Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities.

It seems all modern browsers have protections against things like XSS.

When something like Burp finds an XSS vulnerability, I can't ever verify it when using something like TamperData. The code gets sent to the page, but it never seems to execute.

Is there a browser that specifically allows things like XSS and CSRF to execute, for the purposes of testing?

share|improve this question

closed as off-topic by Xander, Rory Alsop Aug 25 '14 at 16:13

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

4 Answers 4

up vote 8 down vote accepted

Most browsers allow you to disable the function. For instance with chrome you need to start the browser using

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security

For Firefox you have to go type about:config in the address bar. Then you need to set the browser.urlbar.filter.javascript to False.

For Internet Explorer click Tools–>Internet Options and then navigate to the Security Tab. You need to set a custom security level. Scroll towards the bottom where you will find that Enable XSS filter and disable it.

share|improve this answer

Your best bet would be mantra from OWASP:


Contains a myriad of tools for penetration testing out of the box. Also open source should you need to add/modify anything.

share|improve this answer

When something like Burp finds an XSS vulnerability, I can't ever verify it when using something like TamperData.

If you are already using Burp to find the vulnerability, why not use the intercepting proxy functionality to modify the request and to inject the XSS payload?

Burp Intercepting Proxy

share|improve this answer
That's exactly what I was trying, and what was failing. –  Sonny Ordell Aug 25 '14 at 16:58
Sonny: Maybe it was a false positive in this particular case? –  SilverlightFox Aug 25 '14 at 17:00

There is the sand cat projet which provide a lot of pen testing tools, like scripting in lua, better view over the console and dynamic injection tools, and a lot of other good surprise.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.