Dangers: security risks caused by HTML tags

WWW is one of the most important services on the Internet. It provides a variety of information resources to the customer. An important thing to organize such information resources is HTML hypertext language, after the development of the application, other tags such as UBB appear, but the htmlCode. After research, it is found that even the most secure code (which has already ruled out the common XSS vulnerability) cannot avoid another annoying attack method.ProgramWhich may be exploited to generate greater threats. We are now widely used in forums,ArticleThe [img] tag in the system, blog system, and other script programs is the converted tag to illustrate this neglected security problem! First, let's talk about the process of processing the label and the browser. First look at the following UBB code: [img] http://www.5217.cn/loveshell.jpg [/img], and then through the conversion of the script program into the . label This function is used to embed an image into the current page. The current Forum program has this function in posting and personal portraits. When the browser encounters This html tag, it will follow the SRC location Address. Here is the region, This image is displayed in the browser. If the resource cannot be found, a Red Cross is displayed, indicating that an error has occurred. Http://www.5217.cn/loveshell.jpgis a normal figure. Slice, so everything goes smoothly, but I don't know if you have thought about it. If this resource is another type of resource, such as a webpage, an EXE file, or an ASP page, what will happen if it is not an image file? Obviously, the answer is that the image shows a red X, our EXE file is not downloaded, And the HTML page is not executed. This is a matter of course, because IE or other browsers will parse the obtained resources as images, errors will be generated and red X will be displayed. This may be useless, but if we change the image address Http: // 127.0.0.1: 88/imgtest/test. asp? What is the form of user = shell? Test. asp contains the following content: <% Dim FSO, file // defines the FSO object Const forreading = 1, forwriting = 2, forappending = 8 Set FSO = server. Createobject ("scripting. FileSystemObject ") Path = server. mappath ("imgtest.txt") // open the same directory imgtest.txt Set file = FSO. opentextfile (path, forappending, true) File. Write ("someone:") // write content File. Write (request. servervariables ("QUERY_STRING ")) File. Write vbcrlf File. Close Set file = nothing Set FSO = nothing %> You can test and see that our access is recorded and even the submitted parameters are obtained. However, this is unknown for the browser, because we only see a red X. Here we may know what we can do with this thing! It is very important that you can access a page as a viewer, or even support get parameter requests. After understanding this, you can use our imagination to make use of it! 1. fl traffic: We can set our images to be fl pages in a forum with high traffic. Then, every viewer will access our pages, whether or not he sees them, but he accessed it, didn't he? 2. Destruction: This is annoying. If you set your image to logout in a dynamic network forum. if ASP is used, all the people who have read your post will be rejected! As for the phantom forum, you can try it, but it is very immoral! 3. Hackers: This is what we are most interested in. We can do some things across permissions, because many programs are very good at front-end defense, but the background is not so strict. If the program uses the request ("ID") method to retrieve data, we can use the tag to submit data to the CGI script. Note that the request must not be used. form ("username2") strictly specifies the way to obtain the variable source, because our variables can only be submitted through URL, that is, the QUERY_STRING method described above. This is fatal for programs with less rigorous writing. For example, the mobile network is a request. The method for retrieving data in messages. asp in the mobile SQL version background is request. The Code is as follows: ...... Sub del () Dim dnum If request ("username") = "" then Body = body + "<br>" + "Enter the username to be deleted in batches. " Exit sub End if SQL = "select count (*) from dv_message where sender = '" & request ("username ")&"'" Set rs = dvbbs. Execute (SQL) ...... This is a background that must have the background management permission to access, but we construct such a URL: Http://bbs.dvbbs.net/admin/messages.asp? Action = del & User = & #39 ;; update/**/dv_user/**/set/**/useremail = (select/**/top/**/1 /**/ [Username]/**/from/**/dv_admin)/**/where [username] = 'loveeshangel ';-- Or a similar statement, and put it in the [img] label. You may feel that the postmaster is unlikely to view his post, but you need to know that the Forum text message supports the same [img] label as the post, so if you can send a text message to the Postmaster, construct Our IMG tag in it as long as he opens the text message! If it can be connected with social engineering, the murder will not be infected with blood, huh, huh! Unfortunately, it seems that the mobile network has converted the & and other symbols, so you can try to break through them. What's more, there are tens of millions of programs that are not strictly written on the network. 4. It's so hard for everyone to make money. If you change the address in the IMG tag to an attachment, you can just say it without testing. 5 ...... Let's talk about how to defend against this problem. If you want to keep this [img] label but don't want any problems, you need to convert it. For example, the suffix must be JPG, haha, this can be done through URL encoding plus # JPG. Anyway, I think it can be done if there are restrictions. Even if you have restricted IMG, well, there are flash labels, what about the RM tag ?...... Defense and utilization are both difficult.