阻止Google Chrome修正格式错误的HTML脚本

时间:2016-04-12 15:16:27

标签: javascript html google-chrome xss

我正在测试网站的安全性,并尝试利用其XSS,我使用了<script>标记。但是,此网站对输入有字数限制,因此我的结束脚本标记未插入数据库中。现在,当我打开网页时,提交按钮不再出现,因为它位于截断的脚本标记内。由于Chrome的自动更正,该特定脚本标记会在提交按钮标记后关闭。有人能帮帮我吗?

自动更正后,页面的HTML代码如下所示。

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head>
  <title>Update Student Information</title>
  <meta http-equiv="content-type" content="text/html; charset=utf-8" />
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  <link rel="stylesheet" href="../login/css/style_reg.css" type="text/css" />
  <link rel="stylesheet" href="../login/js/jquery-smoothness-ui.css">
    <script src="../login/js/jquery-2.0.3.js"></script>
    <script src="../login/js/jquery-ui.js"></script>
    <script type="text/javascript">
    window.onload=function()
    {
        var c=document.getElementById("same_info");
        c.onchange=toggle_shipping_visibility;
    }
    function toggle_shipping_visibility()
    {
        var c=document.getElementById("same_info");
        var t=document.getElementById("shipping_table");
        t.style.display=(c.checked) ? 'none' : '';
    }
    </script>
    <script>
      $(function() {
      $( "#datepicker" ).datepicker();
    });
    </script>
</head>
<body>

    <div class="wrapper">

    <form class="form2" action="sem-reg.php" method="POST">

            <div class="formtitle">Update Student Information</div>
            <div class="note">
                &nbsp;&nbsp;&nbsp;&nbsp;&raquo;&raquo;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;All Fields are Compulsory
                            <h3 style="margin-left:20px;color:green;">Welcome ADARSH I can still edit it</h3>
            <h3 style="margin-left:20px;color:green;">1403097</h3>
            </div>
                        <div class="input">
                <div class="inputtext">University Roll:</div>
                <div class="inputcontent">
                                    <input type="text" name="univ" placeholder="University Roll No" value="1403097"readonly/>
                </div>
            </div>
                        <div class="input">
                <div class="inputtext">College Roll:</div>
                <div class="inputcontent">
                                    <input type="text" name="coll" placeholder="College Roll No" value="1006/14"readonly/>
                </div>
            </div>
                        <div class="input">
                <div class="inputtext">Name:</div>
                <div class="inputcontent">
                    <input type="text" name="name" placeholder="Name" value="ADARSH I can still edit it"readonly/>
                </div>
            </div>
                        <div class="input">
                <div class="inputtext">Father's Name:</div>
                <div class="inputcontent">
                    <input type="text" name="father" placeholder="Father's Name" value="PAWAN KUMAR" readonly/>
                </div>
            </div>
                        <div class="input">
                <div class="inputtext">Mother's Name:</div>
                <div class="inputcontent">
                    <input type="text" name="mother" placeholder="Mother's Name" value="SH. MT. BABLI DEVI"readonly/>
                </div>
            </div>
                        <div class="input">
                <div class="inputtext">Batch</div>
                <div class="inputcontent" readonly>

                     <select name="batch" >
                                         <option disabled="disabled" value="2011">2011</option>
                    <option value="2011">2011</option><option value="2012">2012</option><option value="2013">2013</option><option value="2014">2014</option><option value="2015">2015</option>                   </select>
                </div>
            </div>
            <div class="input">
                <div class="inputtext">Semester</div>
                <div class="inputcontent">

                     <select name="sem" >
                                         <option value="4">4</option>
                    <option value="1">1</option><option value="2">2</option><option value="3">3</option><option value="4">4</option><option value="5">5</option><option value="6">6</option><option value="7">7</option><option value="8">8</option>                     </select>
                </div>
            </div>
                        <div class="input">
                <div class="inputtext">Branch</div>
                <div class="inputcontent" >

                     <select name="bra">
                                         <option value="3">B.Tech - Computer Science Engineering</option>
                    <option value="1">B.Tech - Biotechnology Engineering</option><option value="2">B.Tech - Chemical Engineering</option><option value="3">B.Tech - Computer Science Engineering</option><option value="4">B.Tech - Electronics & Communications Engineering</option><option value="5">B.Tech - Information Technology</option><option value="6">B.Tech - Mechanical Engineering</option><option value="10">M.Tech Part Time Thermal Engineering</option><option value="11">M.Tech Part Time Computer Science Engineering</option><option value="12">M.Tech Part Time Electronics & Communications Engineering</option><option value="13">M.Tech Part Time Chemical Engineering</option><option value="14">M.Tech Part Time Production Engineering</option><option value="15">M.Sc Physics</option>                  </select>
                </div>
            </div>
            <div class="input">
                <div class="inputtext">Practical Group</div>
                <div class="inputcontent">

                     <select name="prac">
                                         <option value="2">B1</option>
                    <option value="1">None</option><option value="2">B1</option><option value="3">B2</option><option value="4">B3</option>                   </select>
                </div>
            </div>

                        <div class="input">
                <div class="inputtext">D.O.B</div>
                <div class="inputcontent">
                                      <input id="datepicker" type="text" name="dob" placeholder="D.O.B." value="24/04/1997"readonly/>
                </div>
            </div>
                        <div class="input">
                <div class="inputtext">Section</div>
                <div class="inputcontent">
                                    <select name="sec">
                                        <option value="1">A</option>
                                        <option value="0">None</option>
                                        <option value="1">A</option>
                                        <option value="2">B</option>
                                    </select>
                </div>
            </div>
                        <div class="input">
                <div class="inputtext">Category</div>
                <div class="inputcontent">
                                    <select name="cat" readonly>
                                         <option value="General">General</option>
                    <option value="General">General</option><option value="Scheduled Castes/ Scheduled Tribes">Scheduled Castes/ Scheduled Tribes</option><option value="Backward Classes">Backward Classes</option><option value="Border Areas">Border Areas</option><option value="Backward Areas">Backward Areas</option><option value="Sports Persons">Sports Persons</option><option value="Children/ Grand Children of Freedom Fighters/Political Sufferers">Children/ Grand Children of Freedom Fighters/Political Sufferers</option><option value="Disabled Persons">Disabled Persons</option><option value="Children/Widow Of Defence Personnel/ Ex-Servicemen etc">Children/Widow Of Defence Personnel/ Ex-Servicemen etc</option><option value="Children/ Widows Of Para-military forces/Punjab Police, PAP and Punjab Home Guards">Children/ Widows Of Para-military forces/Punjab Police, PAP and Punjab Home Guards</option><option value="Riot Affected/ Terrorist affected families">Riot Affected/ Terrorist affected families</option><option value="Tsunami victims">Tsunami victims</option>                     </select>
                </div>
            </div>

            <div class="input">
                <div class="inputtext">Phone No(Parents):</div>
                <div class="inputcontent">
                    <input type="text" name="phone_parent" placeholder="Phone no(Parents)" value="+919459578556"readonly/>
                </div>
            </div>
            <div class="input">
                <div class="inputtext">Phone No(Self): </div>
                <div class="inputcontent">
                    <input type="text" name="phone_self" placeholder="Phone No(Self)" value="+919814615325"readonly/>
                </div>
            </div>
            <div class="add">Permanent Address:</div>
            <div class="input" style="height:120px">
                <div class="inputtext">Address: </div>
                <div class="inputcontent">
                    <textarea class="textarea" name="address" placeholder="Address" ></textarea><script>alert(hahahahahahahahhaha you gonna pay for this bu</textarea>
                </div>
            </div>
            <div class="input">
                <div class="inputtext">City: </div>
                <div class="inputcontent">
                    <input type="text" name="city" placeholder="City" value="Dhar"readonly/>
                </div>
            </div>
            <div class="input">
                <div class="inputtext">State: </div>
                <div class="inputcontent">
                    <input type="text" name="state" placeholder="State" value="Himachal"readonly/>
                </div>
            </div>
            <input type="checkbox" name="same_info" id="same_info" checked="checked">Correspondence Address is same as Permanent Address<br>
            <table id="shipping_table" style="display:none">
            <tr class="inputtext">
                <td>Address</td>
            </tr>
            <tr>
            <td><textarea class="textarea" name="c_address"placeholder="Address"></textarea><script>alert(hahahahahahahahhaha you gonna pay for this bu</textarea></td>
            </tr>
            <tr class="inputtext">
                <td>City</td>
            </tr>
            <tr>
                <td class="inputcontent"><input type="text" name="c_city" placeholder="City" value="Dhar"></td>
            </tr>
            <tr class="inputtext">
                <td>State</td>
            </tr>
            <tr>
                <td class="inputcontent"><input type="text" name="c_state" placeholder="State" value="Himachal"></td>
            </tr>
            </table>
            <div class="buttons">
                <a href="stu-home.php">&laquo;&laquo; Go Back To Home Page</a>
                <input class="orangebutton" type="submit" name="submit" value="Update" />
            </div>
        </form>
        </div>  
    </body>
    </html>

1 个答案:

答案 0 :(得分:0)

使用Chrome,您可以右键单击最后一个可见元素或页面上的其他位置,选择Inspect,然后使用Chrome内置的开发人员工具编辑浏览器中加载的HTML。例如。删除/更改<script>标记。并查看该页面是否再次可用。

您还可以尝试最新版本的Firefox或MSIE,它们具有与上述非常相似的功能。