GWT - using burp suite for injecting xss payloads

Question

I build a small website for penetration testing purposes using the Google Webtool Kit framework.

However I was able to make the application vulnerable against xss by using following code:

final HTML xssWidget = new HTML();
xssButton.addClickHandler(new ClickHandler() {

    @Override
    public void onClick(ClickEvent event) {
        xssWidget.setHTML(xssTextField.getText());
    }
});

As you can see I am using an HTML widget to display input information directly in the UI. When the user fills in some text into a text field, it will be displayed immediately after clicking on a button.

So far so good.. The problem is, I can't use burp suite to record the request I sent and use this as a base request for the Intruder or Repeater. Clicking on that button is "technically" not seen in burp, because it is not directed to the server (no interaction).

Can anyone give me an advice? Best regards, Nazar

Answer 1

Since Burp is acting as a proxy, and since your XSS exercise happens client-side only, Burp will not be of any use as far as I know (since it is not a DOM manipulator, for example).

If you want to involve Burp in your resting, and since it is acting as a proxy, you have to adapt your code so that an http request can be captured and replayed (and for which parameters can be fuzzed).

I'd recommend you to have a form that submits a request with a "payload" parameter, and to fill the content of your DOM via an event handler. By doing so, you would be able to use Burp's features, including the fuzzing of the "payload" parameter