Skip to content

Instantly share code, notes, and snippets.

@Kuri-su

Kuri-su/XSS

Last active December 13, 2017 08:29
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Kuri-su/78ecad07f625b69f25356842b406d438 to your computer and use it in GitHub Desktop.
Save Kuri-su/78ecad07f625b69f25356842b406d438 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
XSS
![](x"/**/onerror="alert('xss!!!')")
github是采用存入的时候,对特殊符号进行转义,从而无效掉
e.g.
<p><a href="/Kuri-su/Some-classic-algorithms/blob/master/x%22/**/onerror=%22alert('xss!!!')%22" target="_blank"><img src="/Kuri-su/Some-classic-algorithms/raw/master/x%22/**/onerror=%22alert('xss!!!')%22" alt="sdsdssdsd" style="max-width:100%;"></a></p>
也可以采用markdown转成html后去掉全部的onxxxxxx的方法,例如onload,onerror
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment