CTF瀹炴垬9 XSS璺ㄧ珯鑴氭湰婕忔礊

Posted 2021-04-29 鐜勯瓊宸ヤ綔瀹?/a> CT

渚濇棫鍏堟嫓绁栧笀鐖穨

閲嶈澹版槑

璇ュ煿璁腑鎻愬強鐨勬妧鏈彧閫傜敤浜庡悎娉旵TF姣旇禌鍜屾湁鍚堟硶鎺堟潈鐨勬笚閫忔祴璇曪紝璇峰嬁鐢ㄤ簬鍏朵粬闈炴硶鐢ㄩ€旓紝濡傜敤浣滃叾浠栭潪娉曠敤閫斾笌鏈枃浣滆€呮棤鍏?/strong>

鏈夊悓瀛﹂棶鍜嬫渶杩戜笉鍙戝皬濮愬浜唦馃槶

浼楀彛闅捐皟鍞夝煒攡

濂藉惂鎴戜滑鎭㈠鍙戝皬濮愬~

锛堟瘡澶╀负浣犱滑鎸戝皬濮愬閮藉緱涓€涓皬鏃秪锛?/p>

鎴戜滑璋冩暣涓€涓嬪績鎯厏

寮€濮嬪涔犳柊鐨勭煡璇唦

涓嬮潰鎴戜滑寮€濮媬

sdfd

XSS浜х敓鐨勮儗鏅?/strong>

鍦?span>Web 2.0鍑虹幇浠ュ墠锛?span>XSS璺ㄧ珯鑴氭湰鏀诲嚮涓嶆槸閭ｄ箞寮曚汉娉ㄧ洰

浣嗘槸鍦ㄩ殢鐫€Web 2.0鍑虹幇浠ュ悗锛岄厤鍚堟祦琛岀殑AJAX鎶€鏈紝XSS璺ㄧ珯鑴氭湰鏀诲嚮鐨勫嵄瀹虫€ц揪鍒颁簡鍗佸垎涓ラ噸鐨勫湴姝?/p>

涓栫晫涓婄涓€涓?span>XSS璺ㄧ珯鑴氭湰锠曡櫕鍙戠敓鍦?span>MySpace缃戠珯锛?0灏忔椂鍐呭氨浼犳煋浜嗕竴鐧句竾涓敤鎴凤紝鏈€鍚庡鑷磋缃戠珯鐦棯

闅忕潃SNS绀句氦缃戠珯銆佸井鍗氱郴缁熺殑鍑虹幇锛?span>Web搴旂敤瀹夊叏閲嶅績杞Щ鍒扮敤鎴疯处鍙峰畨鍏ㄤ笂锛?span>XSS鏀诲嚮鎴愪负褰撲粖鏈€娴佽鐨勪竴绉嶆敾鍑绘柟寮忥紝鍚屾椂涔熸槸Web搴旂敤闈复鐨勪富瑕佸▉鑳?/p>

sdfd

XSS鏀诲嚮浜嬩欢涓€

鍦?005骞?0鏈堝垵锛屼笘鐣屼笂绗竴涓?span>XSS锠曡櫕Sammy鍑虹幇浜嗭紝瀹冨埄鐢ㄨ憲鍚嶇綉缁滅ぞ鍖?span>MySpace.com鐨勭郴缁熸紡娲烇紝浠?span>XSS鐨勬柟寮忚繘琛屼紶鎾殑Sammy锠曡櫕鐨勪綔鑰呭湪绀惧尯涓汉璧勬枡涓彃鍏?span>XSS鏀诲嚮鑴氭湰

褰撳叾浠?span>MySpace.com鐢ㄦ埛鏌ョ湅浠栫殑璧勬枡鏃讹紝XSS鏀诲嚮鑴氭湰灏变細杩愯锛岃嚜鍔ㄦ妸Sammy鐨勪綔鑰呭姞涓哄ソ鍙嬶紝鍚屾椂Sammy鏈韩涔熶細琚鍒跺埌娴忚鑰呯殑涓汉璧勬枡閲岄潰杩涜浼犳挱

涓嶅埌20涓皬鏃讹紝灏辨湁瓒呰繃100涓?span>MySpace.com鐢ㄦ埛鍙楀埌鎰熸煋锛岄€犳垚缃戠珯涓€搴︾槴鐥?/p>

MySpace.com涓烘涓嶅緱涓嶇姝㈡墍鏈夌敤鎴峰湪涓汉璧勬枡涓姞鍏ヤ换浣曡剼鏈▼搴?/p>

2011骞?鏈?8鏃ユ櫄锛屾柊娴井鍗氬嚭鐜颁簡涓€娆℃瘮杈冨ぇ鐨刋SS鏀诲嚮浜嬩欢銆傚ぇ閲忕敤鎴疯嚜鍔ㄥ彂閫佽濡傦細鈥滈儹缇庣編浜嬩欢鐨勪竴浜涙湭娉ㄦ剰鍒扮殑缁嗚妭鈥濓紝鈥滃缓鍏氬ぇ涓氫腑绌垮府鐨勫湴鏂光€濓紝鈥滆濂充汉蹇冨姩鐨?00鍙ヨ瘲姝屸€濓紝鈥?D鑲夎挷鍥㈤珮娓呮櫘閫氳瘽鐗堢瀛愨€濓紝鈥滆繖鏄紶璇翠腑鐨勭浠欑湻渚ｅ晩鈥濓紝鈥滄儕鐖?鑼冨啺鍐拌壋鐓х湡娴佸嚭浜嗏€濈瓑绛夊井鍗氬拰绉佷俊锛屽苟鑷姩鍏虫敞涓€浣嶅悕涓篽ellosamy鐨勭敤鎴?/p>

sdfd

XSS鏀诲嚮浜嬩欢浜?/strong>

2011骞?鏈?8鏃ユ櫄锛屾柊娴井鍗氬嚭鐜颁簡涓€娆℃瘮杈冨ぇ鐨?span>XSS鏀诲嚮浜嬩欢銆傚ぇ閲忕敤鎴疯嚜鍔ㄥ彂閫佽濡?/p>

"閮編缇庝簨浠剁殑涓€浜涙湭娉ㄦ剰鍒扮殑缁嗚妭"

"寤哄厷澶т笟涓┛甯殑鍦版柟"

"璁╁コ浜哄績鍔ㄧ殑100鍙ヨ瘲姝?

"3D鑲夎挷鍥㈤珮娓呮櫘閫氳瘽鐗堢瀛?

"杩欐槸浼犺涓殑绁炰粰鐪蜂荆鍟?

"鎯婄垎!鑼冨啺鍐拌壋鐓х湡娴佸嚭浜?

绛夌瓑寰崥鍜岀淇★紝骞惰嚜鍔ㄥ叧娉ㄤ竴浣嶅悕涓?span>hellosamy鐨勭敤鎴?/p>

棣栧厛锛岄粦瀹㈤€氳繃瀵规柊娴井鍗氱殑鍒嗘瀽娴嬭瘯鍙戠幇鏂版氮鍚嶄汉鍫傞儴鍒嗙敱浜庝唬鐮佽繃婊や笉涓ワ紝瀵艰嚧XSS婕忔礊锛屽苟鍙互閫氳繃鏋勯€犺剼鏈殑鏂瑰紡妞嶅叆鎭舵剰浠ｇ爜

閫氳繃鍒嗘瀽鍙戠幇锛屽湪鏂版氮鍚嶄汉鍫傞儴鍒嗕腑锛屽綋鎻愪氦鏃讹紝鏂版氮浼氬璇ュ瓧绗︿覆杩涜澶勭悊锛岃€岀敱浜庡簲鐢ㄧ▼搴忔病鏈夊鍙傛暟g鍋氬厖瓒崇殑杩囨护锛屼笖灏嗗弬鏁板€肩洿鎺ユ樉绀哄湪椤甸潰涓紝鐩稿綋浜庡湪椤甸潰涓祵鍏ヤ簡涓€涓潵鑷簬2kt.cn鐨?span>JS鑴氭湰

璇?span>JS鑴氭湰鏄粦瀹㈠彲浠ユ帶鍒剁殑鏂囦欢锛屼娇寰楅粦瀹㈠彲浠ユ瀯閫犱换鎰?span>JS鑴氭湰宓屽叆鍒扮殑椤甸潰涓紝涓旈€氳繃AJAX鎶€鏈畬鍏ㄥ疄鐜板紓姝ユ彁浜ゆ暟鎹殑鍔熻兘锛岃繘鑰岄粦瀹㈤€氳繃鏋勯€犵壒瀹氱殑JS浠ｇ爜瀹炵幇浜嗗彈姝?span>XSS锠曡櫕鏀诲嚮鐨勫鎴疯嚜鍔ㄥ彂寰崥銆佹坊鍔犲叧娉ㄥ拰鍙戠淇＄瓑鎿嶄綔

鐒跺悗锛岄粦瀹负浜嗕娇璇?span>XSS锠曡櫕浠ｇ爜鍙互澶ц寖鍥寸殑鎰熸煋浼犳挱锛屼細閫氳繃鍙戠淇℃垨鍙戝井鍗氱殑鏂瑰紡璇辨儜鐢ㄦ埛鍘荤偣鍑诲瓨鍦ㄨ法绔欎唬鐮佺殑閾炬帴锛屽挨鍏舵槸閽堝V鏍囪璇佺殑鐢ㄦ埛锛屽洜涓烘绫荤敤鎴锋嫢鏈夊ぇ閲忕殑鍏虫敞鑰咃紝鎵€浠ュ鏋滄绫荤敤鎴蜂腑姣掞紝蹇呯劧鍙互瀹炵幇锠曡櫕鐨勫ぇ鑼冨洿銆佸揩閫熺殑浼犳挱

鏈€鍚庯紝褰撳ぇ閲忕殑鍔?span>V璁よ瘉璐︽埛鍜屽叾浠栨櫘閫氱敤鎴蜂腑姣掑悗锛岃繖浜涚敤鎴峰氨浼氶€氳繃鍙戝井鍗氬拰鍙戠淇＄殑鏂瑰紡灏嗚XSS锠曡櫕鍚戝叾浠栫敤鎴疯繘琛屼紶鎾紝杩涜€屽鑷翠簡璇?span>XSS锠曡櫕鐨勫ぇ鑼冨洿銆佸揩閫熺殑浼犳挱涓庢劅鏌?/p>

sdfd

XSS姒傝堪

XSS鍙堝彨CSS (Cross Site Script) 锛岃法绔欒剼鏈敾鍑?/p>

瀹冩寚鐨勬槸鎭舵剰鏀诲嚮鑰呭線Web椤甸潰閲屾彃鍏ユ伓鎰?span>HTML浠ｇ爜锛屽綋鐢ㄦ埛娴忚璇ラ〉闈㈡椂锛屽祵鍏?span>Web椤甸潰鐨?span>HTML浠ｇ爜浼氳鎵ц锛屼粠鑰岃揪鍒版伓鎰忕敤鎴风殑鐗规畩鐩殑

XSS灞炰簬琚姩寮忕殑鏀诲嚮锛屽洜涓哄叾琚姩涓斾笉濂藉埄鐢紝鎵€浠ヨ澶氫汉甯稿拷鐣ュ叾鍗卞鎬?/p>

鍦?span>XSS鏀诲嚮涓紝涓€鑸湁涓変釜瑙掕壊鍙備笌

鏀诲嚮鑰?/p>

鐩爣鏈嶅姟鍣?/p>

鍙楀鑰呯殑娴忚鍣?/p>

sdfd

XSS鐨勫嵄瀹?/strong>

绐佺牬鍩熼檺鍒?/p>

淇敼html浠ｇ爜

XSS锠曡櫕鏀诲嚮

鍛戒护鎵ц

鑾峰彇瀹㈡埛绔俊鎭?/p>

缁撳悎CSRF鏀诲嚮

鑾峰彇绯荤粺绠＄悊鍚庡彴鏉冮檺

鐩楀彇璐﹀彿

DDOS鏀诲嚮

鎴戜滑鍙互鏍规嵁XSS宸ュ叿鐨勭壒鎬у皢XSS鍒嗕负杩欎箞鍑犵

sdfd

鍙嶅皠鍨媂SS

<鍙嶅皠鍨媂SS>涔熺О涓?lt;闈炴寔涔呭瀷XSS>锛屽叾鐗瑰緛鏄洿鎺ュ湪URL涓緭鍏ユ伓鎰忎唬鐮?/span>

杩欑XSS鏀诲嚮鐨勯殣钄芥€ц緝宸紝涓€鑸殑娴忚鍣ㄩ兘鍙互璇嗗埆骞舵嫤鎴?/span>

sdfd

瀛樺偍鍨媂SS

<瀛樺偍鍨媂SS>涔熺О涓?lt;鎸佷箙鎬SS>锛岃繖绉嶆敾鍑荤殑鐗瑰緛鏄伓鎰忎唬鐮佹槸瀛樺偍鍦ㄦ暟鎹簱鎴栬€呮湇鍔″櫒涓?/p>

涓€鑸瓨鍌ㄥ瀷XSS鐨勯殣钄芥€ф瘮杈冮珮锛屾祻瑙堝櫒涓€鑸笉浼氬療瑙夊拰鎷︽埅锛屾墍浠ュ嵄瀹充篃鏄渶澶х殑

閭ｄ箞XSS涓€鑸細鍑虹幇鍦ㄤ粈涔堝湴鏂?

XSS鍙兘鍑虹幇鐨勫湴鏂?/strong>

涓€鑸彲浠ュ垎涓哄涓嬪嚑绉?br>

HTML鏂囨。

鍖呮嫭浜?br>

鏍囩

灞炴€?/p>

Javascript

css

鎴栬€呰繕鍙兘鍑虹幇鍦ㄤ互涓嬪湴鏂?br>

澶氬獟浣撱€佺綉椤垫彃浠?

Flash

Word

PDF

Siverlight

Applet

鐢氳嚦鍦ㄤ竴浜涘唴宓屼簡娴忚鍣ㄧ殑杞欢涓紝涔熷彲鑳戒細瀛樺湪XSS

CS瀹㈡埛绔蒋浠?

杩欓噷灏辨病鏈夊垎绫讳簡锛屽氨杩欎箞涓€绉岰S瀹㈡埛绔蒋浠讹紝鍍忓ぇ瀹剁啛鎮夌殑Steam杩欑绫诲瀷鐨勫鎴风杞欢

閭ｄ箞鎬庝箞鎸栨帢XSS婕忔礊鍛紵

sdfd

鎸栨帢XSS婕忔礊

涓€鑸寲鎺樼殑鏃跺€欒鍦ㄨ兘杈撳叆涓滆タ鐨勫湴鏂归兘杩涜XSS杈撳叆娴嬭瘯

涓€鑸父瑙佺殑濡傜暀瑷€妯″潡

濡傛灉鏄弽灏勫瀷鐨?span>XSS锛屽氨瑕佹敞鎰?span>URL涓殑鍙傛暟

鑰屽鏋滄槸瀛樺偍鍨嬬殑XSS锛屽氨璇ユ敞鎰忔枃鏈鍙婂叾浠?span class="mq-228">浠绘剰鍙互濉啓鍐呭鐨勫湴鏂?/span>

鍒嗗壊鍥緙

涓嬮潰鎴戜滑婕旂ず涓€涓嬩袱绉嶅父瑙佺殑XSS鐨勫尯鍒?/p>

sdfd

鍙嶅皠鍨媂SS绠€鍗曟紨绀?/strong>

鍋囧鎴戜滑鏈夎繖涔堜竴涓綉绔欙紝瀹冧細灏嗘垜浠殑鎼滅储鍐呭閮藉師灏佷笉鍔ㄧ殑杩斿洖鏄剧ず鍦ㄧ綉椤甸噷闈紝鎴戜滑灏卞彲浠ヤ娇鐢ㄥ弽灏勫瀷XSS鏉ユ敾鍑讳簡

杩欓噷鎴戜滑鐢?span>OWASP涓殑WebGoat鏉ユ紨绀鸿繖绉嶆敾鍑?/p>

涓婂浘鍙互鐪嬪嚭鏈変釜鎼滅储妗嗭紝鎴戜滑杈撳叆浠€涔堝氨浼氳繑鍥炰粈涔?/p>

閭ｈ繖鏍峰氨婊¤冻浜嗗弽灏勫瀷XSS鐨勭壒寰侊紝鎴戜滑鍙互杩欐牱杩涜鏀诲嚮

閭ｆ垜浠瘯璇曡緭鍏ヨ繖鍙ユ伓鎰忎唬鐮佺湅鐪?/p>

<script>alert("XSS");</script>

杩欏氨鏄竴涓畝鍗曠殑婕旂ず

sdfd

瀛樺偍鍨媂SS绠€鍗曟紨绀?/strong>

鎴戜滑鍋囪鏈夎繖涔堜竴涓綉绔欙紝鏄浜哄幓鐣欒█鐨勶紝绯荤粺浼氭妸鐣欒█瀛樺偍鍦ㄦ湇鍔″櫒涓?/p>

鎴戜滑杩樻槸鐢?span>OWASP鏉ユ紨绀?/p>

杩欓噷鏈変釜鐣欒█绯荤粺锛屾垜浠暀涓█鐪嬬湅

鎴戜滑娴嬭瘯浜嗕竴涓嬪彂鐜板彲浠ュ畬鏁寸殑鎶婃垜浠殑鐣欒█淇濈暀鍦ㄧ郴缁熶腑

浜庢槸鎴戜滑鍙互杩欐牱娴嬭瘯瀛樺偍鍨?span>XSS

杈撳叆

<script language="javascript" type="text/javascript">alert("Hatsune Say Store XSS");</script>

涔嬪悗鐣欒█

鐒跺悗鎴戜滑鐐瑰紑杩欎釜XSS鐣欒█鐨勯摼鎺?/p>

椹笂灏变細璺冲嚭涓€涓獥鍙?/p>

鐒跺悗鐜板湪杩欎袱绉?span>XSS灏卞ぇ姒傛紨绀哄埌杩欓噷

褰撶劧锛?span>XSS鏀诲嚮鍗氬ぇ绮炬繁锛岀幇瀹炰腑涓€鑸笉浼氭湁鎴戜滑涓婇潰浠嬬粛鐨勮繖涔堢畝鍗曪紝鍏朵粬杩樻湁Flash XSS锛?span>Dom XSS绛夌瓑

杩欓噷鍙槸鎶涚爾寮曠帀缁欏ぇ瀹朵竴涓XSS鐨勫垵姝ョ悊瑙

鎰熻阿鏀寔~~~

鎽告懜澶

绁濆ぇ瀹跺懆鏈剦蹇珇

鏈枃瀹?/span>

涓嬫湡鍐呭锛?span class="mq-305">CSRF璺ㄧ珯璇锋眰浼€犳紡娲?/span>