Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

XSS into Java Script

Dany | Last updated: Jan 12, 2020 07:26AM UTC

Hello, I have a question again. About context into JavaScript, "Terminating the existing script" I understood. The question appears when I go to the lab for practice, >>Reflected XSS into a JavaScript string with single quote and backslash escaped<<, I did it well, but in solutions, I saw a small thing, but I didn't understand it well. So we have to send a random alphanumeric string and after we see it is reflected inside a JS string. After, here is the question, we try to submit "test'payload" and we can observe that single quote gets backslash escaped. i read about escape, what it is for, and understood. But we can try to terminate the tag and introduce a new one without sending this payload, can't we?! Why should we send this particular payload, what does this allow us to see in terms of vulnerability search?? Sorry because my English isn't very good, I hope you got what I mean. Thanks)))))))

Ben, PortSwigger Agent | Last updated: Jan 13, 2020 08:57AM UTC