如何在 HTML 环境中执行 JavaScript
[英]How to execute JavaScript in HTML environment
问题描述
For a testing project I want to create a XSS vulnerable site.
对于一个测试项目，我想创建一个XSS易受攻击的站点。 My basic structure is a forum where people can add forum posts via input fields and a submit button.我的基本结构是一个论坛，人们可以在其中通过输入字段和提交按钮添加论坛帖子。 Currently I render the new post which should be displayed via innerHTML but with this method the malicious (eg <script>alert("123")</script> ) script which I want to insert as an attacker gets not executed.目前，我渲染了应该通过 innerHTML 显示的新帖子，但是使用这种方法，我想作为攻击者插入的恶意（例如<script>alert("123")</script> ）脚本不会被执行。 I searched for other alternatives to innerHTML but none of them worked.我搜索了 innerHTML 的其他替代方案，但没有一个有效。 How can I achieve JavaScript rendering in my code?如何在我的代码中实现 JavaScript 渲染？
Things I tried我尝试过的事情
appendChild();
eval();
insertAdjacentElement();
Input fields for creation new post用于创建新帖子的输入字段
<form>
<label for="topic"
>Topic:
<br />
<input id="topic" required
/></label>
<br />
<br />
<label for="text"
>Text:
<br />
<input id="text" type="text" required
/></label>
<br />
<button type="submit" id="submit">submit</button>
</form>
Input example text field (localStorage is the storage from the input fields)输入示例文本字段（localStorage 是输入字段的存储）
<div id="post">
<script>
if (localStorage.length > 0) {
post.innerHTML += localStorage.key(0);
}
</script>
</div>
2 个解决方案
解决方案1
0 2022-06-02 15:19:36
Solution解决方案
This function gives me actually the desired behaviour.这个功能实际上给了我想要的行为。
<div id="post">
<script>
if (localStorage.length > 0) {
post.innerHTML += localStorage.key(0);
eval(localStorage.getItem(localStorage.key(0)));
}
</script>
</div>
解决方案2
0 2022-06-03 05:44:12
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Document</title>
</head>
<body>
<form>
<label for="topic"
>Topic:
<br />
<input id="topic" required
/></label>
<br />
<br />
<label for="text"
>Text:
<br />
<input id="text" type="text" required
/></label>
<br />
<button id="submit" onclick="test()">submit</button>
</form>
<div id="TESTDIV">
</div>
<script>
function test(){
if(localStorage.length >0){
item+=localStorage.setItem(document.getElementById("topic").value,document.getElementById("text").value);
}
else{
var item=localStorage.setItem(document.getElementById("topic").value,document.getElementById("text").value);
}
document.getElementById("TESTDIV").innerHTML= localStorage.getItem(document.getElementById("topic").value);
}
</script>
</body>
</html>
Hi! Hope You are well i think i will works.
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.