> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/websockets/websocket-message-manipulation.md).

# WebSocket 消息操纵

### 操纵 WebSocket 消息以利用漏洞

这个在线商店有一个实时 **聊天功能** 使用……实现 **WebSockets**。 / 用户发送的消息会立即显示在一位 **客服人员**。 / 该实验的目标是 **启动一个 `alert()`** 通过操纵一条 WebSocket 消息，在客服人员的浏览器中弹出一个弹窗。

应用中提供了一个聊天输入框。

<figure><img src="/files/001388326c7b858e82d92e41a222e769ab8c69d3" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/49fdd696fe52a01b177e14a21503b4f184739dc6" alt=""><figcaption></figcaption></figure>

通过检查流量，可以发现消息通过 WebSocket 按如下方式发送：

```json
{
    "user":"你",
    "content":"嗨"
}
```

**过滤测试**

尝试通过聊天发送以下载荷：

```javascript
<script>alert(0)</script>
```

观察到的结果：/ 内容在\*\*服务器端被转义\*\*并被解释为文本：

```javascript
&lt;script&gt;alert(0)&lt;/script&gt;
```

<figure><img src="/files/fc24b6ffa7e415b87a1b74d215ced31e87388876" alt=""><figcaption></figcaption></figure>

这表明存在针对以下内容的基本过滤： `<script>` 标签。

**绕过过滤**

随后手动发送一条包含以下载荷的 WebSocket 消息：

```http
<img src=0 onerror=alert(0)>
```

该消息被 **直接转发** 通过 WebSocket 请求，而无需经过常规的界面控制。

<figure><img src="/files/71721897d57f85bbd7fc801ba5bedac226ca2b5e" alt=""><figcaption></figcaption></figure>

当客服人员收到该消息时，浏览器会解析 `onerror` 该属性，从而触发：

* 执行 `alert(0)`
* 出现一个 **弹出窗口** 在客服人员的浏览器中

<figure><img src="/files/f2a9d7a751a0d845e4655bc9889ca7ae305700ae" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/websockets/websocket-message-manipulation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.