I am getting started in testing web applications, and I am having trouble verifying vulnerabilities.
It seems all modern browsers have protections against things like XSS.
When something like Burp finds an XSS vulnerability, I can't ever verify it when using something like TamperData. The code gets sent to the page, but it never seems to execute.
Is there a browser that specifically allows things like XSS and CSRF to execute, for the purposes of testing?
Most browsers allow you to disable the function. For instance with chrome you need to start the browser using
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security
For Firefox you have to go type about:config in the address bar. Then you need to set the browser.urlbar.filter.javascript to False.
For Internet Explorer click Tools–>Internet Options and then navigate to the Security Tab. You need to set a custom security level. Scroll towards the bottom where you will find that Enable XSS filter and disable it.
Your best bet would be mantra from OWASP:
Contains a myriad of tools for penetration testing out of the box. Also open source should you need to add/modify anything.
When something like Burp finds an XSS vulnerability, I can't ever verify it when using something like TamperData.
If you are already using Burp to find the vulnerability, why not use the intercepting proxy functionality to modify the request and to inject the XSS payload?
There is the Sandcat project which provide a lot of pen testing tools, like scripting in lua, better view over the console and dynamic injection tools, and a lot of other good surprises.
Some of its unique features include:
