Common JavaScript commands in penetration testing

Bsstructures are becoming increasingly popular, and browsers are widely used. JavaScript commands are executed in browsers. Some common js commands are used in testing:
 
1. The simplest alert (1) is used to pop up a window in a browser. 1 can be replaced with other data, strings, and so on.
 
2, document. cookie, get the cookie of the current domain of the browser, xss attacks are commonly used (for xss attacks, see the article: http://www.bkjia.com/Article/201209/153264.html ). You can try to enter this command in the developer tools of firefox and chrome on the console.
 
3, document. open: open a new blank document on the current page. Command: document. open ("text/html", "replace"), and then document. write ("hello world"); you can write something in the new page.
 
4. document. location. href: enter another page of the current domain. For example, run the js command document. location. href = "/? Cat = 4″, you can be redirected to the "Network Security" subdirectory of the tracing network.
 
5, window. open is used to open a specified link on a new page, such as running window in a browser. open ("http://www.bkjia.com") can open the tracing web in a new page.
 
6. Record keyboard actions, document. onkeypress = function () {window. status + = String. fromCharCode (window. event. keyCode);} this command is used to save the keyboard actions in the browser to the window. status. Run the command in the browser, enter the write character in the webpage, and then run the command: window. status. You can see that the keyboard action was saved in status. For example: