Home → Questions →

XSS Not Detected

• Edit

JL

20 May, 2015 09:15 PM

I cannot get the scanner to find the xss vulnerability we made on purpose. The code below will allow you to execute xss but I can't get the scanner to find it. Am I doing something wrong with the scanner profile? I have tried the default and xss profile and it doesn't find it. We are scanning this from a linux machine to an app server hosted on another machine.

Insert into DOM

1. 1 Posted by JL on 20 May, 2015 09:17 PM

   

   attached the example index.html file

   • index.html 466 Bytes
   • Edit

2. 2 Posted by JL on 20 May, 2015 09:20 PM

   

   The index.html page attached above will allow you to type in script to create a popup, we thought the scanner would find this. Example script in attached screenshot.

   • script.jpg 6.67 KB
   • Edit

3. Support Staff 3 Posted by Tasos Laskos on 21 May, 2015 04:25 AM

   

   Hello,

   Since these 2 elements don't have any clear association with each other the current checks don't audit them.
   For example, if the button was a submit to a form or the document.write was triggered by an event on the input then the issue would be identified,

   Creating event permutations on the entire interface could very well result in an unworkable amount of operations.

   Although, I suppose cases such as you describe do happen and operating on a best effort basis would be better than nothing, so I'll write a check to cover these as well as possible.

   I'll let you know once I've got a nightly you can test.

   Cheers

   • Edit

4. Support Staff 4 Posted by Tasos Laskos on 21 May, 2015 04:14 PM

   

   Done: https://github.com/Arachni/arachni/commit/512ebfcbfd7844488ab3204e0...

   You can try it in the nightlies: https://sourceforge.net/projects/arachni/files/nightlies/

   Thanks for the feedback.

   Cheers

   • Edit

5. Tasos Laskos closed this discussion on 21 May, 2015 04:14 PM.