0

I made a little website using the vaadin-framework. It contains one TextField-component for user input and one Label-component which is placed in another view and which is displaying exactly the value, entered in the view before.

The Label-component is definitely vulnerable against XSS. I know it because I tested it manually. But I would like to find a way to use a tool like Burpsuite and to avoid the manual process.

After watching some videos and reading tutorials about using Burpsuite against XSS Vulnerabilities I recognized that my case is a little different.

I enter the value "TheKing" in my TextField-componentand Burpsuite is showing me following result (in the Intercept Tab):

POST /UIDL/?v-uiId=1 HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:43.0) Gecko/20100101     Firefox/43.0 Iceweasel/43.0.4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json; charset=UTF-8
Referer: http://localhost:8080/
Content-Length: 455
Cookie: JSESSIONID=18u12s9qqlvh416iz3rq3666yj
Connection: close
{"csrfToken":"28170032-d198-4d30-b1eb-9e273b338ee6","rpc": [["27","com.vaadin.shared.ui.ui.UIServerRpc","resize",[802,1280,1280,802]],["31","v","v",["text",["s","The King"]]],["31","v","v",["c",["i",8]]],["30","com.vaadin.shared.ui.button.ButtonServerRpc","click",[{"altKey":false,"button":"LEFT","clientX":655,"clientY":58,"ctrlKey":false,"metaKey":false,"relativeX":98,"relativeY":21,"shiftKey":false,"type":1}]]],"syncId":0,"clientId":0,"wsver":"7.7.0"}

My website url looks like: http://localhost:8080/#!main/TheKing

What can I do with these information?

1

You should look for the HTTP response (tab) in the HTTP history tab. There you can see if your input was filtered or encoded in the response in any way.

But it would be easier to use the Repeater option. Just right click on your HTTP request, and select "send to Repeater". Then go to Repeater tab. Using repeater, just try to manually modify the HTTP request parameters, send the request, and look for the replied value in the response. You can resend/modify the request as many times as you want.

I must note that Burp does not have a javascript engine. That means that it would be quite hard to detect DOM based XSS this way. That also means that Burp wont throw any alert boxes if XSS is present, but you have to conclude by yourself based on the response and the way your input was encoded/filtered if XSS is possible.

  • thanks for help =). I modified the HTTP request header manually and injected an XSS statement. But when I look at the response I can't recognize if my statement was succesful or not. Using this manual way with Burpsuite is more time consuming than using no tools. Could be there another (hopefully) automatically way? Should I customize Burpsuite for myself? – Nazar Medeiros Sep 23 '16 at 13:43
  • If you just want to get a yes/no answer from Burp, try using the Burp XSS validator extension (you will have to install it) , or use some other XSS scanner like Xenotix. The downside of that is that you just get alerted if XSS is present, but in case it is not present, you will not know why and if you could maybe bypass the filters. – stanko Sep 23 '16 at 14:22
  • Ok thank you very much! I tried to vote up your feedback, but it is not visible. There is still someting I would like to ask you: When you look at my csrfToken you can see that "The King" is passed as a value. After clicking on Send to Intruder should I only use The King as a payload position? Because Burpsuite preselects 38 payload positions. Does this make sense? – Nazar Medeiros Sep 26 '16 at 12:23
  • I almost never accept the positions that Intruder preselects. Just clear them and select the position you are interested in (in this case "The King"). – stanko Sep 26 '16 at 12:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.