???????????????????????
????????????????????ONLINE???????????????????????????????????????????????????????????Щ???????????????????????????????ü????????????ж?????????????
????Control-Allow-Origin: *
????????????????????????????????????????????????????????????????Щ?????????????????裺
????1??????????????????????www.internalurl.com
????2??internalurl?????????????????????Access-Control-Allow-Origin: *???????κ??????????????????????????????????
????3????????????????????????? – www.malicioussite.com
????4???????????????????UI???????????????????????????????????????javascript????
????5????javascript??????????XMLHttpRequest????
????6???????????????????????????????????????????
????7??????????????????????????????
???????HTML5?μ?XSS????????
???????????????к???????????????????????XSS???????????????????XSS?????????????????????????XSS??????????<img??<script???HTML5???????????μ??????????audio??vedio??????μ??????????μ??????????????е??????????????????HTML5????????????
????<video> <source onerror=”javascript:alert(1)”> <video onerror=”javascript:alert(1)”><source> <audio onerror=”javascript:alert(1)”><source> <input autofocus onfocus=alert(1)> <select autofocus onfocus=alert(1)> <textarea autofocus onfocus=alert(1)> <keygen autofocus onfocus=alert(1)> <button form=test onformchange=alert(2)>X <form><button formaction=”javascript:alert(1)”
????????XSS???????ο?freebuf??jiayzhan??XSS???????????????
????XSS???????????????????????????????????覴?
????XSS???????????????????????—???????????????
????XSS?????????????: ?????????????????????????
????XSS?????????????????????
?????壺????Web???????ж???
??????????????????HTML??????漼??????Google Chrome?? Mozilla?? Opera???Safari????????????????????????????Щ?е?????в??????п???????“?????ж?”???????????????????????????????JS??????????????????????HTML5????manifest?????????html5????????web??y????????????????????????
????1. ????????￡????????manifest?????????????????????????????????manifest???????????manifest?????и???????????????????????????????棬???????ж??????????????????????????????
????2. ??????????????????????????url?????????????????棬?????????ò?????ajax?????
????????????????????????????????????????÷??????￡?
????1???????????????????????????????WI-FI???繃???????????????
????2???ú??????????????????????????
????3?????????????????????????棬??????????????????iframe?????????????????
????4????????????????????????????????????????????????а?????manifest??????????????????????????????????????????滹??????????
????5???????????????????????????????????????????????????????????????????????????????
????6???????????????????α???????檔
????7???????????????????????
???????????manifest???????????????????????????Щ????о???????????????????????HTML5????????δ????????????????????????