $(location).attr('href'); Best regards, Ozgur

PortSwigger Agent | Last updated: Apr 04, 2018 09:27AM UTC