An article for newbies! (as requested)

面向新手的文章！ (按照要求)

This article is for the newbies who are asking me to write this. Of course there are pro’s everywhere. You may not waste your time by reading. Please don’t judge me for this. Just wanted to let my followers learn how to find and exploit XSS as simple as I can tell them. First of all, you need to find a reflection. We can define “reflection” as a parameter value taking place in source code of the application you are testing. For ex. let’s assume there is a “name” parameter in the URL. If you try name=asd’ and see the parameter reflected in the app source code as:

Ť他的文章是谁问我写这个的新手。 当然到处都有专业人士。 您可能不会浪费时间阅读。 请不要为此判断我。 我只是想让我的关注者学习到如何发现和利用XSS，就像我告诉他们的那样简单。 首先，您需要找到反思。 我们可以将“反射”定义为在您正在测试的应用程序的源代码中发生的参数值。 对于前。 假设URL中有一个“名称”参数。 如果您尝试使用name = asd'并看到应用程序源代码中反映的参数为：

You are on the way of successfully exploit XSS, because you just found the reflection. To exploit XSS here, you need to just add the payload: asd’-alert(1)-’ or asd’;alert(1) as name parameter value or if developers used “ char instead of ‘ then you have to use asd”-alert(1)-” of course. This reflection was in a SCRIPT context and was easy to exploit.

您正处于成功利用XSS的道路上，因为您刚刚找到了反映。 要在此处利用XSS，您只需添加有效负载： asd'-alert(1)-'或asd'; alert(1)作为名称参数值，或者如果开发人员使用“ char代替'，则必须使用asd” -alert(1)-” 。 这种反映是在SCRIPT环境中进行的，并且易于利用。

What if it was in HTML context?For ex. we see the search text (asd) in source code like this:

如果是在HTML上下文中怎么办？ 我们在源代码中看到如下搜索文本(asd)：

<body><div>search result asd not found!</div></body>

找不到<body> <div>搜索结果asd！</ div> </ body>

Then you need to try to open a new tag with the < sign.The simplest way of it, is to use <svg onload=alert(1)> as payload.You enter <svg onload=alert(1)> on the search field and see the reflection.

然后您需要尝试使用<符号打开一个新标签。最简单的方法是使用<svg onload = alert(1)>作为有效负载。在搜索中输入<svg onload = alert(1)>场，看看反射。

If you see &lt;svg onload=alert(1)&gt; as reflection in the source code, then you can’t trigger XSS here. Because developers have filtered the inputs and HTML-Encoded dangerous chars. (This was asked me several times) But you see it as <svg onload=alert(1)> on the page you see. (That’s why I always tell you to check source code!)

如果看到＆lt; svg onload = alert(1)＆gt; 作为源代码中的反映，那么您不能在此处触发XSS。 因为开发人员已经过滤了输入和HTML编码的危险字符。 (这被问过我几次)，但是您在看到的页面上将其显示为<svg onload = alert(1)>。 (这就是为什么我总是告诉您检查源代码！)

Tip: Without checking the source code, when you use <svg> you see some horizontal space on the page, which saves time for you. You can think <svg> tag opened successfully there.

提示：如果不检查源代码，则在使用<svg>时会在页面上看到一些水平空间，从而为您节省了时间。 您可以认为<svg>标记已在此处成功打开。

Next reflection position: attributes

下一个反射位置：属性

The above example was in a <div> tag as you see. Reflection should be in it’s attribute as well. For ex. you found a parameter in the URL and it changes the DIV tag’s class value. Let’s assume it’s name is hideornot=hide

如您所见，以上示例位于<div>标记中。 反思也应该是它的属性。 对于前。 您在网址中找到了一个参数，它会更改DIV标签的类值。 假设它的名字是hideornot = hide

<body><div id=”adiv” class=”hide”>search result asd not found!</div></body>

<body> <div id =” adiv” class =“ hide”>找不到搜索结果asd！</ div> </ body>

To exploit this, you try to break out of the “ by using hideornot=hide”then check source, or if you see some break-out on the page you see, no need. because it seems it will work. source becomes: (see the double quote)

为了利用这一点，试图打破“使用hideornot =隐藏”然后检查源出，或者如果你看到一些突破了网页上看到，没必要。 因为它似乎会工作。 来源变为：(请参见双引号)

<body><div id=”adiv” class=”hide””>search result asd not found!</div></body>

<body> <div id =” adiv” class =“ hide””>未找到搜索结果asd！</ div> </ body>

You can use onevents (which DIV tag has, onmouseover for ex.) here to exploit, because it is in attribute context. So, the URL param would become: hideornot=hide”onmouseover=”alert(1)(the “> chars will be added to finish the tag, by the webpage)

您可以在此处使用onevents (该DIV标签具有onmouseover，例如。)，因为它位于属性上下文中。 因此，URL参数将变为： hideornot = hide” onmouseover =” alert(1) (将通过网页添加“>字符以完成标记”)

Again, if you see &quot instead of “ then this is filtered, too.

同样，如果看到的是“而不是”，则也会被过滤。

And mostly asked another question, how to bypass WAFs?It is not that easy. You have to try every possibilities. For ex. WAF blocks onevents. You need to find the onevent which is not blocked by WAF. In the past, I have several times bypassed WAFs with onwheel event handler. In the near past, I could do it with onpointerenter event handler.and today, ontoggle still works on some cases. WAF bypassing is a high level action. So, you need to know the simple ways to exploit XSS like I tried to tell you.You need to know which onevents works on which TAGs. For ex. onload event works on BODY, SVG, IFRAME but doesn’t work on DIV.

大多数人问了另一个问题，如何绕过WAF？这不是那么容易。 您必须尝试各种可能性。 对于前。 WAF会阻止onevents。 您需要找到未被WAF阻止的事件。 过去，我多次使用onwheel事件处理程序绕过WAF。 在不久的将来，我可以使用onpointerenter事件处理程序来完成此操作。今天，toggle在某些情况下仍然有效。 WAF绕过是一项高级操作。 因此，您需要像我试图告诉您的那样，了解利用XSS的简单方法。您需要知道哪些事件在哪些TAG上起作用。 对于前。 onload事件适用于BODY，SVG，IFRAME，但不适用于DIV。

If you find reflection in an input field: (One of the most cases)

如果您在输入字段中发现反射：(大多数情况之一)

<body><div id=”adiv” class=”hide”><form action=”” method=”post”><input type=”text” name=”name” value=”asd”></form></div></body>

<body> <div id =” adiv” class =“ hide”> <form action =”” method =” post”> <输入类型=”文本” name =“名称” value =” asd”> </ form> </ div> </ body>

You can try to close INPUT tag and open a new tag like SVG. If app doesn’t allow you to open a new tag with < char (remember it could be html encoded) then you try to exploit inside the input tag with: asd”onfocus=”alert(1)or asd”onmouseover=”alert(1)etc..

您可以尝试关闭INPUT标签并打开一个新标签，例如SVG。 如果应用不允许您使用<char打开新标签(请记住它可能是html编码的)，那么您尝试使用以下输入标签来利用： asd” onfocus =” alert(1)或asd” onmouseover =” alert (1)等

As a result, First learn some HTML, then JAVASCRIPT to be good at XSS.Hope this article helps you to understand how to find and exploit XSS a little.

因此，首先学习一些HTML，然后再学习JAVASCRIPT，以便熟练使用XSS。希望本文能帮助您稍微了解如何发现和利用XSS。

You may think how we can find those parameters? Google is your friend as always. Use google dork; site:youlook.for inurl:& or get all archived URLs with parameters via WaybackMachine, or look inside .js files.

您可能会认为我们如何找到这些参数？ Google一如既往是您的朋友。 使用Google Dork； site：youlook.for inurl：＆或通过WaybackMachine获取带有参数的所有存档URL，或在.js文件中查找。

@kenanistaken

@kenanistaken