XSS Validator
Summary: The XSS Validator is a Burp Suite extension that sends base64-encoded page responses to a locally running XSS-Detector server built on Phantom.js and/or Slimer.js, which listens by default on port 8093. Users copy the extension's Grep Phrase into Burp Intruder's grep-match function, and payloads matching that phrase indicate successful XSS execution; version 1.3.2a was last updated 10 February 2022 and requires Java 7.
Bottom line: The extension carries an overall system impact rating of High, and PortSwigger states it is written by a third-party user and makes no warranty about its quality or usefulness - so the tool that confirms your XSS findings is itself unaudited code running against your scan traffic.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026