9. xss bypass formaction bypass

---

layout: post
title: 9. xss bypass
category: SRC
tags: SRC
keywords: SRC,XSS

Preface

This record is the ninth short article that records the actual src process, and the content is the xssbypass of a certain website.

XSS features

1. href will be converted to href_
2. The on* attributes are basically waf, including the onPointerOver and Onwheel mentioned earlier are also added to the rules
3. src=* is directly blocked.

xss bypasses the payload

At this time, I thought of using the form action of the form tag to execute js,
so there is<form><button/formaction=javascript:alert(21)>Test

Afterword

xxxxxx