Burpsuite - finding xss vulnerabilities in the vaadin framework

Question

I made a little website using the vaadin-framework. It contains one TextField-component for user input and one Label-component which is placed in another view and which is displaying exactly the value, entered in the view before.

The Label-component is definitely vulnerable against XSS. I know it because I tested it manually. But I would like to find a way to use a tool like Burpsuite and to avoid the manual process.

After watching some videos and reading tutorials about using Burpsuite against XSS Vulnerabilities I recognized that my case is a little different.

I enter the value "TheKing" in my TextField-componentand Burpsuite is showing me following result (in the Intercept Tab):

POST /UIDL/?v-uiId=1 HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:43.0) Gecko/20100101     Firefox/43.0 Iceweasel/43.0.4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json; charset=UTF-8
Referer: http://localhost:8080/
Content-Length: 455
Cookie: JSESSIONID=18u12s9qqlvh416iz3rq3666yj
Connection: close
{"csrfToken":"28170032-d198-4d30-b1eb-9e273b338ee6","rpc": [["27","com.vaadin.shared.ui.ui.UIServerRpc","resize",[802,1280,1280,802]],["31","v","v",["text",["s","The King"]]],["31","v","v",["c",["i",8]]],["30","com.vaadin.shared.ui.button.ButtonServerRpc","click",[{"altKey":false,"button":"LEFT","clientX":655,"clientY":58,"ctrlKey":false,"metaKey":false,"relativeX":98,"relativeY":21,"shiftKey":false,"type":1}]]],"syncId":0,"clientId":0,"wsver":"7.7.0"}

My website url looks like: http://localhost:8080/#!main/TheKing

What can I do with these information?

Answer 1

You should look for the HTTP response (tab) in the HTTP history tab. There you can see if your input was filtered or encoded in the response in any way.

But it would be easier to use the Repeater option. Just right click on your HTTP request, and select "send to Repeater". Then go to Repeater tab. Using repeater, just try to manually modify the HTTP request parameters, send the request, and look for the replied value in the response. You can resend/modify the request as many times as you want.

I must note that Burp does not have a javascript engine. That means that it would be quite hard to detect DOM based XSS this way. That also means that Burp wont throw any alert boxes if XSS is present, but you have to conclude by yourself based on the response and the way your input was encoded/filtered if XSS is possible.