I am getting a XSS vulnerability through burp suite but when I inject script manually I don't get the XSS vulnerability.

Is this a reportable vulnerability?

  • We need to know more... is it reflected? stored? What browser are you injecting it manually in? If it’s Chrome, Google has made a XSS Auditor which blocks XSS.
    – CoderPE
    Nov 16, 2018 at 13:45

2 Answers 2


If you can't verify the result of an automated tool, it is not a good idea to report it's findings.

Automated tools are great, but they have a problem with false positives.


Is this reflected XSS? One of the common reasons this can be difficult to reproduce is because of browser XSS filters. I recommend you use Firefox which does not have a filter.

To properly determine if this is exploitable you need to gain an understanding of what is happening - what characters get through the filter, what page context the reflection is in, etc.

If you'd like the Portswigger support team to look at this, please send screenshots of the advisory, request and response to [email protected]


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .