> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xss/reflected-dom-xss.md).
# XSS DOM 反射型
XSS DOM 反射型笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### 反射型 DOM XSS
此实验展示了一个经过巧妙设计的 DOM 漏洞。查询中发送的数据会被服务器返回，然后客户端脚本以危险的方式处理它们，并将其写入一个 `eval`，从而为代码执行打开大门。
客户端向以下内容发出 AJAX 请求： `path + window.location.search`。当响应返回时，代码如下：
```javascript
function search(path) {
var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
eval('var searchResultsObj = ' + this.responseText);
displaySearchResults(searchResultsObj);
}
};
xhr.open("GET", path + window.location.search);
xhr.send();
function displaySearchResults(searchResultsObj) {
var blogHeader = document.getElementsByClassName("blog-header")[0];
var blogList = document.getElementsByClassName("blog-list")[0];
var searchTerm = searchResultsObj.searchTerm
var searchResults = searchResultsObj.results
var h1 = document.createElement("h1");
h1.innerText = searchResults.length + " 条关于 '" + searchTerm + "' 的搜索结果";
blogHeader.appendChild(h1);
var hr = document.createElement("hr");
blogHeader.appendChild(hr)
for (var i = 0; i < searchResults.length; ++i)
{
var searchResult = searchResults[i];
if (searchResult.id) {
var blogLink = document.createElement("a");
blogLink.setAttribute("href", "/post?postId=" + searchResult.id);
if (searchResult.headerImage) {
var headerImage = document.createElement("img");
headerImage.setAttribute("src", "/image/" + searchResult.headerImage);
blogLink.appendChild(headerImage);
}
blogList.appendChild(blogLink);
}
blogList.innerHTML += " ";
if (searchResult.title) {
var title = document.createElement("h2");
title.innerText = searchResult.title;
blogList.appendChild(title);
}
if (searchResult.summary) {
var summary = document.createElement("p");
summary.innerText = searchResult.summary;
blogList.appendChild(summary);
}
if (searchResult.id) {
var viewPostButton = document.createElement("a");
viewPostButton.setAttribute("class", "button is-small");
viewPostButton.setAttribute("href", "/post?postId=" + searchResult.id);
viewPostButton.innerText = "查看帖子";
}
}
var linkback = document.createElement("div");
linkback.setAttribute("class", "is-linkback");
var backToBlog = document.createElement("a");
backToBlog.setAttribute("href", "/");
backToBlog.innerText = "返回博客";
linkback.appendChild(backToBlog);
blogList.appendChild(linkback);
}
}
```
该 `displaySearchResults` 函数运行时 `searchResultsObj` 并通过赋值动态创建元素（h1、h2、p、a、img 等）， `innerText` 用于标题和摘要，但重要的是 `searchResultsObj` 通过 `eval`.
```javascript
if (this.readyState == 4 && this.status == 200) {
eval('var searchResultsObj = ' + this.responseText);
displaySearchResults(searchResultsObj);
}
```
使用 `eval('var searchResultsObj = ' + this.responseText)` 至关重要：如果受控响应包含特制文本，就有可能破坏预期语法，并注入在求值期间执行的 JavaScript 代码。
* 将其返回（或拦截） `responseText` 其中包含针对以下内容的攻击值： `searchTerm` 或类似字段。
* 通过关闭结构并添加可执行代码，从字符串/字面量 JSON 的预期中脱离出来，然后用注释（`//`）来中和其余部分，以避免后续语法错误。
#### 已测试载荷示例
（这些字符串旨在放入反射响应的相应部分——它们展示了如何脱离结构并运行 `alert(0)`)
```javascript
hello/"jordan
hello/"jordan}//
```
通过将上述字符串之一注入响应的反射部分， `eval` 将会解释修改后的构造并运行 `alert(0)`，从而演示通过反射型 DOM XSS 实现的客户端代码执行。
```javascript
hello/"*alert(0)}//
```
```javascript
hello/"+alert(0)}//
```
```javascript
hello/"-alert(0)}//
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/xss/reflected-dom-xss.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
