> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/dom/xss-dom-via-web-messages.md). # 通过 Web 消息的 DOM XSS ### 使用 Web 消息的 DOM XSS 利用基于 Web 消息的 XSS 型 DOM 漏洞（`postMessage`) 以导致 `print()` 通过向操作服务器发送一次加载，使目标页面上的函数被调用。 #### 观察到的行为（源代码）该页面监听已发布的消息，并将接收到的内容直接注入到 `#ads` 元素中，未经净化：

<script>
   window.addEventListener('message', function(e) {
   document.getElementById('ads').innerHTML = e.data;
   })
</script>

这意味着任何 `e.data` 接收到的内容将作为 HTML 在 `#ads`，如果攻击者能够发送一条可控消息，就会为 DOM XSS 打开大门。

#### 交互式测试（控制台）从父页面控制台 / d 发送的消息示例 * 简单文本消息 ```javascript window.parent.postMessage('这是一个测试'); ```

* HTML 注入 ```javascript window.parent.postMessage('

你好

'); ```

* 警报测试（XSS） ```jsx window.parent.postMessage("

"); ```

* 导致 `print()` （实验室镜头） ```javascript window.parent.postMessage("

"); ```

#### 攻击服务器上的 iframe 利用你服务器上托管的 HTML 示例，它会将目标页面加载到一个 iframe 中，然后在 iframe 加载时发送载荷： ```mathml ```

要触发 `print()` 在目标页面上，请发送包含以下内容的载荷 `img` 元素，使用 `onerror=print()`: ```html ```

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/zh/web/dom/xss-dom-via-web-messages.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.