1

I build a small website for penetration testing purposes using the Google Webtool Kit framework.

However I was able to make the application vulnerable against xss by using following code:

final HTML xssWidget = new HTML();
xssButton.addClickHandler(new ClickHandler() {

    @Override
    public void onClick(ClickEvent event) {
        xssWidget.setHTML(xssTextField.getText());
    }
});

As you can see I am using an HTML widget to display input information directly in the UI. When the user fills in some text into a text field, it will be displayed immediately after clicking on a button.

So far so good.. The problem is, I can't use burp suite to record the request I sent and use this as a base request for the Intruder or Repeater. Clicking on that button is "technically" not seen in burp, because it is not directed to the server (no interaction).

Can anyone give me an advice? Best regards, Nazar

1

Since Burp is acting as a proxy, and since your XSS exercise happens client-side only, Burp will not be of any use as far as I know (since it is not a DOM manipulator, for example).

If you want to involve Burp in your resting, and since it is acting as a proxy, you have to adapt your code so that an http request can be captured and replayed (and for which parameters can be fuzzed).

I'd recommend you to have a form that submits a request with a "payload" parameter, and to fill the content of your DOM via an event handler. By doing so, you would be able to use Burp's features, including the fuzzing of the "payload" parameter

  • Thanks for help! I appreciate your time. But in case I would not change the request behaviour (from clientside code to serverside code), what could I do instead? Is there another tool which can help me in this scenario? – Nazar Medeiros Dec 23 '16 at 7:57
  • 1
    Not that I know of. But this goes beyond the scope of your question : I explained how to involve Burp in your testing, if you follow those steps it will work. Otherwise I'd google for a client-side only fuzzing tool for web-apps (which is a little weird but certainly exists :) ) – niilzon Jan 3 '17 at 8:32
  • You could validate the answer btw – niilzon Feb 14 '17 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.