2021-03-11 19:51:05 +01:00
|
|
|
<html>
|
|
|
|
|
<head>
|
|
|
|
|
<link
|
|
|
|
|
href="https://fonts.googleapis.com/css?family=Montserrat&display=swap"
|
|
|
|
|
rel="stylesheet"
|
|
|
|
|
/>
|
|
|
|
|
<style>
|
|
|
|
|
.malware {
|
|
|
|
|
position: fixed;
|
|
|
|
|
bottom:0;
|
|
|
|
|
left:0;
|
|
|
|
|
right:0;
|
|
|
|
|
height: 150px;
|
|
|
|
|
background: red;
|
|
|
|
|
color: black;
|
|
|
|
|
display: flex;
|
|
|
|
|
display: flex;
|
|
|
|
|
justify-content: center;
|
|
|
|
|
align-items: center;
|
|
|
|
|
font-family: monospace;
|
|
|
|
|
font-size: 72px;
|
|
|
|
|
}
|
|
|
|
|
</style>
|
|
|
|
|
<script>
|
|
|
|
|
function xssAttack(){
|
|
|
|
|
const div = document.createElement('div')
|
|
|
|
|
div.id = 'the-malware'
|
|
|
|
|
div.className = 'malware'
|
|
|
|
|
div.innerHTML = 'XSS Succeeded'
|
|
|
|
|
document.getElementsByTagName('body')[0].appendChild(div);
|
|
|
|
|
throw new Error('XSS Succeded');
|
|
|
|
|
}
|
|
|
|
|
</script>
|
|
|
|
|
</head>
|
|
|
|
|
<body>
|
|
|
|
|
<div class="mermaid">
|
2021-03-11 20:57:45 +01:00
|
|
|
%%{init: { 'theme':'base', '__proto__': {'polluted': 'asdf'}} }%%
|
2021-03-11 19:51:05 +01:00
|
|
|
graph LR
|
|
|
|
|
A --> B
|
|
|
|
|
</div>
|
2021-08-03 20:10:15 +02:00
|
|
|
<div class="mermaid">
|
|
|
|
|
%%{init: { 'theme':'base', '__proto__': {'polluted': 'asdf'}} }%%
|
|
|
|
|
%%{init: { 'theme':'base', '__proto__': {'polluted': 'asdf'}} }%%
|
|
|
|
|
graph LR
|
|
|
|
|
A --> B
|
|
|
|
|
</div>
|
2021-08-05 00:40:21 +02:00
|
|
|
<div class="mermaid">
|
|
|
|
|
%%{init: { 'prototype': {'__proto__': {'polluted': 'test'}}} }%%
|
|
|
|
|
%%{init: { 'prototype': {'__proto__': {'polluted': 'test'}}} }%%
|
|
|
|
|
sequenceDiagram
|
|
|
|
|
Alice->>Bob: Hi Bob
|
|
|
|
|
Bob->>Alice: Hi Alice
|
|
|
|
|
</div>
|
2021-03-11 19:51:05 +01:00
|
|
|
<script src="./mermaid.js"></script>
|
|
|
|
|
<script>
|
|
|
|
|
mermaid.initialize({
|
|
|
|
|
startOnLoad: true,
|
|
|
|
|
useMaxWidth: true,
|
|
|
|
|
});
|
|
|
|
|
var cnt = 0;
|
|
|
|
|
var a;
|
|
|
|
|
var handler = setInterval(() => {
|
|
|
|
|
cnt++;
|
|
|
|
|
a = {};
|
|
|
|
|
if(typeof a.polluted !== 'undefined') {
|
|
|
|
|
clearInterval(handler);
|
2021-03-11 20:57:45 +01:00
|
|
|
xssAttack();
|
2021-03-11 19:51:05 +01:00
|
|
|
}
|
|
|
|
|
if(cnt>20) {
|
|
|
|
|
clearInterval(handler);
|
|
|
|
|
}
|
|
|
|
|
}, 100);
|
|
|
|
|
</script>
|
|
|
|
|
</body>
|
|
|
|
|
</html>
|
