The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

XSS with document.location.pathname

youness | Last updated: Oct 26, 2023 11:20AM UTC

Hello I'm kind of a n00b in this do you think this is exploitable And what are your suggestions to do so. <script type="text/javascript"> document.write("<base href='" + document.location.pathname + "' />"); </script>

Michelle, PortSwigger Agent | Last updated: Oct 26, 2023 02:14PM UTC

If you're new to this topic, a good starting point would be the resources on our Web Security Academy https://portswigger.net/web-security/cross-site-scripting You might also find our XSS cheat sheet useful which contains many vectors that can help you bypass WAFs and filters. https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

youness | Last updated: Oct 26, 2023 02:52PM UTC