网络安全 DVWA通关指南 DVWA DOM Based Cross Site Scripting (DOM型 XSS)

<?php

# No protections, anything goes

?>
//没有任何防御措施

<script>alert(/XSS/)</script>

<?php

// Is there any input?
if ( array_key_exists( "default", $_GET ) && !is_null ($_GET[ 'default' ]) ) {
	$default = $_GET['default'];
	
	# Do not allow script tags
	if (stripos ($default, "<script") !== false) {
		header ("location: ?default=English");
		exit;
	}
}

?>

</optin></select><img src = 1 onerror = alert(/xss/)>

<?php

// Is there any input?
if ( array_key_exists( "default", $_GET ) && !is_null ($_GET[ 'default' ]) ) {

	# White list the allowable languages
	switch ($_GET['default']) {
		case "French":
		case "English":
		case "German":
		case "Spanish":
			# ok
			break;
		default:
			header ("location: ?default=English");
			exit;
	}
}

?>

(空格)#<script>alert(/xss/)</script>

<?php

# Don't need to do anything, protction handled on the client side

?>
# 大多数情况下浏览器都会对 URL 中的内容进行编码，这会阻止任何注入的 JavaScript 被执行。