Imagine we have the following vulnerable request, where the name parameter is vulnerable to XSS:
GET /dvwa/vulnerabilities/xss_r/?name=cosa HTTP/1.1 Host: 192.168.1.72 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://192.168.1.72/dvwa/vulnerabilities/xss_r/ Connection: close Cookie: security=low; PHPSESSID=3nradmnli4kg61llf291t9ktn1 Upgrade-Insecure-Requests: 1
You can catch it with the Burp Suite's proxy, and modify the parameter's value using the common testing string, as follows:
<script>alert(1)</script>
Quit Intercept ...
