ProfessionalCommunity Edition

Testing for stored XSS with Burp Suite

• Last updated: June 18, 2024

• Read time: 3 Minutes

Stored XSS arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. In a stored XSS attack, the attacker places their exploit into the application, but the exploit only executes when a user visits a particular location. For example, an attacker may place an exploit in a blog post comment that later executes when a victim user visits the blog post.

While Burp Scanner can detect stored XSS, you can also use Burp to manually identify linked input and output points in the application, then test these links to determine whether a stored XSS vulnerability is present.

Steps

You can follow along with the steps below using the Stored XSS into HTML context with nothing encoded Web Security Academy lab.

Identifying linked input and output points

To test for stored XSS with Burp Suite, you first need to identify points where user input is stored and then later displayed by the application:

1. Go to Proxy > Intercept and click Intercept is off to toggle intercept on. Burp will now intercept each request and display the message details in the Intercept tab.

2. In Burp's browser, click around the website. As you browse, review each request in the Intercept tab:

   1. Identify data entry points that may be vulnerable to stored XSS.
   2. Submit a unique value into each of the identified data entry points.
   3. Click Forward to send the request.

3. In Proxy > HTTP history, filter the messages to identify any responses that include the unique values:

   1. Click on the filter bar.
   2. Under Filter by search term, enter the unique value.
   3. Click Apply. The HTTP history tab now only shows messages that include the unique value.
   4. Review the messages in the HTTP history tab to identify any linked input and output points.

Testing for stored XSS

Once you've found linked input and output points, you can test these for stored XSS:

1. In Proxy > HTTP history, right-click the request that results in the input being stored. Select Send to Repeater. Do the same for the later request that results in the input being displayed.
2. Go to the Repeater tab.

3. Create a group in Repeater that includes the two messages:

   1. Right-click a message tab in Repeater and select Add tab to group > Create tab group.
   2. Add both messages to the folder.
   3. Click Create.
   4. Drag the messages to place the input message before the output message.
   
4. In the input request, change the data entry point to a proof-of-concept XSS payload. For example, <script>alert(1)</script>.
5. Click the Send drop-down menu, then select Send group in sequence (separate connections).
6. Click Send group (separate connections) to send the request.
7. Right-click on the output and select Show response in browser. Burp Suite displays a dialog containing a URL.
8. Copy and paste this URL into your browser to see if the proof of concept ran successfully. If you used the alert() function in your payload, you should see an alert pop-up.