Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

XSS DOM

Anab | Last updated: Jan 21, 2021 10:49PM UTC

Hi Team, I have 2 different tentative DOM XSS issues with this description: First one: "Data is read from location and passed to the 'append()' function of JQuery via the following statements:" var cell = "<th scope='row'>"+company+"</th><td>"+ location+"</td><td>"+district+"</td>"; row.append(cell); - Second one: Data is read from location and passed to $() via the following statement: $(location) I'm trying to imagine which scenario this would be exploitable. It seems to be a false positive because the variables path and var1 will get the literal value and won't trigger any JavaScript code. Could you please give me a exemple where this could be exploitable? Thanks

Michelle, PortSwigger Agent | Last updated: Jan 22, 2021 12:34PM UTC

You can read up on DOM-based XSS, how to find it and how to exploit it on our Web Security Academy. https://portswigger.net/web-security/cross-site-scripting/dom-based There are labs on the topic too, so you can try to test out your knowledge.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.