The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

XSS DOM-Based

Mike | Last updated: Jun 19, 2018 04:14PM UTC

Hi, I'm a relative n00b trying to understand DOM-based XSS from the following issue reported by Burp. I'm trying to figure out if this is false-positive or not. Having difficulty putting together a POC, identifying the sources and sinks. Data is read from window.location.pathname and passed to $() via the following statements: var href=window.location.pathname; href=href.substr(href.lastIndexOf('/') + 1); var li=$('a[href^="' + href + location.hash + '"]').parent('li.chapter').first(); Thanks, Mike

PortSwigger Agent | Last updated: Jun 19, 2018 04:17PM UTC