Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Testing for XSS, SQLi etc.

Mike | Last updated: Apr 08, 2020 07:30PM UTC

Does Burp already try all XSS and other type payloads on Active Scanning as outlined in the "Cross-site scripting (XSS) cheat sheet" page or only a sample of these and the rest should be performed manually?

Michelle, PortSwigger Agent | Last updated: Apr 09, 2020 11:06AM UTC

The "Cross-site scripting (XSS) cheat sheet" is intended for manual testing. You can find details of what the scanner covers here: https://portswigger.net/kb/issues

Mike | Last updated: Apr 09, 2020 01:16PM UTC

Thank you for the quick response. In other words, the active scanner only tries some variations of XSS when it's scanning (i.e. <script>alert('1')</script>, but maybe not <a id=x tabindex=1 onbeforeactivate=alert(1)></a>) and I should be manually trying all variations outlined in the cheat sheet and then some?

Michelle, PortSwigger Agent | Last updated: Apr 14, 2020 01:47PM UTC