diff --git a/src/main/java/burp/BurpExtender.java b/src/main/java/burp/BurpExtender.java index 8e6538a..289462c 100644 --- a/src/main/java/burp/BurpExtender.java +++ b/src/main/java/burp/BurpExtender.java @@ -103,7 +103,7 @@ public List doPassiveScan(IHttpRequestResponse baseRequestResponse) String jsCode = tag.html(); // check that we are executing javascript with our parameter value as a method name // this would find things like - if( jsCode.contains(p.getValue() + "({") && Character.toString(jsCode.charAt((jsCode.indexOf(p.getValue()+"({"))-1)).matches("[^a-zA-Z0-9\\.]") ) { + if( jsCode.contains(p.getValue() + "({") && Character.toString(jsCode.charAt((jsCode.indexOf(p.getValue()+"({"))-1)).matches("[^a-zA-Z0-9]") ) { String detail = "Same Origin Method Execution might be possible. This is rated as high severity because it appears the callback parameter" + " is specifying which method to directly call in the response under a Javascript context." + " Search for " + p.getValue() + "({ in the response to determine validity.";