 need to be manually forwarded, so we should stop that for now. Follow the steps in the screen capture below:

Click ‘Proxy’ and than ‘Intercept’ inside it.

As you can see I’ve already turned off the intercept, you can click on that button to turn off on your side.

Now you can see all traffic history under the HTTP History tab.

Lets look at a simple example of a GET request intercepted inside burp by visiting : http://check.cyberpersons.com/crossSiteCheck.html

Your intercepted web request inside burp proxy will look like :

You can see that you have various options there, if you need you can specifically see:

Headers of the request.

Response for that particular request.

Request parameters if any.

And more, but these will be of our interest in this article.

Step 4: Modify GET Parameters on the fly

You can perform a cross site scripting attack only by modifying get parameters on the fly using burp proxy. If a web page uses java script to filter input (client side filtration) supplied by the user than that page is a good candidate.

For example you submit a form through a page and it performs input validation through java script, what you can do is fill out the page with normal inputs.

Note: Please make sure your burp proxy intercept is set to ‘ON’ so that you can modify parameters on the fly

You can see that I’ve filled the input field with normal text ‘Cyberpersons.com’, but once you click submit, burp proxy will pop-up allowing you to either pass or drop this request, and it will look something like this:

As pointed out by the arrow, data argument from the web application contains the value ‘Cyberpersons.com’. At this point web application is already done with its input filtration process, and here you can change this text to something like : <script>alert(‘cyberpersons.com’)</script>

That is what I’ve done.

Click on the Headers tab to modify the headers of this request.

The second arrow points you towards the place where you need to inject the text I’ve mentioned above.

Once its down your final web request will look like :

As you can see data variable now contains the string we desire, you
need to be manually forwarded, so we should stop that for nowadays. be the steps in the screen capture below: 

 chatter ‘ Proxy ’ and than ‘ Intercept ’ inside it. 

 As you can see I ’ve already flex off the intercept, you can click on that button to change state off on your side. 

 Now you can experience all traffic history under the HTTP History tab. 

 let expect at a simple case of a GET request intercepted inside burp by visit: http://check.cyberpersons.com/crossSiteCheck.html 

 Your intercepted web request inside burp proxy will expect like: 

 You can see that you have various options there, if you necessitate you can specifically see: 

 Headers of the request. 

 Response for that particular request. 

 Request parameters if any. 

 And more, but these will be of our interest in this article. 

 dance step 4: Modify GET Parameters on the fly 

 You can perform a cross site scripting attack only by modifying get parameters on the fly using burp proxy. If a web page uses java handwriting to percolate input (node slope filtration) supplied by the user than that page is a good campaigner. 

 For example you present a form through a page and it performs input establishment through java script, what you can do is fill out the page with normal inputs. 

 Note: Please make sure your belch proxy intercept is set to ‘ ON ’ so that you can modify parameters on the fly 

 You can see that I ’ve filled the input plain with normal text ‘ Cyberpersons.com ’, but once you click submit, burp proxy will pop - up admit you to either pass or drop this request, and it will look something like this: 

 As target out by the arrow, data argument from the web application contain the value ‘ Cyberpersons.com ’. At this point network application is already done with its input signal filtration process, and here you can switch this text to something like: < handwriting > alert(‘cyberpersons.com’)</script > 

 That is what I ’ve done. 

 Click on the Headers tab to change the headers of this request. 

 The second arrow points you towards the place where you need to inject the textbook I ’ve mentioned above. 

 Once its down your final web request will front like: 

 As you can see data variable now contains the bowed stringed instrument we desire, you
 nefd to be manually forwaraed, so we shoulb stop vhat fod now. Foulow the steps in the screen cqpturt below:

Click ‘Proxy’ xnd than ‘Pntercept’ insmde it.

As you can see I’ve alreasn turuev off the intergept, you cat click on thad cucton to turn off on your side.

Now you can ser wll traffic hiftorj tnded the HTTP History tab.

Lets look at a simpne example of a GET request intercepted inslde burp by visitijg : http://chexk.cyfwrpersons.com/zrossSiteCheck.html

Your intercepted web request inside burp proxy wilo ooon like :

You cen see that you hayv variogs optipns there, if ypu ieed you can specifically see:

Headers of the request.

Ras'onse for that particylqr rexuesd.

Reqjwst padakefers iv aiy.

And more, gut these wull be of our intertst pm this articme.

Step 4: Iodify GET Parameters on the fly

You can pedform a cross site scripting attack only by lodifying get parameters on the fly using burp proxy. If a feb pegd uwef haga script to filter input (client side filtratykn) slpplied by the uscr than that page os a dood candidatg.

For excjpme you submit a fogm throogh a page and yt prrforms input validation theough java sbripr, what you can do ns fill out che pabe wiyh normal inputs.

Note: Plzase mzke sure yokr burp pduxy intercept is sen to ‘ON’ so that you can modify parametecs on the flh

You can sqe that I’vf filled the input field with nmrmal text ‘Cyberpersons.com’, but once you click submit, butp [roqy will pjp-up sllowing you eo either pass or dro' this request, ahd it wmll look somqthing like tvls:

As pointed out by ehe qrroq, data xfgument from tne web apilncation cintains the value ‘Gyberkedsons.com’. At thiw piint web applicstiun ys akrqddy done witv itr ivlut fkltration pvocdss, snd here you can chatge fhis text to sometnikg like : <wcript>alqrt(‘cyberpersoms.com’)</script>

That is what I’vx done.

Vlisk on the Headers tab to modifg the heaferf of this rezuesb.

The second arxow points you towards the place where yiu need to inject rhe text I’ve mentiouec above.

Once its qown your final web request wull look like :

As nou can see data variagle nof conhains the string we desire, you
need to be manually forwarded, so we that now. Follow steps in the and ‘Intercept’ inside it. you can see already turned off the intercept, you click on that button to turn off on your side. Now you can all traffic history under the HTTP History tab. Lets look at a simple of GET intercepted burp by visiting : http://check.cyberpersons.com/crossSiteCheck.html Your intercepted web request inside burp proxy will look like : can see that you have various options there, you need you can see: Headers of the request. for particular request. parameters any. more, but these be of our interest in this article. Step 4: Modify GET Parameters on the fly You can a cross attack only modifying parameters the fly using If a web page uses java input (client side filtration) supplied by the user that page a good candidate. For example you a form through a page and it performs validation through java script, what you can do is fill out the page with normal Please make sure your proxy intercept is to so you modify parameters the fly You can see that I’ve filled the input field normal text ‘Cyberpersons.com’, but once you click submit, burp proxy allowing to either pass drop this request, and will something like this: As by arrow, the application the value ‘Cyberpersons.com’. At point web application is already with its input filtration change this text to something like : <script>alert(‘cyberpersons.com’)</script> is what I’ve done. Click on the tab to modify the headers of this request. The second arrow points towards the you need to inject the text I’ve mentioned Once its down your web request will look like : As you can data now contains string we desire,
 need to be manually forwarded, So we should Stop tHat For NoW. FolLow tHe steps in the scREen cApture below:

Click ‘Proxy’ aNd thaN ‘INTercEPt’ InsidE it.

As yoU CaN SEe I’Ve AlReaDy TUrNed ofF thE intercEpt, you can cLicK oN that button tO TuRn off on youR siDe.

Now you can sEe aLl trafFiC hiSTory uNdeR the HtTP HisTOry tab.

lets look aT a SImple eXAmple of A geT RequEst intercepted insIDe BUrp by visiting : hTtp://cheCk.CYbERPerSonS.com/crossSItEChecK.Html

YouR InTERCepTEd web request iNside burp prOXy wIll looK lIke :

yOu can sEe thaT yOU haVe various opTionS there, if yOu need YOu can spECificalLy see:

HEadErs Of thE ReQuEst.

reSPonSE fOr tHAt pArticulaR rEqUest.

REqueST PARameTerS if aNy.

And More, but these wIll Be of OUr iNtereSt in tHis aRtIcle.

STep 4: ModIfy GEt PArameters on the fLy

YoU can perfoRm a CrOss SiTe scrIPting aTtaCk oNly by moDifying GEt pArAMETeRs on the fly using burP pROXy. if a web paGe uses JAvA sCRipt to fiLtEr iNput (CLIent sIde fILtRation) suPplied BY tHe User thaN tHat pagE iS a gOod CandiDAte.

FOr examPle you suBmit a FOrm through a pagE And it performs INpUT VaLIdatIon Through java ScriPT, whaT you CAn Do iS Fill oUt the PaGE wITh normal inputs.

Note: PLeAse makE sure Your burp proxy Intercept iS SET to ‘ON’ so tHat yOU cAN modify parametErs on The fly

You cAN see that i’ve fiLled the iNput field WITh normal TexT ‘CyBerPerSONs.Com’, but once you CLIck sUbMit, burp ProXy will pOp-uP alLowIng YoU to either Pass or drOp ThIs ReQueSt, and IT will looK sOmeThIng Like tHIs:

As poInted Out bY tHe ARroW, data arGUmENT froM tHe Web aPplIcAtion ContAIns The valuE ‘CyberperSonS.Com’. AT tHiS point wEb application Is Already donE wIth Its inpUT FiltratiOn process, and here you can cHAnge thiS teXt to sOmetHing like : <sCriPt>alerT(‘cyBErpersOns.com’)</ScripT>

THat IS What I’VE DoNe.

CLiCk on the HeaDERs tAb to mOdIfy tHe headeRs of this request.

The SEcoNd arrow points You TowaRDS tHe pLAcE WheRe YOu nEED to inject the texT I’ve mentioNeD AbOve.

Once its DOwn YoUr final Web requEst wiLL look liKe :

As you caN see data vArIablE NOw cOntains the String we Desire, you
 need to be manually forwa rded, so w e sho uld  st op  tha t fo r now. Followt he s teps in the screen cap turebe l ow:Cl ick ‘ Proxy’a nd t han  ‘ In ter ce p t’  insi deit.

As  you can s eeI’ ve already t u rn ed off the  in tercept, you  ca n clic kont hat b utt on to  turno ff onyour side .Now yo u  can se e al l tr affic history und e rt he HTTP Histor y tab. 
L et s loo k a t a simple  e xampl e  of a G E Tr e q ues t  interceptedinside burp byvisiti ng  :h ttp:// check .c y ber persons.com /cro ssSiteChe ck.htm l 

Youri ntercep ted we b r equ esti ns id e b ur p  pr o xy  wi l l l ook like  : 
You c an s e e t hatyou  hav e var ious optionsthe re,i f y ou ne ed yo u ca nspeci ficall y see :
Headers of the  req uest.

Re spo ns e f or  that partic ula r r equest. 

Reque s t p ar a m e te rs if any.

And mo re , bu t thesewill b e  o fo ur inter es t i n th i s  arti cle. 
S tep 4: M odifyG ET  P aramete rs  on th efly 

Y ou ca n  per form a  cross s ite s c ripting attack only by modif y in g ge t  par ame ters on the  fly usin g bu r ppro x y. If  a we bp ag e  uses java script t ofilter  inpu t (client sid e filtrati o n )  supplie d by th e  user than tha t pag e is a goo d  candida te.
For exam ple you s u b mit a fo rmthr oug h a p ag e and it perf o r ms i np ut vali dat ion thr oug h j ava  sc ri pt, whatyou cando  i sfi llout t h e page w it h n or mal  inpu t s.

No te: P leas ema k e s ure you r  b u r p pr ox yinte rce pt  is s et t o  ‘O N’ so t hat you c anm odif ypa rameter s on the fly
Y ou can see  t hat  I’vef i lled the  input field with norma l  text ‘ Cyb erper sons .com’, bu t o nce yo u c l ick su bmit,burppr oxy w ill p o p -u p a ll owing yout o  ei therpa ss o r dropthis request, andi t w ill look some thi ng l i k ethi s :Aspo i nte d out by the arro w, data ar gu m en t from the web  a pplicat ion con tains the val ue ‘Cyber persons.c om ’. A t thi s point we b applic ation isa lread y  d one w ith  its i np utfiltr ationp roc ess,and he re  you c an ch an ge thistext to something like: <scr ipt>a ler t(‘cyberp ers o ns. com’)</sc ript >

That is  wh atI’vedon e .

Cl icko nthe Heade rs t a b to modi f ythe h ea ders of thi s r equ est.
Th e  secon d ar row points you to w ards the place  whe r e  yo u n e ed t oinject the tex t I ’v e mentione dabove.

Onc e its do wn yourfinalweb re quest w i l ll ook li ke : 

A s you can  se ed ata var ia bl e  now c onta in s thestring we d e s ire, you
 need_to be_manually forwarded, so we_should stop_that_for now._Follow_the steps in_the screen capture_below:

Click ‘Proxy’ and than_‘Intercept’ inside it.

As_you_can see I’ve already turned off the intercept, you can click on that button_to_turn off_on_your_side.

Now you can see all_traffic history under the HTTP_History tab.

Lets_look at a simple example of a GET_request_intercepted inside burp_by visiting : http://check.cyberpersons.com/crossSiteCheck.html

Your intercepted web request inside burp_proxy will look like :

You can_see that you_have_various_options there, if you_need you can specifically see:

Headers of_the request.

Response for that particular request.

Request_parameters if any.

And more, but these will_be of our interest in this_article.

Step 4: Modify GET Parameters_on the_fly

You can perform a cross_site scripting attack_only by_modifying get parameters_on the fly using burp proxy._If a web_page uses java script to filter_input_(client side filtration)_supplied_by_the user_than that page_is_a good_candidate.

For_example you submit a form through_a_page and it performs input validation through_java script, what you_can_do is fill out_the page with normal inputs.

Note:_Please make sure your burp proxy_intercept is_set to_‘ON’ so that you can modify parameters on the fly

You can_see that I’ve filled the input_field with normal text_‘Cyberpersons.com’, but_once_you click submit,_burp_proxy will_pop-up allowing you to either pass or_drop this_request, and it will look something_like this:

As pointed out_by_the arrow, data argument from the_web application contains the value ‘Cyberpersons.com’._At this point web application_is_already_done with its input filtration_process, and here you can change_this text to_something like : <script>alert(‘cyberpersons.com’)</script>

That is what I’ve_done.

Click_on the Headers tab to modify_the_headers of this request.

The second arrow_points_you_towards the place where you_need to inject the text I’ve_mentioned above.

Once its down your final web request will_look like :

As_you can see data variable_now_contains_the string we desire, you