i 春秋月刊 5：进击的 XSS (it-ebooks)（Z-Library）

【One-Line Pitch】 A hands-on Chinese security monthly issue that treats XSS not as a single trick but as a mindset: inject, adapt to the output context, bypass filters, and chain with CSRF, phishing, and platform tooling. Best for web-security learners and pentesters who already know basic HTML/JS and want practical, scenario-driven XSS craft. 【Book Arc】 - **Opening (~0%–11%)**: Frames XSS fundamentals through the DVWA lab — reflected, stored, and DOM types across Low/Medium/High/Impossible levels, so you learn by comparing vulnerable vs. hardened code. - **Early (~11%–28%)**: Moves from theory to construction: how the output context (attributes, tags, textareas) dictates your payload, and how to escape or close tags rather than blindly pasting `<script>`. - **Early–Middle (~28%–44%)**: Introduces encoding and bypass as a discipline — URL, Unicode, HTML, and CSS encoding, plus common WAF-evasion patterns and the underrated risk of browser plugins. - **Middle (~44%–61%)**: Shifts to chained attacks: XSS combined with CSRF to mass-harvest cookies, XSS platforms for GPS/battery/screenshot collection, and phishing flows that turn a "useless" stored XSS into admin takeover. - **Late (~61%–end)**: Applies everything to real targets — financial sites, e-commerce, game phishing networks — and closes with remediation advice (output encoding per language) and a CTF-style XSS challenge walkthrough. 【Key Takeaways】 - **XSS is "executing your JS in the page," not just alert boxes** (Early): the book repeatedly stresses that popups only prove existence; real value comes from cookie theft, action control, and chaining. - **Output context determines payload** (Early): whether your input lands in an attribute, a tag body, or a textarea decides whether you close a quote, close a tag, or use an `on` event. - **Filter bypass is pattern recognition, not magic** (Middle): case mixing, double-writing (`scrSCRIPTipt`), entity encoding, and `eval(String.fromCharCode(...))` recur as reusable techniques. - **Encoding is a bypass toolkit** (Middle): URL, Unicode, HTML, and CSS encodings each exploit a different parsing layer between input and browser rendering. - **XSS + CSRF is far more dangerous than XSS alone** (Middle): a "chicken-rib" event-triggered stored XSS becomes a mass cookie-harvesting weapon once paired with a CSRF page. - **XSS platforms lower the skill floor** (Middle): external JS links let beginners harvest GPS, battery status, and screenshots without writing the payloads themselves. - **Browser plugins are an overlooked attack surface** (Middle): because plugins render cross-domain, a malicious or compromised plugin can bypass even a well-defended site. - **Defense is output encoding, language by language** (Late): the book lists `htmlspecialchars`, `cgi.escape`, `Server.HTMLEncode`, and similar functions as the practical fix. 【Reading Tips】 - Deep-read the DVWA section (Opening) if you're new — comparing the four security levels is the fastest way to internalize why filters fail. - Skim the CTF challenge walkthrough (Late) on a first pass, then return to it as a puzzle set once you've absorbed the bypass techniques. - Treat the encoding chapter (Middle) as a reference you'll revisit; don't try to memorize every encoding at once. - Pay attention to the chained-attack chapters (Middle) — they show how individual tricks combine into realistic intrusion scenarios. - Note the remediation section (Late) even if you're offense-focused; it clarifies what actually stops each technique. 【Coverage Limits】 The excerpts cover XSS fundamentals, encoding/bypass, chaining, and real-world cases, but do not detail the full CTF challenge solutions or every chapter's content; some sections (e.g., XCS, page-rendering XSS) are mentioned only briefly.