Burp suggests that there is a reflection.. It changes a value of a cookie named as x as x=<script src=abc.js> and in response this value gets injected to a javascript function..

<script type="text/javascript">
fnUseX('arg1','<script src=abc.js>');

I tried a few scripts and looks like characters such as / and ; are blocked. Does this confirm the presence of cross site scripting? How we could actually exploit it? Are there any HTML5 XSS vectors which could be tried here?

1 Answer 1


This looks like it could be exploited using a cookie value like this


Try setting it manually and see if it fires the alert.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .