So I was put on an engagement over the last week and I found a potential XSS when using Burp's intruder/repeater. However, the strange thing that I noticed was that the response in Burp is different to when I request it in the browser (Firefox & Chrome - both with the security measures, such as XSS Protection, turned off). I also tried to "Request in Browser" through Burp, but to no avail.
At first I assumed it was a different UA, so I made sure that they were both the same (even tried removing it from Burp), and eventually I did this with all of the HTTP headers just to make sure there was no difference there.
With Burp I get the page back with a successful XSS payload in the source, in the browser I get a 404. Obviously as this is a work engagement I cannot provide specific details of the host/target.
My question is, why would burp give me a 200 response with the source code and the browser throw a 404 error?
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head></head> <frameset> <frame src="http://host/injection_point_here"> <script>alert(1);M</script><frame src=""></frame></frameset></html>