首先进入XSS Game - Learning XSS Made Simple! | Created by PwnFunction打开环境
Ma Spaghet
在script里面给使用get传参给somdbody传一个值,若没有传值,默认传Somebody+Toucha Ma Spaghet!,赋值给spaghet,放在h2标签中,spaghet后会有一个innerHTMl的属性
script标签内有插入,但无法执行,切换img尝试
jeff关卡
<!-- Challenge -->
<h2 id="maname"></h2>
<script>
let jeff = (new URL(location).searchParams.get('jeff') || "JEFFF")
let ma = ""
eval(`ma = "Ma name ${jeff}"`)
setTimeout(_ => {
maname.innerText = ma
}, 1000)
</script>
第一关一样
先get传参获取'jeff'的值,如果没有参数就默认为JEFFF
js获取到页面的jeff参数,并通过eval赋值给ma,再将ma复制到maname的text
Ugandan Knuckles
不能使用https://sandbox.pwnfunction.com/?html=&js=&css=
.;
直接通过双引号闭合placeholder的参数