Skip to content

Commit a4fff38

Browse files
authored
Merge pull request #6 from rsponeev/master
Update README.md
2 parents 4ac2b21 + 08c1ccd commit a4fff38

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Each burp issue includes detailed info about reflected parameter, such as:
2020

2121
# Allowed symbols analyse
2222
![reflector usage](https://github.com/elkokc/reflector/blob/master/screenshot/symbols_analyse.png)
23-
When the reflection is found and option "Aggressive mode" is activated, the reflector will check which of special-symbols are displayed on this page from vulnerable parameters. For this action, reflector compose additional requests for each reflected parameter. In example, while we was working with elkokc.ml website reflector are generated issue with a detailed information about reflection. There are 3 reflection for "search" parameter and each of them pass special symbols. Because of the possibility of displaying special characters issue severity is marked as high. Every time when reflection is found reflector define severity and generate burp issue.
23+
When the reflection is found and option "Aggressive mode" is activated, the reflector will check which of special-symbols are displayed on this page from vulnerable parameters. For this action, reflector compose additional requests for each reflected parameter. In example, while we were working with elkokc.ml website reflector are generated issue with a detailed information about reflection. There are 3 reflection for "search" parameter and each of them pass special symbols. Because of the possibility of displaying special characters issue severity is marked as high. Every time when reflection is found reflector define severity and generate burp issue.
2424

2525
# Context analyse
2626
In the "Check context" mode reflector it's not only show special characters that are reflected to the page, but also figure out a character that allows to break the syntax in the page code. In example you may see server response by reflector extension. Parameter "search" was send with a payload - p@y<"'p@y. As a result, it was reflected a few times in a different contexts.

0 commit comments

Comments
 (0)