I made a little website using the vaadin-framework. It contains one TextField-component
for user input and one Label-component
which is placed in another view and which is displaying exactly the value, entered in the view before.
The Label-component
is definitely vulnerable against XSS. I know it because I tested it manually. But I would like to find a way to use a tool like Burpsuite and to avoid the manual process.
After watching some videos and reading tutorials about using Burpsuite against XSS Vulnerabilities I recognized that my case is a little different.
I enter the value "TheKing" in my TextField-component
and Burpsuite is showing me following result (in the Intercept Tab):
POST /UIDL/?v-uiId=1 HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:43.0) Gecko/20100101 Firefox/43.0 Iceweasel/43.0.4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json; charset=UTF-8
Referer: http://localhost:8080/
Content-Length: 455
Cookie: JSESSIONID=18u12s9qqlvh416iz3rq3666yj
Connection: close
{"csrfToken":"28170032-d198-4d30-b1eb-9e273b338ee6","rpc": [["27","com.vaadin.shared.ui.ui.UIServerRpc","resize",[802,1280,1280,802]],["31","v","v",["text",["s","The King"]]],["31","v","v",["c",["i",8]]],["30","com.vaadin.shared.ui.button.ButtonServerRpc","click",[{"altKey":false,"button":"LEFT","clientX":655,"clientY":58,"ctrlKey":false,"metaKey":false,"relativeX":98,"relativeY":21,"shiftKey":false,"type":1}]]],"syncId":0,"clientId":0,"wsver":"7.7.0"}
My website url looks like: http://localhost:8080/#!main/TheKing
What can I do with these information?