XSS Cross-site scripting test

The test will involve the XSS test, the following summary of the knowledge of XSS

XSS Cross-site scripting feature is the ability to inject malicious HTML/JS code into the user's browser, hijacking user sessions

Common alert to verify that a Web site has a vulnerability

If a vulnerability is identified, it can be compromised as the injected content is different

<script>alert ("XSS test");</script>

For example: stealing cookies, web-linked horses, malicious operations, cross-site worms, etc.

Classification:

Reflective type: Non-persistent, usually a URL, requires the user to click, in the URL parameter passed in

Persistent: Often in comments and other interactions, common in <textarea> this label, can be used for hanging horse fishing penetration, etc.

Simple excavation:

Reflective type:

1. Verify that the website is filtering <>, enter TEST<TESTXSS> in the input box, and then submit only test after submission, stating that <> may be filtered

This time need to further verify, view the site source files, search Testxss, if searchable, it means that <> can be written

2. Then enter <script>alert ("XSS test");</script> is one of the simplest reflective XSS attacks

Persistent Type:

1. After you enter <script>alert ("XSS test");</script> in the comment box, you find that the statement is not filtered

And will be fully displayed by the browser, after analysis is not embedded in <textarea>

So it is possible to first label the closure, for example </textarea><script>alert ("XSS test");</script><textarea>

This attack is more serious, if the review requires a background administrator to audit, with other XSS statements can cause greater harm

It can be seen that, in order to prevent XSS, character filtering is less harmful to attack, but XSS attacks are more than that simple,

It can also bypass XSS filtering on the server!!! Cond

PS: Common list of XSS attack statements

Https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet English

http://drops.wooyun.org/tips/1955 Chinese

XSS Cross-site scripting test