~

Tag: 安全

  • xss

    xss

    —

    from

    moneyslow
    of

    1.Non-persistent XSS 便携a.php <?php $input = $_GET[“param”]; echo “<div>”.$input.”</div>”; ?> 访问 https://www.moneyslow.com/a.php?param=<script>alert(/xss/)</script> 2.DOM XSS <html> <head> <meta http-equiv=”Content-Type” content=”text/html; charset=utf-8″> <script type=”text/javascript”> function changeLink() { var str = document.getElementById(“text”).value; document.getElementById(“t”).innerHTML=”<a href='”+str+”‘ >testlink</a>”; } </script> </head> <div id=”t”></div> <input type=”text” id=”text” value=”” /> <input type=”button” id=”s” value=”write” onclick=”changeLink()” /> </html> 测试输入 ‘ onclick=alert(/xss) //