3

【prompt(1) to win】 Level 3 - HTML Comment

 2 years ago
source link: https://exp-blog.com/safe/ctf/prompt/level-3-html-comment/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

【prompt(1) to win】 Level 3

javascript
function escape(input) {
    // filter potential comment end delimiters
    input = input.replace(/->/g, '_');

    // comment the input to avoid script execution
    return '<!-- ' + input + ' -->';
}

正则把 -> 过略了，导致我们无法闭合注释。

但是 HTML 注释还有另一种闭合方式：<!-- xxxxx --!>

因此构造这样的 payload 即可实现绕过：--!><script>prompt(1)</script>

01.png

report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK