Creating HTML with intentional HTML Injection

问题

I am a cybersecurity student trying to understand some basic HTML injections. I have been working on this code for a few days and can't understand what I am doing wrong. The code that I have currently does allow for injection, for example if I put <h1>test</h1> into the textbox, it will display test as a header. But if I try <script>alert(1)</script> it won't actually run the script. I have tried setting the value of the text box to "" or with the thought that I could close out that line by inputting the following into the textbox: "><script>alert(1)</script>

I've also tried to cancel out the remainder of the code by adding a comment to the end like this: <script>alert(1)</script><!--

I've tried a number of combinations of each with no luck. Now I actually need to be able to inject a script since I'm playing around with CSP and how that affects injection of scripts into the webpage. I currently DO NOT have a csp specified that would restrict the JavaScript from running. Some other things I've tried include using different browsers, changing browser security, and ensuring that JavaScript is enabled in the browser. Any help would be greatly appreciated!!

<html>
    <script language='JavaScript'>
    function getwords(){
        textbox = document.getElementById('words');
        label = document.getElementById('label');
        label.innerHTML = textbox.value;
    }
    </script>

    <body>
        <input type="text" id="words">
        <input type="button" onclick="getwords()" id="Button" value="Enter" />
        <label id="label">
        </label>
    </body>
</html>

回答1:

That's because <script>s run at page load, and, when the label's content change, the scripts have ran already.

However, if you inject <script> tags to a different page (through the backend (XSS means Cross-Site Scripting)), it does work.

Alternatively, to make it work in a scenario, where the content injected after page load (like your case), you can use JS events (like onclick) to run your code:

<div onclick="alert(1)">Click me!</div>

Or, to execute it without user interaction, you could use an <iframe>'s onload event:

<iframe onload="alert(1)" style="display:none"></iframe>

回答2:

to execute javascript from your form, you can try:

<iframe src=javascript:alert(1)>

<img src=x onerror=alert(1)>

Also worth noting:

script elements inserted using innerHTML do not execute when they are inserted.

回答3:

To manually execute JavaScript, you may do the following

without editing your HTML file, add this to the Input field on your Browser.

<iframe onload="alert(1)" style="display:none"></iframe>

More information on why this works here

More on how you can perform actions like this here: developer.mozilla.org

<html>
    <script language='JavaScript'>
    function getwords(){
        textbox = document.getElementById('words');
        label = document.getElementById('label');
        label.innerHTML = textbox.value;
    }
    </script>

    <body>
        <input type="text" id="words">
        <input type="button" onclick="getwords()" id="Button" value="Enter" />
        <label id="label">
        </label>
    </body>
</html>

来源：https://stackoverflow.com/questions/58169889/creating-html-with-intentional-html-injection

标签

javascript

html

xss

code-injection