I am getting started in testing web applications, and I am having trouble verifying vulnerabilities.

It seems all modern browsers have protections against things like XSS.

When something like Burp finds an XSS vulnerability, I can't ever verify it when using something like TamperData. The code gets sent to the page, but it never seems to execute.

Is there a browser that specifically allows things like XSS and CSRF to execute, for the purposes of testing?

  • There is PenQ from QBurst. It is open source and free to download. – Anonymous Platypus Apr 6 '16 at 11:35

Most browsers allow you to disable the function. For instance with chrome you need to start the browser using

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security

For Firefox you have to go type about:config in the address bar. Then you need to set the browser.urlbar.filter.javascript to False.

For Internet Explorer click Tools–>Internet Options and then navigate to the Security Tab. You need to set a custom security level. Scroll towards the bottom where you will find that Enable XSS filter and disable it.


Your best bet would be mantra from OWASP:


Contains a myriad of tools for penetration testing out of the box. Also open source should you need to add/modify anything.


When something like Burp finds an XSS vulnerability, I can't ever verify it when using something like TamperData.

If you are already using Burp to find the vulnerability, why not use the intercepting proxy functionality to modify the request and to inject the XSS payload?

Burp Intercepting Proxy

  • That's exactly what I was trying, and what was failing. – Sonny Ordell Aug 25 '14 at 16:58
  • Sonny: Maybe it was a false positive in this particular case? – SilverlightFox Aug 25 '14 at 17:00

There is the Sandcat project which provide a lot of pen testing tools, like scripting in lua, better view over the console and dynamic injection tools, and a lot of other good surprises.

Some of its unique features include:

  • Live HTTP Headers — built-in live headers with a dedicated cache per tab and support for preview extensions
  • Sandcat Console — an extensible command line console; Allows you to easily run custom commands and scripts in a loaded page
  • Resources tab — allows you to view the page resources, such as JavaScript files and other web files.
  • Page Menu extensions — allows you to view details about a page and more.
  • Pen-Tester Tools — Sandcat comes with a multitude of pen-test oriented extensions. This includes a Fuzzer, a Script Runner, HTTP & XHR Editors, Request Loader, Request Replay capabilities



Not the answer you're looking for? Browse other questions tagged or ask your own question.