Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

XSS DOM Based

Atul | Last updated: Nov 03, 2020 06:54AM UTC

Burp has created DOM XSS issues with this description: Data is read from window.location.href and passed to $() via the following statements: var anchor = extractAnchor(window.location.href); var anchorMatch = url.match(/#[^$]+/); return anchorMatch ? anchorMatch[0] : null; var anchor = extractAnchor(window.location.href); goToAnchor(anchor); var targetPosition = $(anchor).offset().top; I'm trying to imagine which scenario this would be exploitable. Could you please give me a scenario where this could be exploitable? Thanks! Atul Choudhary

Hannah, PortSwigger Agent | Last updated: Nov 03, 2020 12:31PM UTC

Hi Atul My colleague has responded to your email. Have you checked out the resources we sent you? - https://portswigger.net/web-security/cross-site-scripting/dom-based - https://portswigger.net/support/using-burp-scanner-to-test-for-dom-based-xss - https://medium.com/@dstevensio/barebones-security-cross-site-scripting-xss-921f9187814c - https://twitter.com/mdisec/status/1031659768744751104 (please double-check the version of JQuery the application you are testing is using)

Jean-Sebastien | Last updated: Dec 13, 2021 02:16PM UTC