Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

XSS False positive

Joel | Last updated: Nov 03, 2016 11:27AM UTC

I have some reflected XSS reported as high+certain when actually there's no vulnerability. There is a specific header (anti Csrf) which is added by some js on page. Since a request from another domain won't be able to add this header it is not possible to have the reflected work. I blelieve Burp should be able to identify this as a non-XSS. Tx for the great tool, Best regards, Joel Example: POST /path HTTP/1.1 Host: fitnhotel.fr User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0 Accept: */* Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-CSRF-TOKEN: ktyLTnoI6twbDdwiTGOG9Wh6JLhHNuECtkV+0= X-Requested-With: XMLHttpRequest Referer: https://x.y.com/path Content-Length: 190 Cookie: some Connection: close type=geographic_area&lat=48.85661400000001v85pw<script>alert(1)<%2fscript>wn686&lng=2.3522219000000177&latupperleft=49.17320081786136&lngupperleft=1.866423025912468&latlowerright=48.538012026909&lnglowerright=2.8318954084877532

PortSwigger Agent | Last updated: Nov 03, 2016 01:54PM UTC

We've given this some thought and we plan to make Burp issue a follow-up request in this situation only containing headers that browsers will issue by default. If the XSS behavior goes away, then Burp will downgrade the issue to tentative confidence.

Burp User | Last updated: Nov 09, 2016 09:32AM UTC