> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xss/dom-xss-with-jquery-hashchange-event.md).
# 使用 jQuery 和 hashchange 的 DOM XSS
使用 jQuery 和 hashchange 的 DOM XSS 笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### 使用 jQuery 选择器接收点中的 DOM XSS，借助 hashchange 事件
该实验在主页上包含一个客户端 XSS 漏洞。代码使用了 `$()` jQuery 的选择器函数来自动定位一篇标题通过以下方式传递的文章 `location.hash`。实验的目标是获取一个利用载荷，当访客打开它时，会在 `print()` 其浏览器中调用。
{% code overflow="wrap" %}
```javascript
$(window).on('hashchange', function(){
var post = $('section.blog-list h2:contains(' + decodeURIComponent(window.location.hash.slice(1)) + ')');
if (post) post.get(0).scrollIntoView();
});
```
{% endcode %}
* 该函数获取 URL 片段（`window.location.hash`），移除 `#` 替换为 `slice(1)` 并使用以下方法对其进行解码 `decodeURIComponent`.
* 然后，该文本直接拼接到 jQuery `:contains(...)` 选择器中。由于没有转义，特制内容可以破坏语法，并通过如下向量注入 HTML/JS： `onerror` 属性。
* 代码仅在哈希发生变化时触发该操作（`hashchange`），因此，一个不带哈希的普通初始链接不会触发任何内容，直到客户端更改片段为止。
* 我们利用了以下事实：对 `#` 会触发该事件。因此，利用载荷必须强制受害者的浏览器加载一个包含有效载荷片段的 URL。
* 一种常见的方法是使用 `
```
{% endcode %}
* 最终利用载荷： `print()` （改编版本）：
{% code overflow="wrap" %}
```javascript
```
{% endcode %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/xss/dom-xss-with-jquery-hashchange-event.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
