Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Strange XSS false positives in scanning.

Ash | Last updated: Mar 17, 2019 01:50AM UTC

I was trying to scan an application with Burp. The scanner found around 20 XSS and in the scanner, the request and how the payload was reflected in the response was clear in the response tab. However, when trying to manually verify the exploit (the the same payload to the same URL) the payload was HTML encoded. How comes that it in clear in the "Response" tab and encoded in the page?

PortSwigger Agent | Last updated: Mar 18, 2019 02:50PM UTC

Hi Ash Please could you give us a bit more information. What requests where used? What were the responses? Kind regards Gareth

PortSwigger Agent | Last updated: Mar 18, 2019 03:40PM UTC

It sounds like this vulnerability triggers with URL parameters, and only when they are not URL encoded. Most browsers automatically escape URL parameters, which makes this non-exploitable. However, Internet Explorer does not, so I suggest you try exploiting in that browser.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.