导入
跨站脚本攻击（XSS）
学习非持久型和持久型跨站脚本攻击的区别，以及如何防范这类攻击。
Educative JavaScript requests
No configuration found for ID: 1935c2e6aaebb380ae59e776a27e154db303e732b3bafb4b98e0c1ef6ea138b9
已转义的字符串
1"foo\"bar"
编码后的 JavaScript
1$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"(\\\"\\"+$.__$+$.__$+$.___+$.$$$_+(![]+"")[$._$_]+(![]+"")[$._$_]+$._$+"\\"+$.$__+$.___+$.$$$$+"\\"+$.__$+$.$$_+$._$_+$._$+"\\"+$.__$+$.$_$+$.$_$+"\\"+$.$__+$.___+"\\"+$.__$+$.___+$.$_$+$.$$_$+$._+$.$$__+$.$_$_+$.__+"\\"+$.__$+$.$_$+$.__$+"\\"+$.__$+$.$$_+$.$$_+$.$$$_+"!\\\"\\"+$.$__+$.___+")"+"\"")())();
No configuration found for ID: 7982255631dda2d68573f3194858048100cddbc2eb1215beb01c1bf11550e9c5
No configuration found for ID: 51568aabf6913c4c52d26ddbf301d618c73381e955c7179c46a70a7ab33226ae
1<meta 2 http-equiv="Content-Security-Policy" 3 content="default-src 'self'; img-src https://*; child-src 'none';" 4/>
...
XSS blocked with CSP
1<script>myAwesomeCode();</script>
1echo -n 'myAwesomeCode();' | openssl sha256 -binary | openssl base64
1<meta 2 http-equiv="Content-Security-Policy" 3 content="script-src 'sha256-eJS3AJRl6g8NMVpSesO4Ljn4ex9eK5ewVNW88NgjyUk=';" />
1Set-Cookie: id=a3fWa; Expires=Sat, 25 Dec 2022 07:28:00 GMT; Secure; HttpOnly