I know its possible to use a tool like Burp to test Cookie/post/get values , but is it possible to use such tool to perform a brute force/dictionary attack (fuzzy test) on the values after # symbol.

I know that the values after the # in a URL are not sent to the server. They are only interpreted by the browser. This makes it more difficult to use tools such as Burp.

  • What would you want to achieve? I have never heard of any malicious use of the hash parameter so why do you want to do a (fuzzy) test?
    – Jeff
    Commented Oct 19, 2016 at 17:47
  • Pentesterlab 'Web for Pentester I' XSS exercise 9: pentesterlab.com/exercises/web_for_pentester document.write(location.hash.substring(1)); "This example is a DOM-based XSS. This page could actually be completely static and still be vulnerable. ... When the page is rendered, the JavaScript code uses the current URL to retrieve the anchor portion of the URL (#...) and dynamically (on the client side) write it inside the page. This can be used to trigger a XSS vulnerability, if you use the payload as part of the URL [maliciously sent]."
    – Aralox
    Commented Apr 28, 2017 at 8:37


You must log in to answer this question.

Browse other questions tagged .