> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/dom/xss-dom-via-web-messages.md). # 通过 Web 消息的 XSS DOM 通过 Web 消息的 XSS DOM 笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。 ### 使用 Web 消息的 DOM XSS 利用基于 Web 消息的 XSS 型 DOM 漏洞（`postMessage`）以导致 `print()` 该函数通过经由攻击服务器发送加载请求在目标页面上被调用。 #### 观察到的行为（源代码）页面监听已发送的消息，并将接收到的内容直接注入到 `#ads` 元素中，未经清理：

<script>
   window.addEventListener('message', function(e) {
   document.getElementById('ads').innerHTML = e.data;
   })
</script>

这意味着任何 `e.data` 接收到的内容都将作为 HTML 渲染到 `#ads`，如果攻击者能够发送受控消息，就会为 XSS DOM 打开大门。

#### 交互式测试（控制台）来自父页面控制台 / d 的消息示例 * 简单文本消息 ```javascript window.parent.postMessage('This is a test'); ```

* HTML 注入 ```javascript window.parent.postMessage('

hello

'); ```

* alert 测试（XSS） ```jsx window.parent.postMessage("

"); ```

* 触发 `print()` （实验镜头） ```javascript window.parent.postMessage("

"); ```

#### 利用服务器上的 iframe 攻击你服务器上托管的 HTML 示例：它将目标页面加载到一个 iframe 中，然后在 iframe 加载时发送有效载荷： ```mathml ```

要触发 `print()` 在目标页面上，请发送包含以下内容的有效载荷： `img` 元素，带有 `onerror=print()`: ```html ```

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/web/dom/xss-dom-via-web-messages.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.