0

I am getting a XSS vulnerability through burp suite but when I inject script manually I don't get the XSS vulnerability.

Is this a reportable vulnerability?

  • We need to know more... is it reflected? stored? What browser are you injecting it manually in? If it’s Chrome, Google has made a XSS Auditor which blocks XSS. – CoderPE Nov 16 '18 at 13:45
4

If you can't verify the result of an automated tool, it is not a good idea to report it's findings.

Automated tools are great, but they have a problem with false positives.

0

Is this reflected XSS? One of the common reasons this can be difficult to reproduce is because of browser XSS filters. I recommend you use Firefox which does not have a filter.

To properly determine if this is exploitable you need to gain an understanding of what is happening - what characters get through the filter, what page context the reflection is in, etc.

If you'd like the Portswigger support team to look at this, please send screenshots of the advisory, request and response to support@portswigger.net

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.