Persistent XSS plugin (prime and spider) does not work properly
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 15.8k
- Forks
- 2.6k
- Avg merge
- 13h 16m
- Merged PRs (30d)
- 17
Description
I have 2 PHP pages, one for updating information and for showing information, simple CRUD APP which is vulnerable to STORED XSS. The first page updates information and the information is showed by viewing the second page where stored XSS payload executes.
I scan(active scan tool > Persistent XSS plugin prime and spider) the first page for STORED XSS, and no alert is showed.
Here what I noticed on the active scan submitted HTTP request
- Resubmit the base(original) HTTP request to scan
- Insert the XSS payload in the target vector
- Use random string payload in the target vector
- Resubmit the base HTTP request(do the step 1 again). maybe active scan tries to search the random value that is issued earlier.
Expected behavior
revisit all requested pages after the insertion of payload to find the unique random string or searches unique random string on every HTTP response of pages that tester visits
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the active scan's Persistent XSS plugin, specifically its prime and spider behavior, and reproduce the report using the two-page CRUD application described in the issue. Trace how the original request, inserted payload, and random string are submitted and searched across responses. Done means a stored payload is detected after the scanner revisits the affected page or finds the unique value in visited responses.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100