Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities.

It seems all modern browsers have protections against things like XSS.

When something like Burp finds an XSS vulnerability, I can't ever verify it when using something like TamperData. The code gets sent to the page, but it never seems to execute.

Is there a browser that specifically allows things like XSS and CSRF to execute, for the purposes of testing?

share|improve this question

closed as off-topic by Xander, Rory Alsop Aug 25 '14 at 16:13

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

4 Answers 4

up vote 10 down vote accepted

Most browsers allow you to disable the function. For instance with chrome you need to start the browser using

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security

For Firefox you have to go type about:config in the address bar. Then you need to set the browser.urlbar.filter.javascript to False.

For Internet Explorer click Tools–>Internet Options and then navigate to the Security Tab. You need to set a custom security level. Scroll towards the bottom where you will find that Enable XSS filter and disable it.

share|improve this answer

Your best bet would be mantra from OWASP:

Contains a myriad of tools for penetration testing out of the box. Also open source should you need to add/modify anything.

share|improve this answer

When something like Burp finds an XSS vulnerability, I can't ever verify it when using something like TamperData.

If you are already using Burp to find the vulnerability, why not use the intercepting proxy functionality to modify the request and to inject the XSS payload?

Burp Intercepting Proxy

share|improve this answer
That's exactly what I was trying, and what was failing. – Sonny Ordell Aug 25 '14 at 16:58
Sonny: Maybe it was a false positive in this particular case? – SilverlightFox Aug 25 '14 at 17:00

There is the Sandcat project which provide a lot of pen testing tools, like scripting in lua, better view over the console and dynamic injection tools, and a lot of other good surprises.

Some of its unique features include:

  • Live HTTP Headers — built-in live headers with a dedicated cache per tab and support for preview extensions
  • Sandcat Console — an extensible command line console; Allows you to easily run custom commands and scripts in a loaded page
  • Resources tab — allows you to view the page resources, such as JavaScript files and other web files.
  • Page Menu extensions — allows you to view details about a page and more.
  • Pen-Tester Tools — Sandcat comes with a multitude of pen-test oriented extensions. This includes a Fuzzer, a Script Runner, HTTP & XHR Editors, Request Loader, Request Replay capabilities



share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.