I'm trying to create a POC for responsible disclosure, but I'm having an issue...

When I use a textbox to submit my payload, it brings me to another page where the javascript executes and is present in the HTML.

If I copy paste the end URL, where the payload is present, the part of the page that contained my vector is no longer present.

I tried entering my payload into the textbox, intercepting the request with Burp Suite and then repeating the request in a new tab.

Instead of getting the same result, a txt file is downloaded with a JSON response. This is the only GET request that's sent between submitting the payload and the javascript executing.

If it isn't clear what my goal is, I'd like to make this an actual exploitable bug instead of simply being a self-XSS.

I've never ran into this issue before, so I'm quite confused why this is happening.

marked as duplicate by SilverlightFox, Xander, schroeder, Question Overflow, Scott Pack Jul 13 '15 at 20:53

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Is the form being submitted using POST / XHR? - When you copy/paste a URL, the request should be in the query string (ie: GET request). – ndrix Jul 9 '15 at 6:38
  • @m1ke A GET request is sent right away with the query string in one of the parameters. If it helps, I noticed one of the parameter's values is "mycjson64". – Michael Blake Jul 9 '15 at 6:43
  • It seems your form's response is a JSON object which is rendered in your page. I'm afraid the page isn't even reloading. Do you have a code snippet when the form is submitted? It's probably an XHR function, or JQuery's $.getJSON() ... – ndrix Jul 9 '15 at 6:58
  • @m1ke I've been looking quite a while through the javascript trying to find what it does when it's submitted, but there's quite a bit to look through, even with listeners. I'll keep looking to see if I find anything. And it looks like you're right. I don't think the page is reloading, but the URL is changing, which I believe would make it DOM XSS, which I believe would make it not exploitable, unfortunately. – Michael Blake Jul 9 '15 at 7:19
  • @MichaelBlake There might be other parameters that you need to submit along with payload. An anti-csrf token, for example. Also try setting referrer to where the form was submitted from. Since the URL changes, I don't think it's an ajax request, it's using HTML5 instead, you can verify whether it's an ajax request or not by inspecting requests in Developer Tools > Network (filter=XHR). Ajax requests also typically send an X-Requested-With HTTP header. – 1lastBr3ath Jul 9 '15 at 10:08

Browse other questions tagged or ask your own question.