The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

(Unintended Solution) for Lab: Stored XSS into anchor href attribute with double quotes HTML-encoded

Eileen | Last updated: Nov 13, 2022 07:16AM UTC

Hi, The lab for teaching XSS that is supposed to encode double quotes did not actually HTML-encode the character ", the following payload works. Relevant Request: website=http%3A%2F%2Ftest"><script>alert()</script> Relevant Response: <a id="author" href="http://test"><script>alert()</script>">aaa

Michelle, PortSwigger Agent | Last updated: Nov 14, 2022 11:41AM UTC