I build a small website for penetration testing purposes using the Google Webtool Kit
framework.
However I was able to make the application vulnerable against xss by using following code:
final HTML xssWidget = new HTML();
xssButton.addClickHandler(new ClickHandler() {
@Override
public void onClick(ClickEvent event) {
xssWidget.setHTML(xssTextField.getText());
}
});
As you can see I am using an HTML widget to display input information directly in the UI. When the user fills in some text into a text field, it will be displayed immediately after clicking on a button.
So far so good.. The problem is, I can't use burp suite to record the request I sent and use this as a base request for the Intruder or Repeater. Clicking on that button is "technically" not seen in burp, because it is not directed to the server (no interaction).
Can anyone give me an advice? Best regards, Nazar