{"id":129,"date":"2021-08-04T04:54:18","date_gmt":"2021-08-04T04:54:18","guid":{"rendered":"http:\/\/49.235.100.226\/?p=129"},"modified":"2021-08-31T08:40:49","modified_gmt":"2021-08-31T08:40:49","slug":"pikachu-xss","status":"publish","type":"post","link":"http:\/\/www.nokws.top\/index.php\/2021\/08\/04\/pikachu-xss\/","title":{"rendered":"Pikachu–XSS"},"content":{"rendered":"\n

Cross-Site Scripting \u7b80\u79f0\u4e3a\u201cCSS\u201d\uff0c\u4e3a\u907f\u514d\u4e0e\u524d\u7aef\u53e0\u6210\u6837\u5f0f\u8868\u7684\u7f29\u5199”CSS”\u51b2\u7a81\uff0c\u6545\u53c8\u79f0XSS\u3002
XSS\u662f\u4e00\u79cd\u53d1\u751f\u5728\u524d\u7aef\u6d4f\u89c8\u5668\u7aef\u7684\u6f0f\u6d1e\uff0c\u6240\u4ee5\u5176\u5371\u5bb3\u7684\u5bf9\u8c61\u4e5f\u662f\u524d\u7aef\u7528\u6237\u3002
\u5f62\u6210XSS\u6f0f\u6d1e\u7684\u4e3b\u8981\u539f\u56e0\u662f\u7a0b\u5e8f\u5bf9\u8f93\u5165\u548c\u8f93\u51fa\u6ca1\u6709\u505a\u5408\u9002\u7684\u5904\u7406\uff0c\u5bfc\u81f4\u201c\u7cbe\u5fc3\u6784\u9020\u201d\u7684\u5b57\u7b26\u8f93\u51fa\u5728\u524d\u7aef\u65f6\u88ab\u6d4f\u89c8\u5668\u5f53\u4f5c\u6709\u6548\u4ee3\u7801\u89e3\u6790\u6267\u884c\u4ece\u800c\u4ea7\u751f\u5371\u5bb3\u3002
\u56e0\u6b64\u5728XSS\u6f0f\u6d1e\u7684\u9632\u8303\u4e0a\uff0c\u4e00\u822c\u4f1a\u91c7\u7528\u201c\u5bf9\u8f93\u5165\u8fdb\u884c\u8fc7\u6ee4\u201d\u548c\u201c\u8f93\u51fa\u8fdb\u884c\u8f6c\u4e49\u201d\u7684\u65b9\u5f0f\u8fdb\u884c\u5904\u7406:
\u00a0\u00a0 \u8f93\u5165\u8fc7\u6ee4\uff1a\u5bf9\u8f93\u5165\u8fdb\u884c\u8fc7\u6ee4\uff0c\u4e0d\u5141\u8bb8\u53ef\u80fd\u5bfc\u81f4XSS\u653b\u51fb\u7684\u5b57\u7b26\u8f93\u5165;
\u00a0\u00a0 \u8f93\u51fa\u8f6c\u4e49\uff1a\u6839\u636e\u8f93\u51fa\u70b9\u7684\u4f4d\u7f6e\u5bf9\u8f93\u51fa\u5230\u524d\u7aef\u7684\u5185\u5bb9\u8fdb\u884c\u9002\u5f53\u8f6c\u4e49;
XSS\u76f8\u5173\u4ecb\u7ecd\uff1aCross-Site Scripting\uff08XSS\uff09\u7b80\u4ecb – kabibo – \u535a\u5ba2\u56ed (cnblogs.com)<\/a><\/p>\n\n\n\n

\u53cd\u5c04\u578bXSS\uff08get\uff09<\/h3>\n\n\n\n
\"\"<\/div>
\u53cd\u5c04\u578bXSS<\/figcaption><\/figure>\n\n\n\n
\"\"<\/div>
\u4fee\u6539\u6700\u5927\u8f93\u5165\u5b57\u7b26<\/figcaption><\/figure>\n\n\n\n

\u5c1d\u8bd5\u8f93\u5165<script>alert(1)<\/script>\uff0c\u53d1\u73b0\u5b57\u7b26\u53d7\u9650\uff0c\u89e3\u51b3\u65b9\u6cd5\uff1a<\/p>\n\n\n\n

1\u76f4\u63a5\u5728url\u5730\u5740\u680f\u4e2d\u8f93\u5165?message= <script>alert(1)<\/script> &submit=submit<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

2\u5728\u524d\u7aef\u66f4\u6539\u8f93\u5165\u9650\u5236<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u4fee\u6539maxlength<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u53cd\u5c04\u578bXSS\uff08post\uff09<\/h3>\n\n\n\n

\u767b\u5f55\u540e\u76f4\u63a5\u8f93\u5165<script>alert(1)<\/script><\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u5b58\u50a8\u578bXSS<\/h3>\n\n\n\n

\u76f4\u63a5\u8f93\u5165 <script>alert(1)<\/script> <\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

DOM\u578bXSS<\/h3>\n\n\n\n

\u8f93\u5165 <script>alert(1)<\/script> \u68c0\u67e5\u5143\u7d20\u53d1\u73b0\u4e0d\u884c<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u5229\u7528 ‘ \u73b0\u5c06href\u95ed\u5408\uff08\u6211\u731c\u7684\uff09\uff0c\u5229\u7528 onclick\u8fdb\u884c\u5f39\u7a97<\/p>\n\n\n\n

\u8f93\u5165 ‘ onclick=”alert(‘521’)”<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u4e5f\u53ef\u4ee5\u8f93\u5165’#’ onclick=”alert(‘521’)” <\/p>\n\n\n\n

DOM\u578bXSS-X<\/h4>\n\n\n\n

\u968f\u4fbf\u8f93\u70b9\u4ec0\u4e48\uff0c\u68c0\u67e5\u4e0b\u5143\u7d20<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u548c\u4e0a\u9762\u7684\u90a3\u4e2a\u7c7b\u4f3c\uff0c\u76f4\u63a5\u8f93 ‘ onclick=”alert(‘xss’)” \uff08\u4e0e\u4e0a\u9762\u90a3\u4e2a\u4e0d\u540c\u8fd9\u4e2a\u4f1a\u5728url\u91cc\u663e\u793a\uff09<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u4e5f\u53ef\u4ee5\u8f93\u5165’#’ onclick=”alert(‘521’)” <\/p>\n\n\n\n

XSS\u4e4b\u76f2\u6253 <\/h3>\n\n\n\n
\"\"<\/div>
\u7528\u6237\u754c\u9762<\/figcaption><\/figure>\n\n\n\n
\"\"<\/div>
\u540e\u53f0\u754c\u9762<\/figcaption><\/figure>\n\n\n\n

\u5c1d\u8bd5\u76f4\u63a5\u5229\u7528<script>alert()<script><\/p>\n\n\n\n

\"\"<\/div>
test<\/figcaption><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

XSS\u4e4b\u8fc7\u6ee4<\/h3>\n\n\n\n

\u5927\u5c0f\u5199\u8fc7\u6ee4<\/p>\n\n\n\n

\u8f93\u5165<SCRIPT>alert()<\/SCRIPT><\/p>\n\n\n\n

\"\"<\/div>
\u8f93\u5165\u6d4b\u8bd5<\/figcaption><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

XSS\u4e4bhtmlspecialchars<\/h3>\n\n\n\n

\u4ec0\u4e48\u662f htmlspecialchars <\/p>\n\n\n\n

\u628a\u9884\u5b9a\u4e49\u7684\u5b57\u7b26 “<” \uff08\u5c0f\u4e8e\uff09\u548c “>” \uff08\u5927\u4e8e\uff09\u8f6c\u6362\u4e3a HTML \u5b9e\u4f53\uff1a<\/p>\n\n\n\n

\u8be6\u89c1PHP htmlspecialchars() \u51fd\u6570 (w3school.com.cn)<\/a><\/p>\n\n\n\n

\u76f4\u63a5\u7528’ onclick=”alert(‘1’)” <\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

XSS\u4e4bhref\u8f93\u51fa<\/h3>\n\n\n\n

\u8f93\u5165https:\/\/www.baidu.com\u6d4b\u8bd5<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u76f4\u63a5\u7528javascript:alert(1)<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

XSS\u4e4b\u8f93\u51fa<\/h3>\n\n\n\n

\u67e5\u770b\u4e0b\u6e90\u4ee3\u7801<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u53d1\u73b0\u8f93\u51fa\u662f\u7531<script>\uff08\u4e0d\u77e5\u9053\u8fd9\u4e48\u8bf4\u5bf9\u4e0d\u5bf9\uff09<\/p>\n\n\n\n

\u5c1d\u8bd5 <\/script> <script> alert(1)<\/script>\u8f93\u5165\u95ed\u5408\uff08\u5916\u9762\u7684<script>\u4e0d\u80fd\u76f4\u63a5\u590d\u5236\u5230WordPress\uff1f\uff01\uff09<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u603b\u7ed3<\/h3>\n\n\n\n

\u5bf9\u4e8ehtml\u8bed\u8a00\u4e0d\u719f js \u4e0d\u719f<\/p>\n","protected":false},"excerpt":{"rendered":"

Cross-Site Scripting \u7b80\u79f0\u4e3a\u201cCSS\u201d\uff0c\u4e3a\u907f\u514d\u4e0e\u524d\u7aef\u53e0\u6210\u6837\u5f0f\u8868\u7684\u7f29\u5199”CSS& […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,4],"tags":[],"class_list":["post-129","post","type-post","status-publish","format-standard","hentry","category-pikachu","category-bachanglianxi"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/www.nokws.top\/index.php\/wp-json\/wp\/v2\/posts\/129","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.nokws.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.nokws.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.nokws.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.nokws.top\/index.php\/wp-json\/wp\/v2\/comments?post=129"}],"version-history":[{"count":2,"href":"http:\/\/www.nokws.top\/index.php\/wp-json\/wp\/v2\/posts\/129\/revisions"}],"predecessor-version":[{"id":164,"href":"http:\/\/www.nokws.top\/index.php\/wp-json\/wp\/v2\/posts\/129\/revisions\/164"}],"wp:attachment":[{"href":"http:\/\/www.nokws.top\/index.php\/wp-json\/wp\/v2\/media?parent=129"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.nokws.top\/index.php\/wp-json\/wp\/v2\/categories?post=129"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.nokws.top\/index.php\/wp-json\/wp\/v2\/tags?post=129"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}