Burp Suite User Forum

Create new post

Reflected XSS finding with Burp Repeater

BugHunter | Last updated: Aug 23, 2020 01:06PM UTC

Hello, I have discovered a potential XSS vulnerability and would like to receive feedback from more experienced people. Okay, here it is. With Burp Repeater I was able to inject XSS payloads and with "show response" the pop-up was displayed. By manual review ("copy URL") I found out that modern web browsers are destroying this payload by simply URL encoding it (means <, > did not work anymore). In Internet Explorer however at least </script> went through, so that I could free myself from the previous JavaScript code of the webpage. The website threw half of its source code around my ears. But the actual payload didn't work in Internet Explorer because it was blocked by the Internet Explorers own anti-XSS-filter. I've been trying to bypass the Internet Explorer filter for weeks. Should I continue or is this not a solid finding? Many thanks for your assessment. Best regards, Manuel Ungeheuer

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.