1. DOM-based internal XSS

Zero Customer Network SecurityXiao xiaoshuai! Bytes ﹊

Only for learning. Understand, there are no hackers here... It does not mean.

Internal Domain Name:
Http://share.xiaonei.com
There is a function that checks the value of the shared website title.
It does not determine whether there is any security risk in it, hence XSS

Function sharelink1 (){
Var _ 76 = document. getElementById ("sharelink"). weblink. value; // click here.
Var _ 77 =/s/ig;
_ 76 = _ 76. replace (_ 77 ,"");
If (_ 76 = "") | (_ 76 = "http: //") | (_ 76 = "Hangzhou ")){
Alert ("u8bf7u8f93u5165u4e00u4e2au7f51u5740 ");
Return false;
}