Hands-On Bug Hunting for Penetration Testers

Payload Processing

Here you'll want to add a rule, choosing Invoke Burp extension as the rule type and then XSS Validator as the processor:

After you've made all these selections, your app's GUI should look like the following:

We need to make one more setting change before we can start our attack. If you head over to the xssValidator tab, you'll see a random string generated in the Grep Phrase field, and you might also spot the bullet point explaining that Successful attacks will be denoted by the presence of the Grep Phrase:

We want to add ...