reflector: Burp plugin able to find reflected XSS on page in real-time while browsing on site
reflector
Description
Burp Suite extension is able to find reflected XSS on the page in real-time while browsing on the website and include some features as:
- Highlighting of reflection in the response tab.
- Test which symbols is allowed in this reflection.
- Analyze of reflection context.
- Content-Type whitelist.
How to use
After plugin install you just need to start work with the tested web-application. Every time when reflection is found, reflector defines severity and generates burp issue.
Each burp issue includes detailed info about the reflected parameter, such as:
- Symbols that allowed in this reflection.
- Highlighting of reflection value in response.
- Reflection context analyze.
Allowed sybmols analyse
When the reflection is found an option “Aggressive mode” is activated, the reflector will check which of special-symbols are displayed on this page from vulnerable parameters. For this action, reflector composes additional requests for each reflected parameter. In the example, while we were working with elkokc.ml website reflector is generated issue with a detailed information about reflection. There are 3 reflections for “search” parameter and each of them pass special symbols. Because of the possibility of displaying special characters issue severity is marked as high. Every time when reflection is found reflector define severity and generate burp issue.
Context analyse
In the “Check context” mode reflector it does not only show special characters that are reflected the page but also figure out a character that allows breaking the syntax in the page code. In the example, you may see server response by reflector extension. Parameter “search” was sent with a payload – p@y<“‘p@y. As a result, it was reflected a few times in different contexts.
- reflection with next characters – ‘,”, < and the double quote allow to exit from this context and write HTML code.
- reflection with next characters – “, < and the bracket allow to inject HTML-tags.
- reflection with next characters – ‘,”, < and the single quote allow to exit from js variable context and write malicious code.
In the issue information it’s marked as:
- Context char – the character that allows breaking the syntax.
- Other chars – other chars that are reflected without context.
Reflection navigation
Navigation by arrow buttons in the response tab.
[adsense size='1' ]
Settings
- Scope only – allow reflector to work only with a scope added websites.
- Agressive mode – reflector generates the additional request with a test payload.
- Check context – activate check context mode.
Moreover, you can manage content-types whitelist with which reflector plugin should work. But if you will use another type except for text/html, this can lead to slowdowns in work.
Gloss