Medium 级别存储型 XSS 演示(附链接)

简介: Medium 级别存储型 XSS 演示(附链接)

环境准备


测试

打开页面

输入正常值观察

一样的,用户名做了长度限制

更改后输入 HTML 标签语句测试


一样没有做过滤,接下来试试 JS 恶意代码

发现只剩下了 alert(/xss/),过滤掉了  关键字

再输入  测试</div><div style="text-align: center;"><span data-card-type="inline" data-ready-card="image" data-card-value="data:%7B%22src%22%3A%22https%3A%2F%2Fucc.alicdn.com%2Fpic%2Fdeveloper-ecology%2Fvzmvmwcrnweq2_f2b9f229077c4acc81c2fed1de5b6834.png%22%2C%22originWidth%22%3A1920%2C%22originHeight%22%3A1080%2C%22size%22%3A0%2C%22display%22%3A%22inline%22%2C%22align%22%3A%22left%22%2C%22linkTarget%22%3A%22_blank%22%2C%22status%22%3A%22done%22%2C%22style%22%3A%22none%22%2C%22search%22%3A%22%22%2C%22margin%22%3A%7B%22top%22%3Afalse%2C%22bottom%22%3Afalse%7D%2C%22width%22%3A1200%2C%22height%22%3A675%7D"></span></div><div>发现咱们的猜测没错,可以试试双写或者大小写混淆</div><div><br /></div><div>关键字采用大小写混淆</div><div><span data-card-type="inline" data-ready-card="image" data-card-value="data:%7B%22src%22%3A%22https%3A%2F%2Fucc.alicdn.com%2Fpic%2Fdeveloper-ecology%2Fvzmvmwcrnweq2_e84d6a17e5fa401dba7f4950faccb9b4.png%22%2C%22originWidth%22%3A1920%2C%22originHeight%22%3A1080%2C%22size%22%3A0%2C%22display%22%3A%22inline%22%2C%22align%22%3A%22left%22%2C%22linkTarget%22%3A%22_blank%22%2C%22status%22%3A%22done%22%2C%22style%22%3A%22none%22%2C%22search%22%3A%22%22%2C%22margin%22%3A%7B%22top%22%3Afalse%2C%22bottom%22%3Afalse%7D%2C%22width%22%3A1200%2C%22height%22%3A675%7D"></span></div><div><br /></div><div>成功</div><div style="text-align: center;"><span data-card-type="inline" data-ready-card="image" data-card-value="data:%7B%22src%22%3A%22https%3A%2F%2Fucc.alicdn.com%2Fpic%2Fdeveloper-ecology%2Fvzmvmwcrnweq2_dea9d762f11d48998e5f5f272825dcbb.png%22%2C%22originWidth%22%3A1920%2C%22originHeight%22%3A1080%2C%22size%22%3A0%2C%22display%22%3A%22inline%22%2C%22align%22%3A%22left%22%2C%22linkTarget%22%3A%22_blank%22%2C%22status%22%3A%22done%22%2C%22style%22%3A%22none%22%2C%22search%22%3A%22%22%2C%22margin%22%3A%7B%22top%22%3Afalse%2C%22bottom%22%3Afalse%7D%2C%22width%22%3A1200%2C%22height%22%3A675%7D"></span></div><div> 双写被过滤的标签</div><div style="text-align: center;"><span data-card-type="inline" data-ready-card="image" data-card-value="data:%7B%22src%22%3A%22https%3A%2F%2Fucc.alicdn.com%2Fpic%2Fdeveloper-ecology%2Fvzmvmwcrnweq2_be91ad0bde084a4a914ad4463582f7a5.png%22%2C%22originWidth%22%3A1920%2C%22originHeight%22%3A1080%2C%22size%22%3A0%2C%22display%22%3A%22inline%22%2C%22align%22%3A%22left%22%2C%22linkTarget%22%3A%22_blank%22%2C%22status%22%3A%22done%22%2C%22style%22%3A%22none%22%2C%22search%22%3A%22%22%2C%22margin%22%3A%7B%22top%22%3Afalse%2C%22bottom%22%3Afalse%7D%2C%22width%22%3A1200%2C%22height%22%3A675%7D"></span></div><div><br /></div><div>成功 </div><div><span data-card-type="inline" data-ready-card="image" data-card-value="data:%7B%22src%22%3A%22https%3A%2F%2Fucc.alicdn.com%2Fpic%2Fdeveloper-ecology%2Fvzmvmwcrnweq2_891072a190f94daba2c8a09cc011607f.png%22%2C%22originWidth%22%3A1920%2C%22originHeight%22%3A1080%2C%22size%22%3A0%2C%22display%22%3A%22inline%22%2C%22align%22%3A%22left%22%2C%22linkTarget%22%3A%22_blank%22%2C%22status%22%3A%22done%22%2C%22style%22%3A%22none%22%2C%22search%22%3A%22%22%2C%22margin%22%3A%7B%22top%22%3Afalse%2C%22bottom%22%3Afalse%7D%2C%22width%22%3A1200%2C%22height%22%3A675%7D"></span></div><div><br /></div></div>

相关文章
|
1月前
|
JavaScript
High 级别 DOM 型 XSS 演示(附链接)
High 级别 DOM 型 XSS 演示(附链接)
|
1月前
|
存储 JavaScript 前端开发
High 级别存储型 XSS 演示(附链接)
High 级别存储型 XSS 演示(附链接)
|
1月前
|
存储 前端开发 JavaScript
Low 级别存储型 XSS 演示(附链接)
Low 级别存储型 XSS 演示(附链接)
|
1月前
|
JavaScript
Medium 级别 DOM 型 XSS 演示(附链接)
Medium 级别 DOM 型 XSS 演示(附链接)
|
1月前
|
JavaScript
Low 级别 DOM 型 XSS 演示(附链接)
Low 级别 DOM 型 XSS 演示(附链接)
|
1月前
|
JavaScript 前端开发
High 级别反射型 XSS 演示(附链接)
High 级别反射型 XSS 演示(附链接)
|
1月前
|
存储 JavaScript 前端开发
前端xss攻击——规避innerHtml过滤标签节点及属性
前端xss攻击——规避innerHtml过滤标签节点及属性
100 4
|
1月前
|
JavaScript 安全 前端开发
js开发:请解释什么是XSS攻击和CSRF攻击,并说明如何防范这些攻击。
XSS和CSRF是两种常见的Web安全威胁。XSS攻击通过注入恶意脚本盗取用户信息或控制账户,防范措施包括输入验证、内容编码、HTTPOnly Cookie和CSP。CSRF攻击则诱使用户执行未经授权操作,防范手段有CSRF Tokens、双重验证、Referer检查和SameSite Cookie属性。开发者应采取这些防御措施并定期进行安全审计以增强应用安全性。
37 0
|
1月前
|
缓存 安全 JavaScript
前端安全:Vue应用中防范XSS和CSRF攻击
【4月更文挑战第23天】本文探讨了在Vue应用中防范XSS和CSRF攻击的重要性。XSS攻击通过注入恶意脚本威胁用户数据,而CSRF则利用用户身份发起非授权请求。防范措施包括:对输入内容转义、使用CSP、选择安全的库;采用Anti-CSRF令牌、同源策略和POST请求对抗CSRF;并实施代码审查、更新依赖及教育团队成员。通过这些实践,可提升Vue应用的安全性,抵御潜在攻击。
|
1月前
|
安全 JavaScript Go
【Web】什么是 XSS 攻击,如何避免?
【Web】什么是 XSS 攻击,如何避免?