XSS编码绕过讲解

形成原因：
有些字符和关键词冲突，比如<>，解码之后，浏览器会误认为它们是标签

解决方法：
实体化编码
**

HTML解析

三种方法可以容纳字符实体——>**这里重要的是在这三种模式下，**可以进行HTML实体自动“解码”！！！
**

数据状态中的字符引用

属性值状态中的字符引用

类似于src，herf这样的属性值被编码，会自动进行Html解码
**

RCDATA状态中的字符引用

作用：可以容纳文本和字符引用
RCDATA元素(RCDATA elements)，有和<title></p> <p><strong>HTML有五类元素：</strong><br /><strong>空元素</strong>(Void elements)：如<area>,<br>,<base>等等<br /> <strong>原始文本元素</strong>(Raw text elements)：有<script>和<style><br /> <strong> RCDATA元素</strong>(RCDATA elements)：有<textarea>和<title><br /> <strong> 外部元素</strong>(Foreign elements)：例如MathML命名空间或者SVG命名空间的元素<br /> <strong> 基本元素</strong>(Normal elements)：即除了以上4种元素以外的元素 </p> <p><strong>作用如下：</strong><br /><strong>空元素：</strong>不能容纳任何内容（因为它们没有闭合标签，没有内容能够放在开始标签和闭合标签中间）<br /> <strong> 原始文本元素：</strong>可以容纳文本<br /> <strong> RCDATA元素：</strong>可以容纳文本和字符引用<br /> <strong> 外部元素：</strong>可以容纳文本、字符引用、CDATA段、其他元素和注释<br /> <strong> 基本元素：</strong>可以容纳文本、字符引用、其他元素和注释<br /><strong><br /></strong>注意事项：<strong><br /></strong>HTML不区分大小写！！！**</p> <p><a name="woXhl"></a></p> <h2 id="4n5me"><a name="4n5me" class="reference-link"></a><span class="header-link octicon octicon-link"></span>URL解析</h2><p><strong>**<br /></strong>服务端收到请求时，会自动对请求进行一次URL解码<strong><br /></strong>不能对协议类型进行任何的编码操作<strong>，</strong>不然URL解析器会认为它无类型<strong><br /> </strong>：也不能被任何方式编码<strong><br /></strong><br /><strong>实例：</strong><br /> <a href="%6a%61%76%61%73%63%72%69%70%74:%61%6c%65%72%74%28%31%29"></a><br /> 协议被编码，不知类型，没用<br /> <br /> <a href="javascript:%61%6c%65%72%74%28%31%29"></a><br /> 可以解析</p> <p><a name="trhzM"></a></p> <h2 id="5pxihk"><a name="5pxihk" class="reference-link"></a><span class="header-link octicon octicon-link"></span>JS解析</h2><p><strong>知识：</strong><br />当HTML解析产生DOM节点后，会根据DOM节点来做接下来的解析工作，比如在处理诸如<script> <style>这样的标签，解析器会自动切换到JS解析模式</p> <p>而src、 href后边加入的javascript 伪URL，也会进入JS 的解析模式</p> <p>js解析的字符不一定全部都会当成js代码解析，需要分情况，转义序列放在3个部分：<strong>字符串中，标识符名称中和控制字符中</strong><br /><strong><br /></strong>如果编码：字符串和控制字符会被转义为文本！！！**<br /> <br /> 不会执行，因为单引号被JS编码，转义为文本<br /> <br />但是对于在标识符名称中时，它会被解码并解释为标识符名称的一部分，例如函数名，属性名等等，比如将alert关键字编码后，当解码之后他会成为js执行代码的一部分，是可以执行的<br /> <br />可以执行，字符串和控制字符都没有被编码</p> <p><a name="9io0Q"></a></p> <h2 id="baeofy"><a name="baeofy" class="reference-link"></a><span class="header-link octicon octicon-link"></span>代码解析顺序</h2><p><strong>HTML解析总是第一步解析，然后再判断URL和JS解码</strong><br /><strong><br /></strong>href中—->先URL解码href属性值，然后判断是否有js代码，在进行JS解码<strong><br /></strong><br /><strong>事件函数中—->先JS解码，然后URL解码</strong></p> <p><strong>不管怎么样，都是先HTML解码，最后都会有URL解码(因为输出在网页中)</strong><br />**<br /><a href="UserInput"></a><br /> 该例子中，首先由HTML解析器对UserInput部分进行字符实体解码<br /> 接着URL解析器对UserInput进行URL decode<br /> 如果URL的Scheme部分为javascript的话，JavaScript解析器会再对UserInput进行解码<br /> 所以解析顺序是：HTML解析->URL解析->JavaScript解析</p> <p><a href=# onclick="window.open('UserInput')"></a><br /> 该例子中，首先由HTML解析器对UserInput部分进行字符实体解码<br /> 接着由JavaScript解析器会再对onclick部分的JS进行解析并执行JS<br /> 执行JS后window.open(‘UserInput’)函数的参数会传入URL，所以再由URL解析器对UserInput部分进行解码<br /> 因此解析顺序为：HTML解析->JavaScript解析->URL解析</p> <p><a href="javascript:window.open('UserInput')"><br /> 该例子中，首先还是由HTML解析器对UserInput部分进行字符实体解码<br /> 接着由URL解析器解析href的属性值<br /> 然后由于Scheme为javascript，所以由JavaScript解析<br /> 解析执行JS后window.open(‘UserInput’)函数传入URL，所以再由URL解析器解析<br /> 所以解析顺序为：HTML解析->URL解析->JavaScript解析->URL解析</p> <p><a href="%26%23x6a%3B%26%23x61%3B%26%23x76%3B%26%23x61%3B%26%23x73%3B%26%23x63%3B%26%23x72%3B%26%23x69%3B%26%23x70%3B%0A%26%23x74%3B%26%23x3a%3B%26%23x25%3B%26%23x35%3B%26%23x63%3B%26%23x25%3B%26%23x37%3B%26%23x35%3B%26%23x25%3B%26%23x33%3B%0A%26%23x30%3B%26%23x25%3B%26%23x33%3B%26%23x30%3B%26%23x25%3B%26%23x33%3B%26%23x36%3B%26%23x25%3B%26%23x33%3B%26%23x31%3B%0A%26%23x25%3B%26%23x35%3B%26%23x63%3B%26%23x25%3B%26%23x37%3B%26%23x35%3B%26%23x25%3B%26%23x33%3B%26%23x30%3B%26%23x25%3B%0A%26%23x33%3B%26%23x30%3B%26%23x25%3B%26%23x33%3B%26%23x36%3B%26%23x25%3B%26%23x36%3B%26%23x33%3B%26%23x25%3B%26%23x35%3B%0A%26%23x63%3B%26%23x25%3B%26%23x37%3B%26%23x35%3B%26%23x25%3B%26%23x33%3B%26%23x30%3B%26%23x25%3B%26%23x33%3B%26%23x30%3B%0A%26%23x25%3B%26%23x33%3B%26%23x36%3B%26%23x25%3B%26%23x33%3B%26%23x35%3B%26%23x25%3B%26%23x35%3B%26%23x63%3B%26%23x25%3B%0A%26%23x37%3B%26%23x35%3B%26%23x25%3B%26%23x33%3B%26%23x30%3B%26%23x25%3B%26%23x33%3B%26%23x30%3B%26%23x25%3B%26%23x33%3B%0A%26%23x37%3B%26%23x25%3B%26%23x33%3B%26%23x32%3B%26%23x25%3B%26%23x35%3B%26%23x63%3B%26%23x25%3B%26%23x37%3B%26%23x35%3B%0A%26%23x25%3B%26%23x33%3B%26%23x30%3B%26%23x25%3B%26%23x33%3B%26%23x30%3B%26%23x25%3B%26%23x33%3B%26%23x37%3B%26%23x25%3B%0A%26%23x33%3B%26%23x34%3B%26%23x28%3B%26%23x31%3B%26%23x35%3B%26%23x29%3B">click</a></p> <p><strong>最后的形式是以URL形式的，因为实体化中有#，#中**</strong>在URL<strong>**是注释的意思，传不过去</strong></p> <p><strong>解码顺序：URL->HTML->URL->JS</strong></p> <p><strong>编码顺序：JS->URL->HTML->URL（与解码顺序相反）</strong><br /><strong><img src="https://cdn.nlark.com/yuque/0/2020/png/1781646/1600867253426-28a75512-bf3b-4990-87dc-8dd5aacd41e0.png#align=left&display=inline&height=358&margin=%5Bobject%20Object%5D&name=image.png&originHeight=594&originWidth=830&size=85839&status=done&style=none&width=500" alt="image.png"></strong></p> <p>因为<strong>在属性中</strong>，所以先HTML解码，结果如下<br /><img src="https://cdn.nlark.com/yuque/0/2020/png/1781646/1600861308741-31b3d074-0aa3-4a50-b9e8-c75763438c2d.png#align=left&display=inline&height=238&margin=%5Bobject%20Object%5D&name=image.png&originHeight=274&originWidth=634&size=17895&status=done&style=none&width=550" alt="image.png"></p> <p>然后因为<strong>在href**</strong>中<strong>，所以进行URL编码<br /></strong><img src="https://cdn.nlark.com/yuque/0/2020/png/1781646/1600861382259-13cbf787-1870-4315-b809-d84c4973384a.png#align=left&display=inline&height=226&margin=%5Bobject%20Object%5D&name=image.png&originHeight=451&originWidth=1096&size=27233&status=done&style=none&width=550" alt="image.png"><strong><br /></strong><br />最后因为<strong>Schema为Javascript</strong>，进行JS解码<br /><img src="https://cdn.nlark.com/yuque/0/2020/png/1781646/1600861439211-e136963c-7eee-41fa-a94d-6661e0525c8d.png#align=left&display=inline&height=270&margin=%5Bobject%20Object%5D&name=image.png&originHeight=403&originWidth=821&size=19886&status=done&style=none&width=550" alt="image.png"></p> <p><strong>最终结果就是：**</strong><a href="javascript:alert(15)"> <strong><br /></strong><img src="https://cdn.nlark.com/yuque/0/2020/png/1781646/1600868174135-616fe98e-93dd-4f67-ad99-4ba6a1af4693.png#align=left&display=inline&height=147&margin=%5Bobject%20Object%5D&name=image.png&originHeight=244&originWidth=914&size=20069&status=done&style=none&width=550" alt="image.png"><strong><br /></strong><img src="https://cdn.nlark.com/yuque/0/2020/png/1781646/1600868179930-c5bcc7c8-ca2c-4673-9503-f327f01a908b.png#align=left&display=inline&height=144&margin=%5Bobject%20Object%5D&name=image.png&originHeight=241&originWidth=918&size=18881&status=done&style=none&width=550" alt="image.png">**</p>