Burp Suite detected a reflected XXS, if I use the Repeater and send the request the payload shows up in the response unfiltered, but if I visit the url it gets filtered, is there a way to bypass it or make it work? Thank you (if I show the response in browser I get the alert)

  • Welcome to the community. Could you rewrite your question please? At this state it's hard to comprehend what you're exactly asking. Commented Apr 4, 2023 at 17:43

2 Answers 2


Modern browsers have a tendency to URL encode characters whereas Repeater does not. Chances are it would work in an older browser, say IE 6, but does not work in a modern browser due to the browser sending a URL encoded character such as %22 instead of " which can break the payload even if the page does not encode characters

  • It might not just be stuff as old as IE, though. Different browsers all have different URL escaping rules (and a pentester who tests with only one browser is making a big mistake). IE11 is deprecated but some people still use it, possibly the same is true of the pre-Chromium Edge versions. Firefox and Safari are not Chrome-based, and do their own things. Even among Chrome-based browsers, different vendors and different versions may use different encoding rules.
    – CBHacking
    Commented Apr 5, 2023 at 8:32

It sounds like your problem is that the browser (which browser, incidentally?) is URL-encoding some parameters that are not required to be URL-encoded, but for which it's usually safer to do so. There are several things you can try:

  1. Check other browsers. Older ones, platform-specific ones like Safari or Samsung Internet, ones from completely different development families like Firefox vs. Chrome, etc. They all have somewhat different rules for what URL encoding they apply automatically.
  2. Check whether the site accepts the payload via POST request, especially in the body. You can put whatever you want in a POST body, if you don't mind including some superfluous cruft too. Even if you can't send the attack in a POST body, you might be able to avoid the URL encoding by sending the payload as a URL query parameter in a POST request. You can still use POST for XSS attacks, just have the victim visit a site that has an automatically-submitted HTML form.
  3. Try loading the vulnerable page in an iframe (X-Frame-Options/frame-ancestors permitting) in case the browser is only performing supererogatory encoding on top-level windows.
  4. Try to trick the browser into not encoding the URL part in question. For example, the encoding rules are URL paths, query parameter names, query parameter values, and even esoteric fields like username; if the attack is due to something like the site reflecting the whole URL into the response, rather than a specific parameter, you can probably find a way to send that payload without encoding it (especially if you try enough browsers).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .