> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/dom/dom-based-cookie-manipulation.md).
# 基于 DOM 的 Cookie 操作
### 基于 DOM 的 Cookie 操作
这个实验演示了对 Cookie 的客户端（DOM）操作，使得可以向其中注入一个值 `lastViewedProduct` cookie。更改此值可能会在另一个页面上导致内容执行（XSS），并调用 `print()` 函数。利用方式是通过利用服务器将受害者引导到所需页面。
* 有一个名为 `lastViewedProduct` 的会话 cookie，其中包含最近查看的商品链接。
* 页面上有一个“最近查看的商品”部分，其中有一个类似于以下内容的链接： `<a href=".../product?productId=1">最近查看的商品</a>`.
* 通过更改存储为“last page view”的值，显示的链接可以被解释为 HTML/JS。
* 通过将 cookie 值替换为外部 URL（`https://jord4n.pro`）该链接会重定向到该网站。
插入 `JavaScript:print()` 在该值中会在此上下文中被浏览器解释。
* 通过注入包含 HTML 的有效载荷，例如 `productId=1&'>
TEST
`，内容就会被渲染。
{% code overflow="wrap" %}
```html
最近查看的商品
```
{% endcode %}
类似以下的脚本有效载荷 `productId=1&'>` 也会被解释并触发 `print()`.
```
productId=1&'>
```
1. 将受害者的 `lastViewedProduct` cookie 中存入一个包含注入内容的值（商品页面用于保存该值）。
2. 然后将受害者重定向到主页（或显示“最近查看的商品”的页面），这样就会返回这个格式不正确的值并执行脚本（`print()`).
3. 使用利用服务器协调重定向到商品页面（该页面会写入 cookie），然后再到显示 cookie 的页面。
{% code overflow="wrap" %}
```javascript
```
{% endcode %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/dom/dom-based-cookie-manipulation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.