XSS靶场攻关笔记

博主： literature
发布时间：2021 年 06 月 10 日
117 次浏览
关闭评论
13138字数
分类：主机教程

安装

项目地址：https://gitee.com/Zcodetea/xss-labs

level

我们首先对核心代码进行分析

欢迎用户".$str."";
?>

通过GET方法，将name的值赋值为变量$srt并将其直接输出。
即！如果name=时，将会把结果直接输出。
构造POC

http://192.168.123.240/level1.php?name=%3Cscript%3Ealert('bbskali.cn')%3C/script%3E

leve2

代码解读

没有找到和".htmlspecialchars($str)."相关的结果.".'



';
?>

我们对数据进行抓包分析

后台过滤了<>符号，对其进行了实体化。但是我们发现了另一个可搞的地方。input标签的value值，正是我们的输入内容，且没有过滤。
修改payload：">
提前将input标签闭合，让欢迎来到level11

欢迎来到level11

没有找到和good job!相关的结果.

payload的长度:9

其中多了一个input，它的value很有趣，就是第10关的url。
在第十关完成的瞬间，我们使用burp抓取数据包

未完待续……

版权属于：逍遥子大表哥

本文链接：https://blog.bbskali.cn/2552.html

按照知识共享署名-非商业性使用 4.0 国际协议进行许可，转载引用文章应遵循相同协议。

Kali黑客笔记一键关注

Last modification：June 20, 2021

© Allow specification reprint

正在沿街乞讨中……

Leave a Comment Cancel reply

请输入正确的邮箱，以便收到回复!

3 comments

Mikey

中国湖南
October 18th, 2021 at 12:41 pm
这么久之前的文章了，也来踩一下
Reply
1. 逍遥子
  
  中国四川广元
  October 18th, 2021 at 11:26 pm
  @Mikey
  感谢支持。
  Reply
站元素主机

中国山东
June 11th, 2021 at 09:26 am
感谢分享赞一个
Reply

最后修改：2023 年 08 月 04 日

© 允许规范转载

如果觉得我的文章对你有用，请随意赞赏

此处评论已关闭

XSS靶场攻关笔记

literature • 2021 年 06 月 10 日

<p><img src="https://blog.bbskali.cn/usr/uploads/2021/06/2817174784.png" alt="xss" title="xss" style="" class="aligncenter"style=""></p><h3>安装</h3><p>项目地址：<span class="external-link"><i data-feather="external-link"></i>https://gitee.com/Zcodetea/xss-labs</span></p><h3>level</h3><p><img src="https://blog.bbskali.cn/usr/uploads/2021/06/330653746.jpg" alt="level1" title="level1" style="" class="aligncenter"style=""><br />我们首先对核心代码进行分析</p><pre><code><?php 
ini_set("display_errors", 0);
$str = $_GET["name"];
echo "<h2 align=center>欢迎用户".$str."</h2>";
?></code></pre><p>通过<code>GET</code>方法，将<code>name</code>的值赋值为变量<code>$srt</code>并将其直接输出。<br />即！如果name=<code><script>alert()</script></code>时，将会把结果直接输出。<br />构造POC</p><pre><code>http://192.168.123.240/level1.php?name=%3Cscript%3Ealert('bbskali.cn')%3C/script%3E</code></pre><p><img src="https://blog.bbskali.cn/usr/uploads/2021/06/2888226071.jpg" alt="" title="" style="" class="aligncenter"style=""></p><h3>leve2</h3><p><img src="https://blog.bbskali.cn/usr/uploads/2021/06/340054467.jpg" alt="level2" title="level2" style="" class="aligncenter"style=""><br /><strong>代码解读</strong></p><pre><code><?php 
ini_set("display_errors", 0);
$str = $_GET["keyword"];
echo "<h2 align=center>没有找到和".htmlspecialchars($str)."相关的结果.</h2>".'<center>
<form action=level2.php method=GET><input name=keyword  value="'.$str.'"><br />
<input type=submit name=submit value="搜索"/></form>
</center>';
?></code></pre><p>我们对数据进行抓包分析<br /><img src="https://blog.bbskali.cn/usr/uploads/2021/06/4133238217.jpg" alt="" title="" style="" class="aligncenter"style=""><br />后台过滤了<>符号，对其进行了实体化。但是我们发现了另一个可搞的地方。input标签的value值，正是我们的输入内容，且没有过滤。<br />修改payload：<code>"><script>alert()</script></code><br />提前将input标签闭合，让<script>独立出来。</p><h3>leve3</h3><p><img src="https://blog.bbskali.cn/usr/uploads/2021/06/386735146.jpg" alt="" title=""style=""style=""><br />代码分析<br /><img src="https://blog.bbskali.cn/usr/uploads/2021/06/2890228879.jpg" alt="" title=""style=""style=""><br />发现value里的<>也被实体化掉了<br />以采用“事件”，常用的有两个，<code>onclick</code>和<code>onmouseover</code>。<br />这里用onmouseover，payload：<code>' onmouseover='javascript:alert(1)</code><br />这个为什么会起作用呢？你把它带进input的value就明白了。带入：<br />源码中就会被修改成：<code><input name=keyword  value=' ' onmouseover='javascript:alert(1)'>    </code><br /><img src="https://blog.bbskali.cn/usr/uploads/2021/06/3019936176.jpg" alt="" title=""style=""style=""><br />注入成功后，鼠标移动到input输入框，就会触发</p><p><img src="https://blog.bbskali.cn/usr/uploads/2021/06/4210837481.jpg" alt="" title=""style=""style=""></p><h3>leve4</h3><p><img src="https://blog.bbskali.cn/usr/uploads/2021/06/3240605209.jpg" alt="" title=""style=""style=""><br />和leve3的原理一样，只不过需要将<code>'</code>改为<code>"</code><br />payload:<code>" onmouseover='alert(1)'</code><br /><img src="https://blog.bbskali.cn/usr/uploads/2021/06/2809453007.jpg" alt="" title=""style=""style=""></p><h3>leve5</h3><p><img src="https://blog.bbskali.cn/usr/uploads/2021/06/2296556965.jpg" alt="" title=""style=""style=""><br />发现事件也被过滤掉了。不要感到束手无策，前两题我们用事件是因为，<>不能用。但是这关没限制呀。我们只是不能用script，还有好多标签可用，比如<code><a></code>, <code><img></code>。<br />所以我们提前闭合<code>input</code>给<code><a></code>即可<br />payload:<code>" /> <a href=javascript:alert()>bbskali.cn</a></code><br /><img src="https://blog.bbskali.cn/usr/uploads/2021/06/34133507.jpg" alt="" title=""style=""style=""></p><h3>leve6</h3><p>同样的套路，但是发现超链接屏蔽了。<br /><img src="https://blog.bbskali.cn/usr/uploads/2021/06/928016031.jpg" alt="" title=""style=""style=""><br />将<code>href</code>进行了屏蔽，那么有么有屏蔽<code>Href</code>等大小写组合呢？<br />OK 成功！<br /><img src="https://blog.bbskali.cn/usr/uploads/2021/06/3460240384.jpg" alt="" title=""style=""style=""></p><h3>leve7</h3><p><img src="https://blog.bbskali.cn/usr/uploads/2021/06/3315444155.jpg" alt="" title=""style=""style=""><br />script字符串被整个的过滤掉了，输入的on被过滤掉了，javascript的script也过滤了。<br />payload：<code>"><scripscriptt>alert()</scrscriptipt></code></p><h3>leve8</h3><p><img src="https://blog.bbskali.cn/usr/uploads/2021/06/2145095881.jpg" alt="" title=""style=""style=""><br />发现输入框的value会被填进超链接的href里面去。所以我们只需构造href就好了。<br />javascript被过滤了。这里你发现调整大小写也没有用。怎么办？<br />我们就可以使用&#116替换javascript中的t，从而绕过过滤。<br />payload：<code>javascrip&#116:alert()</code></p><h3>leve9</h3><p><img src="https://blog.bbskali.cn/usr/uploads/2021/06/2794758055.jpg" alt="" title=""style=""style=""><br />输入中要有http://才能被识别写入。<br />paylaod：<code>javascrip&#x74:alert()//http://</code></p><h3>leve10</h3><p><img src="https://blog.bbskali.cn/usr/uploads/2021/06/209141959.jpg" alt="" title=""style=""style=""><br />没有输入框，也没有超链接了。<br /><img src="https://blog.bbskali.cn/usr/uploads/2021/06/1996148942.jpg" alt="" title=""style=""style=""><br />通过发现，将输入框隐藏了而已。<br />payload:<code>t_sort=" type="text" onmouseover=alert() "</code><br /><img src="https://blog.bbskali.cn/usr/uploads/2021/06/2204556384.jpg" alt="" title=""style=""style=""></p><h3>leve11</h3><p><img src="https://blog.bbskali.cn/usr/uploads/2021/06/2541873681.jpg" alt="" title=""style=""style=""><br />对其源码分析</p><pre><code><script>
window.alert = function()  
{     
confirm("完成的不错！");
 window.location.href="level12.php?keyword=good job!"; 
}
</script>
<title>欢迎来到level11</title>
</head>
<body>
<h1 align=center>欢迎来到level11</h1>
<h2 align=center>没有找到和good job!相关的结果.</h2><center>
<form id=search><input name="t_link"  value="" type="hidden"><br />
<input name="t_history"  value="" type="hidden"><br />
<input name="t_sort"  value="" type="hidden"><br />
<input name="t_ref"  value="http://192.168.123.240/level10.php?t_sort=%22%20type=%22text%22%20onmouseover=alert()%20%22" type="hidden"></form>
</center><center><img src=level11.png></center>
<h3 align=center>payload的长度:9</h3></body></code></pre><p>其中多了一个input，它的value很有趣，就是第10关的url。<br />在第十关完成的瞬间，我们使用burp抓取数据包<br /><img src="https://blog.bbskali.cn/usr/uploads/2021/06/937646918.jpg" alt="" title=""style=""style=""></p><p>未完待续……</p><p><hr class="content-copyright" style="margin-top:50px" /></p><div class="post-copyright" style="font-style:normal"><p class="iconfont-copyright"><i class="glyphicon glyphicon-copyright-mark"></i></p><p class="content-copyright">版权属于：逍遥子大表哥</p><p class="content-copyright">本文链接：<a class="content-copyright" href="https://blog.bbskali.cn/2552.html">https://blog.bbskali.cn/2552.html</a></p><p class="content-copyright">按照知识共享署名-非商业性使用 4.0 国际协议进行许可，转载引用文章应遵循相同协议。</p></div><p></div></p><p></p><div class="ad"><img class="adimg" src="https://blog.bbskali.cn/ad/wx1.png"></p><div class="adp"><img style="width: 30px;border-radius: 50%;<br />
vertical-align: middle;" src="https://blog.bbskali.cn/kali.png" >  Kali黑客笔记<a class="anu" href="https://mp.weixin.qq.com/mp/profile_ext?action=home&__biz=MzkxMzIwNTY1OA==#wechat_redirect">一键关注</a></div></div><p></p><div class="show-foot"><div class="notebook" data-toggle="tooltip" data-original-title="June 20, 2021 10:01 pm"><i class="fontello fontello-clock-o"></i><br />
<span>Last modification：June 20, 2021</span></div><div class="copyright" data-toggle="tooltip" data-html="true" data-original-title="For reprint, please keep the reprint address of this article, and the copyright belongs to the author"><span>© Allow specification reprint</span></div></div><p></p><div class="support-author"><button id="support_author"  data-toggle="modal" data-target="#myModal" class="box-shadow-wrap-lg btn_post_footer btn btn-pay btn-yellow btn-rounded"><svg fill="none" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" class="icon" aria-hidden="true"><path d="M10.084 7.606c3.375-1.65 7.65-1.154 10.493 1.487 3.497 3.25 3.497 8.519 0 11.77-3.498 3.25-9.167 3.25-12.665 0-.897-.834-2.488-2.96-2.488-5.085" stroke="currentColor" stroke-width="1.4" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"></path><path d="M17.392 14.78s1.532-1.318-.053-2.79c-1.585-1.473-3.17-.404-3.719.403-.549.807.495 2.082.93 2.69.434.61 1.364 2.182-.054 3.202-1.417 1.012-3.002.658-4.153-.708-1.15-1.367-.602-3.365 0-3.924M17.338 11.982l1.159-1.076M9.87 18.922l.937-.871" stroke="currentColor" stroke-width="1.4" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"></path><path d="M.8 1.205s7.15 4.673 8.773 6.182c1.623 1.508 3.231 4.008 1.616 5.509-2.195 2.04-4.054.595-6.737-.75-.884-.447-3.15-1.777-3.15-1.777M10.136.9l1.047 3.188" stroke="currentColor" stroke-width="1.4" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"></path></svg><span>Support</span></button><div id="myModal" class="modal fade bs-example-modal-sm" tabindex="-1" role="dialog" aria-labelledby="mySmallModalLabel"><div class="modal-dialog modal-sm" role="document"><div class="modal-content box-shadow-wrap-lg"><div class="modal-header box-shadow-bottom-normal"><button type="button" class="close" data-dismiss="modal"><i style="vertical-align: bottom;" data-feather="x-circle"></i></button><h4 class="modal-title">Appreciate the author</h4></div><div class="modal-body"><div class="solid-tab tab-container post_tab"><ul class="nav no-padder b-b scroll-hide" role="tablist"> <li class="nav-item active" role="presentation"><a class="nav-link active" style="" data-toggle="tab"  role="tab" data-target="#alipay_author"><i class="iconfont icon-alipay" aria-hidden="true"></i>AliPay</a></li><li class="nav-item " role="presentation"><a class="nav-link " style="" data-toggle="tab"  role="tab" data-target="#wechatpay_author"><i class="iconfont icon-wechatpay" aria-hidden="true"></i>WeChat</a></li>        </ul><div class="tab-content no-border"><div role="tabpanel" id="alipay_author" class="tab-pane fade active in"><img noGallery class="pay-img tab-pane" id="alipay_author" role="tabpanel" src="https://blog.bbskali.cn/usr/themes/handsome/assets/img/loading.svg" data-original="https://blog.bbskali.cn/zfb.jpg" /></div><div role="tabpanel" id="wechatpay_author" class="tab-pane fade  "><img noGallery  class="pay-img tab-pane" id="wechatpay_author" role="tabpanel" src="https://blog.bbskali.cn/usr/themes/handsome/assets/img/loading.svg" data-original="https://blog.bbskali.cn/wx.png" /></div></div><p></div><p></div><p></div><p></div><p></div><p></p><button id="star_post" data-cid="2552" class="box-shadow-wrap-lg btn_post_footer like_button btn btn-pay btn-rounded">
                 <svg xmlns="http://www.w3.org/2000/svg" width="24px" height="24px" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="shake-little unlike_svg feather feather-thumbs-up"><path d="M14 9V5a3 3 0 0 0-3-3l-4 9v11h11.28a2 2 0 0 0 2-1.7l1.38-9a2 2 0 0 0-2-2.3zM7 22H4a2 2 0 0 1-2-2v-7a2 2 0 0 1 2-2h3"></path></svg>
                 <div class="circle-rounded"></div>
                 <svg class="liked_svg" style="transform: scale(2.2);" xmlns="http://www.w3.org/2000/svg" viewBox="30 30 60 60" width="60" height="60" preserveAspectRatio="xMidYMid meet">
                    <g clip-path="url(#__lottie_element_1061)">
                        <g style="display: block;" transform="matrix(1,-0.0000012433954452717444,0.0000012433954452717444,1,47.87498474121094,47.057003021240234)" opacity="1">
                            <g class="like_rotate">
                                <g opacity="1" transform="matrix(1,0,0,1,14.376999855041504,11.416000366210938)">
                                    <path stroke-linecap="butt" stroke-linejoin="miter" fill-opacity="0" stroke-miterlimit="10" stroke="rgb(255,255,255)" stroke-opacity="1" stroke-width="2" d=" M-7.936999797821045,9.531000137329102 C-7.936999797821045,9.531000137329102 3.378000020980835,9.531000137329102 3.378000020980835,9.531000137329102 C3.815999984741211,9.531000137329102 4.209000110626221,9.258999824523926 4.360000133514404,8.847000122070312 C4.360000133514404,8.847000122070312 7.501999855041504,0.36000001430511475 7.501999855041504,0.36000001430511475 C8.020000457763672,-1.0360000133514404 6.986000061035156,-2.5199999809265137 5.497000217437744,-2.5199999809265137 C5.497000217437744,-2.5199999809265137 -0.5669999718666077,-2.5199999809265137 -0.5669999718666077,-2.5199999809265137 C-0.6399999856948853,-2.5199999809265137 -0.6859999895095825,-2.5969998836517334 -0.6499999761581421,-2.6600000858306885 C-0.36800000071525574,-3.1679999828338623 0.6269999742507935,-4.922999858856201 0.8870000243186951,-5.764999866485596 C1.309000015258789,-7.13100004196167 0.847000002861023,-8.715999603271484 -1.4539999961853027,-9.519000053405762 C-1.4759999513626099,-9.526000022888184 -1.4989999532699585,-9.527000427246094 -1.5180000066757202,-9.519000053405762 C-1.5299999713897705,-9.513999938964844 -1.5410000085830688,-9.505999565124512 -1.5490000247955322,-9.494000434875488 C-1.7309999465942383,-9.234999656677246 -2.6489999294281006,-7.934000015258789 -3.6419999599456787,-6.52400016784668 C-4.795000076293945,-4.888000011444092 -6.050000190734863,-3.1059999465942383 -6.380000114440918,-2.638000011444092 C-6.434000015258789,-2.562000036239624 -6.519000053405762,-2.5199999809265137 -6.611000061035156,-2.5199999809265137 C-6.611000061035156,-2.5199999809265137 -7.938000202178955,-2.5199999809265137 -7.938000202178955,-2.5199999809265137 C-7.982999801635742,-2.5199999809265137 -8.020000457763672,-2.4839999675750732 -8.020000457763672,-2.437999963760376 C-8.020000457763672,-2.437999963760376 -8.020000457763672,9.447999954223633 -8.020000457763672,9.447999954223633 C-8.020000457763672,9.494000434875488 -7.982999801635742,9.531000137329102 -7.936999797821045,9.531000137329102z"></path>
                                    <path fill="rgb(255,255,255)" fill-opacity="1" d=" M-7.936999797821045,9.531000137329102 C-7.936999797821045,9.531000137329102 3.378000020980835,9.531000137329102 3.378000020980835,9.531000137329102 C3.815999984741211,9.531000137329102 4.209000110626221,9.258999824523926 4.360000133514404,8.847000122070312 C4.360000133514404,8.847000122070312 7.501999855041504,0.36000001430511475 7.501999855041504,0.36000001430511475 C8.020000457763672,-1.0360000133514404 6.986000061035156,-2.5199999809265137 5.497000217437744,-2.5199999809265137 C5.497000217437744,-2.5199999809265137 -0.5669999718666077,-2.5199999809265137 -0.5669999718666077,-2.5199999809265137 C-0.6399999856948853,-2.5199999809265137 -0.6859999895095825,-2.5969998836517334 -0.6499999761581421,-2.6600000858306885 C-0.36800000071525574,-3.1679999828338623 0.6269999742507935,-4.922999858856201 0.8870000243186951,-5.764999866485596 C1.309000015258789,-7.13100004196167 0.847000002861023,-8.715999603271484 -1.4539999961853027,-9.519000053405762 C-1.4759999513626099,-9.526000022888184 -1.4989999532699585,-9.527000427246094 -1.5180000066757202,-9.519000053405762 C-1.5299999713897705,-9.513999938964844 -1.5410000085830688,-9.505999565124512 -1.5490000247955322,-9.494000434875488 C-1.7309999465942383,-9.234999656677246 -2.6489999294281006,-7.934000015258789 -3.6419999599456787,-6.52400016784668 C-4.795000076293945,-4.888000011444092 -6.050000190734863,-3.1059999465942383 -6.380000114440918,-2.638000011444092 C-6.434000015258789,-2.562000036239624 -6.519000053405762,-2.5199999809265137 -6.611000061035156,-2.5199999809265137 C-6.611000061035156,-2.5199999809265137 -7.938000202178955,-2.5199999809265137 -7.938000202178955,-2.5199999809265137 C-7.982999801635742,-2.5199999809265137 -8.020000457763672,-2.4839999675750732 -8.020000457763672,-2.437999963760376 C-8.020000457763672,-2.437999963760376 -8.020000457763672,9.447999954223633 -8.020000457763672,9.447999954223633 C-8.020000457763672,9.494000434875488 -7.982999801635742,9.531000137329102 -7.936999797821045,9.531000137329102z"></path>
                                </g>
                                <g opacity="1" transform="matrix(1,0,0,1,2.694000005722046,14.967000007629395)">
                                    <path fill="rgb(255,255,255)" fill-opacity="1" d=" M0.5019999742507935,7.0269999504089355 C0.5019999742507935,7.0269999504089355 -0.5019999742507935,7.0269999504089355 -0.5019999742507935,7.0269999504089355 C-0.7789999842643738,7.0269999504089355 -1.003999948501587,6.802000045776367 -1.003999948501587,6.525000095367432 C-1.003999948501587,6.525000095367432 -1.003999948501587,-6.525000095367432 -1.003999948501587,-6.525000095367432 C-1.003999948501587,-6.802000045776367 -0.7789999842643738,-7.0269999504089355 -0.5019999742507935,-7.0269999504089355 C-0.5019999742507935,-7.0269999504089355 0.5019999742507935,-7.0269999504089355 0.5019999742507935,-7.0269999504089355 C0.7789999842643738,-7.0269999504089355 1.003999948501587,-6.802000045776367 1.003999948501587,-6.525000095367432 C1.003999948501587,-6.525000095367432 1.003999948501587,6.525000095367432 1.003999948501587,6.525000095367432 C1.003999948501587,6.802000045776367 0.7789999842643738,7.0269999504089355 0.5019999742507935,7.0269999504089355z"></path>
                                </g>
                            </g>
                        </g>
                    </g>
                 </svg>
                 <span>Like&nbsp;<span id="like_label" class="like_label">0</span></span>
                 </button><div class="mt20 text-center article__reward-info"><span class="mr10">正在沿街乞讨中……</span></div></div><p>             <br />
</div><br />
</article><br />
</div><br />
</p><nav class="m-t-lg m-b-lg">
        <ul class="pager">
        <li class="next"><a class="box-shadow-wrap-normal" href="https://blog.bbskali.cn/2550.html" title="宝塔环境下安装Zabbix" data-toggle="tooltip">Next</a></li>   <li class="previous"><a class="box-shadow-wrap-normal" href="https://blog.bbskali.cn/2577.html" title="Pr消除音频中的杂音" data-toggle="tooltip">Previous</a></li>
        </ul>
       </nav><p></p><style>
            textarea#comment{
                background-image: url('https://blog.bbskali.cn/ad/pl.gif');
                background-color: #ffffff;
                transition: all 0.25s ease-in-out 0s;
            }
            textarea#comment:focus {
                background-position-y: 105px;
                transition: all 0.25s ease-in-out 0s;
            }
        </style><p><div id="comments"></p><p></p><div id="respond-post-2552" class="respond comment-respond no-borders"><h4 id="reply-title" class="comment-reply-title m-t-lg m-b-none">Leave a Comment                        <small class="cancel-comment-reply"><a id="cancel-comment-reply-link" href="https://blog.bbskali.cn/2552.html#respond-post-2552" rel="nofollow" style="display:none" onclick="return TypechoComment.cancelReply();">Cancel reply</a></small><br />
                        <div class="text-muted m-t-xs" style="font-size: 13px;line-height: 18px;"><i style="vertical-align: -2px;width:14px;height: 14px" data-feather="alert-circle"></i><br />
请输入正确的邮箱，以便收到回复!</div></h4><form id="comment_form" method="post" action="https://blog.bbskali.cn/2552.html/comment"  class="comment-form" role="form"><input type="hidden" name="receiveMail" id="receiveMail" value="yes" /></p><div class="comment-form-comment form-group"><label class="padder-v-sm" for="comment">Comment                                <span class="required text-danger">*</span></label><textarea id="comment" class="textarea form-control OwO-textarea" name="text" rows="5" placeholder="say something…" onkeydown="if(event.ctrlKey&&event.keyCode==13){document.getElementById('submit').click();return false};"></textarea><div class="OwO padder-v-sm"></div><div class="secret_comment" id="secret_comment" data-toggle="tooltip"
                            data-original-title="When this function is enabled, your comments are only visible to both the author and the comment"><label class="secret_comment_label control-label">Private comment</label><div class="secret_comment_check"><label class="i-switch i-switch-sm bg-info m-b-ss m-r">
                                        <input type="checkbox" id="secret_comment_checkbox">
                                        <i></i>
                                    </label></div></div></div><p></p><div id="author_info" class="row row-sm"><div class="comment-form-author form-group col-sm-6 col-md-4"><label for="author">Name                                        <span class="required text-danger">*</span></label><div><img class="author-avatar" src="/d41d8cd98f00b204e9800998ecf8427e?s=65&r=R&d=" nogallery/><br />
<input id="author" class="form-control" name="author" type="text" value="" maxlength="245" placeholder="Name or nickname"></p><div class="random_user_name shake-constant"></div></div></div><div class="comment-form-email form-group col-sm-6 col-md-4"><label for="email">Email                                                                                <span class="required text-danger">*</span>
                                                                            </label><p><input type="text" name="mail" id="mail" class="form-control" placeholder="E-mail (required)" value="" /></div><div class="comment-form-url form-group col-sm-12 col-md-4"><label for="url">Site                                                                            </label><p><input id="url" class="form-control" name="url" type="url" value="" maxlength="200" placeholder="Website or blog"></div></div><p></p><div class="form-group"><button type="submit" name="submit" id="submit" class="submit btn-rounded box-shadow-wrap-lg btn-gd-primary padder-lg">
                                    <span>Leave a Comment</span>
                                    <span class="text-active">submitting...</span>
                                </button><p><i class="animate-spin fontello fontello-spinner hide" id="spin"></i><br />
<input type="hidden" name="comment_post_ID" id="comment_post_ID"><br />
<input type="hidden" name="comment_parent" id="comment_parent"></div></form></div><p><br />
<div id="post-comment-list" class="skt-loading"></p><h4 class="comments-title m-t-lg m-b">3 comments</h4><nav class="loading-nav text-center m-t-lg m-b-lg hide">
<p class="infinite-scroll-request"><i class="animate-spin fontello fontello-refresh"></i>Loading...</p>
</nav><ol class="comment-list">

<li id="comment-1369" class="comment-body comment-parent comment-odd"><div id="div-comment-1369" class="comment-body"><a class="pull-left thumb-sm comment-avatar" rel="nofollow"><img nogallery src="https://q2.qlogo.cn/g?b=qq&nk=2679855646&s=100" class="img-40px photo img-square normal-shadow"></a></p><div class="m-b m-l-xxl"><div class="comment-meta"><span class="comment-author vcard"><b class="fn">Mikey</b><br />
                                <a data-coid="1369" class="post-comment-star text-muted star_talk"><i class="glyphicon glyphicon-heart-empty"></i>&nbsp;<span class="star_count"></span></a><br />
                        <span ><span class="ua-icon"style="background:#f3f3f3" data-toggle="tooltip" data-original-title="中国 湖南"><i class="iconfontua icon-location-arrow " aria-hidden="true"></i> 中国 湖南</span></span></span></p><div class="comment-metadata"><a href="#comment-1369"><time class="format_time text-muted text-xs block m-t-xs" pubdate="pubdate" datetime="2021-10-18T12:41:26+08:00">October 18th, 2021 at 12:41 pm</time></a></div></div><p></p><div class="comment-content m-t-sm"><span class="comment-author-at"><b></b></span></p><div class="comment-content-true"><p>这么久之前的文章了，也来踩一下</p></div></div><p></p><div class="comment-reply m-t-sm"><a href="https://blog.bbskali.cn/2552.html/comment-page-1?replyTo=1369#respond-post-2552" rel="nofollow" onclick="return TypechoComment.reply('comment-1369', 1369);">Reply</a></div></div></div><br />
            <br />
             <br />
                <div class="comment-children list-unstyled m-l-xxl"><ol class="comment-list">

<li id="comment-1370" class="comment-body comment-child comment-level-odd comment-odd comment-by-author"><div id="div-comment-1370" class="comment-body"><a class="pull-left thumb-sm comment-avatar" rel="nofollow"><img nogallery src="https://q2.qlogo.cn/g?b=qq&nk=914101530&s=100" class="img-40px photo img-square normal-shadow">                    <label data-toggle="tooltip" data-placement="right" title="Author" class="label comment-author-logo m-l-xs"><span><i data-feather="zap"></i></span></label></a></p><div class="m-b m-l-xxl"><div class="comment-meta"><span class="comment-author vcard"><b class="fn"><a href="https://bbskali.cn"target="_blank" rel="external nofollow" class="no-external-link">逍遥子</a></b><br />
                                <a data-coid="1370" class="post-comment-star text-muted star_talk"><i class="glyphicon glyphicon-heart-empty"></i>&nbsp;<span class="star_count"></span></a><br />
                        <span ><span class="ua-icon"style="background:#f3f3f3" data-toggle="tooltip" data-original-title="中国 四川 广元"><i class="iconfontua icon-location-arrow " aria-hidden="true"></i> 中国 四川 广元</span></span></span></p><div class="comment-metadata"><a href="#comment-1370"><time class="format_time text-muted text-xs block m-t-xs" pubdate="pubdate" datetime="2021-10-18T23:26:23+08:00">October 18th, 2021 at 11:26 pm</time></a></div></div><p></p><div class="comment-content m-t-sm"><span class="comment-author-at"><b><a href="#comment-1369">@Mikey</a></b></span></p><div class="comment-content-true"><p>感谢支持。</p></div></div><p></p><div class="comment-reply m-t-sm"><a href="https://blog.bbskali.cn/2552.html/comment-page-1?replyTo=1370#respond-post-2552" rel="nofollow" onclick="return TypechoComment.reply('comment-1370', 1370);">Reply</a></div></div></div><br />
            <br />
             </li>
    </ol><p></div><br />
             </li>

<li id="comment-1237" class="comment-body comment-parent comment-even"><div id="div-comment-1237" class="comment-body"><a class="pull-left thumb-sm comment-avatar" rel="nofollow"><img nogallery src="https://q2.qlogo.cn/g?b=qq&nk=2650966634&s=100" class="img-40px photo img-square normal-shadow"></a></p><div class="m-b m-l-xxl"><div class="comment-meta"><span class="comment-author vcard"><b class="fn"><a href="http://www.zysgp.net"target="_blank" rel="external nofollow" class="no-external-link">站元素主机</a></b><br />
                                <a data-coid="1237" class="post-comment-star text-muted star_talk"><i class="glyphicon glyphicon-heart-empty"></i>&nbsp;<span class="star_count"></span></a><br />
                        <span ><span class="ua-icon"style="background:#f3f3f3" data-toggle="tooltip" data-original-title="中国 山东"><i class="iconfontua icon-location-arrow " aria-hidden="true"></i> 中国 山东</span></span></span></p><div class="comment-metadata"><a href="#comment-1237"><time class="format_time text-muted text-xs block m-t-xs" pubdate="pubdate" datetime="2021-06-11T09:26:38+08:00">June 11th, 2021 at 09:26 am</time></a></div></div><p></p><div class="comment-content m-t-sm"><span class="comment-author-at"><b></b></span></p><div class="comment-content-true"><p>感谢分享 赞一个</p></div></div><p></p><div class="comment-reply m-t-sm"><a href="https://blog.bbskali.cn/2552.html/comment-page-1?replyTo=1237#respond-post-2552" rel="nofollow" onclick="return TypechoComment.reply('comment-1237', 1237);">Reply</a></div></div></div><br />
            <br />
             </li>
    </ol><nav id="comment-navigation" class="text-center m-t-lg m-b-lg" role="navigation"></nav><script type="text/javascript" id='outputCommentJS'>
(function () {
    window.TypechoComment = {
        dom : function (id) {
            return document.getElementById(id);
        },
    
        create : function (tag, attr) {
            var el = document.createElement(tag);
        
            for (var key in attr) {
                el.setAttribute(key, attr[key]);
            }
        
            return el;
        },

reply : function (cid, coid) {
            var comment = this.dom(cid), parent = comment.parentNode,
                response = this.dom('respond-post-2552'), input = this.dom('comment-parent'),
                form = 'form' == response.tagName ? response : response.getElementsByTagName('form')[0],
                textarea = response.getElementsByTagName('textarea')[0];

if (null == input) {
                input = this.create('input', {
                    'type' : 'hidden',
                    'name' : 'parent',
                    'id'   : 'comment-parent'
                });

form.appendChild(input);
            }

input.setAttribute('value', coid);

if (null == this.dom('comment-form-place-holder')) {
                var holder = this.create('div', {
                    'id' : 'comment-form-place-holder'
                });

response.parentNode.insertBefore(holder, response);
            }

comment.appendChild(response);
            this.dom('cancel-comment-reply-link').style.display = '';

if (null != textarea && 'text' == textarea.name) {
                textarea.focus();
            }

return false;
        },

cancelReply : function () {
            var response = this.dom('respond-post-2552'),
            holder = this.dom('comment-form-place-holder'), input = this.dom('comment-parent');

if (null != input) {
                input.parentNode.removeChild(input);
            }

if (null == holder) {
                return true;
            }

this.dom('cancel-comment-reply-link').style.display = 'none';
            holder.parentNode.insertBefore(response, holder);
            return false;
        }
    };
})();
</script><script type="text/javascript">
var registCommentEvent = function() {
    var event = document.addEventListener ? {
        add: 'addEventListener',
        focus: 'focus',
        load: 'DOMContentLoaded'
    } : {
        add: 'attachEvent',
        focus: 'onfocus',
        load: 'onload'
    };
    
    var r = document.getElementById('respond-post-2552');
    if (null != r) {
        var forms = r.getElementsByTagName('form');
        if (forms.length > 0) {
            var f = forms[0], textarea = f.getElementsByTagName('textarea')[0], added = false;
            var submitButton = f.querySelector('button[type="submit"]');
            if (null != textarea && 'text' == textarea.name) {
                var referSet =  function () {
                    if (!added) {
//                        console.log('commentjs');
                        const child = f.querySelector('input[name="_"]');
                        const child2 = f.querySelector('input[name="checkReferer"]');
                        if (child!=null){
                            f.removeChild(child);                        
                        } 
                        if (child2!=null){
                            f.removeChild(child2);                        
                        } 
                        var input = document.createElement('input');
                        input.type = 'hidden';
                        input.name = '_';
                            input.value = (function () {
    var _ibRymNN = //'lt'
'388'+//'Q8'
'a6'+'a80'//'9RO'
+'af6'//'c'
+/* 'X'//'X' */''+//'ZG'
'3b'+//'HH'
'4'+'182'//'Cht'
+'ad4'//'DqE'
+'H'//'H'
+//'siu'
'b'+//'fwL'
'28d'+//'pK'
'6'+'0bf'//'MCC'
+'1'//'97'
+'57'//'n'
+/* '4'//'4' */''+/* 'q2'//'q2' */''+''///*'Po'*/'Po'
+'N'//'N'
+//'O1o'
'7', _7ewGn41 = [[20,21],[31,32]];
    
    for (var i = 0; i < _7ewGn41.length; i ++) {
        _ibRymNN = _ibRymNN.substring(0, _7ewGn41[i][0]) + _ibRymNN.substring(_7ewGn41[i][1]);
    }

return _ibRymNN;
})();
                    
                        f.appendChild(input);
                        
                        input = document.createElement('input');
                        input.type = 'hidden';
                        input.name = 'checkReferer';
                        input.value = 'false';
                        
                        f.appendChild(input);

added = true;
                    }
                };//end of reset
                referSet();
            }
        }
    }
};

$(function(){
    registCommentEvent();
});
</script></p>