DOM XSS alert has no evidence returned

[David S.]

Hi.  ZAP reports DOM XSS attack issues but no response is returned so how does ZAP determine there exists an issue?

The attack is by appending #blablabla to the .asp/.html

https://1.2.3.4/x.htm#blabla or https://1.2.3.4/x.asp#blabla

where blabla from ZAP are...

#jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

or 

#javascript:alert(1)

I also recall seeing others like x.asp?a=1&b=1#blabla

Thanks/david

[Simon Bennetts]

Hiya,

Thats described in the help for the DOM XSS add-on: https://www.zaproxy.org/docs/desktop/addons/dom-xss-active-scan-rule/

Cheers,

Simon

[David S.]

Use Reply all instead :)

If not mistaken, Zap detects potential issues by detecting the browser alert popups when it appends #alert()  or #alert(1).

Will it cause a false positive when the page has its own alert("blabla")?

The blank response page of the DOM XSS alert report still confuses me :) when other trigger alerts have content in the response.

[David S.]

Zap does not seem to report those DOM XSS after I change my own alert to console.log. 

Please advise.

[kingthorin+owaspzap]

https://github.com/zaproxy/zaproxy/issues/6484

Seems the same