Use XSS to destroy Web (1)

Bkjia.com expert article]This article is intended for those who do not take XSS as a serious Web application vulnerability. In fact, people can exploit the XSS vulnerability to make a profit. This article is published on websites that love hacking technology but never attack others. Therefore, I will not take any responsibility for the usage of the knowledge introduced here.

I. Introduction

Recently, I am very interested in XSS, so I decided to write an article to introduce in detail how to inject a Javascript key recorder. Of course, people can use the knowledge introduced in this article to perform XSS intrusion filtering, you can also use the Javascript key recorder introduced here to steal user names, passwords, and user certificates. Even if you are not a Javascript expert, you can write effective malicious Javascript code, as long as you know the web better. In the subsequent sections of this article, I will provide readers with two Javascript key recorders of the same nature but different styles.

To read this article, you must have the following knowledge:

⒈ How to write Html web forms.

Compile How to Write Javascript DOM objects.

3. Understand the basic functions of Http.

4. Understand Javascript camouflage technology.

Xiaoming was informed of the usage of Burp Suite1.1.

2. Our XSS Functions

Before exploiting the XSS vulnerability, we must know what functions the XSS exploitation should have. That is to say, we need to clarify the target of XSS attacks, such as destroying a website, redirecting users or stealing User Certificates (this is what we are most interested in !!). In this article, we aim to create an XSS with the key recorder function. Therefore, we must examine the login form from the user's perspective, for example, what is the average length of the user name and password? What is the average typing speed of a user? Such information can be used in the creation of Javascript key recorders that can run on IE, Firefox, Opera, and NetScape browsers. Of course, we will use different styles to implement this key recorder. Our programs can steal user authentication information, or rely only on timing (for example, automatically run after a period of time) or only on password length (for example, automatically run after the user typed 5 characters) or based on the timing and password length (for example, you may perform a certain character step, such as checking whether to press the Enter or Tab key ).

Iii. How fast is the typing speed?

Why should we consider this? Because our key recorder must be more effective. To measure the typing speed per minute, a word is normalized to 5 characters or 5 buttons. A Study of normal computer users shows that the average input speed during transcription is 33 words per minute, and only 19 words per minute during writing. [8] a similar research was conducted, which divided everyone into three groups: "fast", "medium", and "slow, their average rates are 40wpm (wpm is the number of words per minute), 35wpm, and 23wpm. For the users who practice the two things, they can reach 37wpm by memorizing the input text, and the input speed is 27wpm.

On average, typists can reach 50-70 WPM, while some jobs require 80-95wpm (which is usually the slowest requirement for quick jobs and other entry industries), and some sophisticated typists are faster than 120wpm.

The input speed can reach 15wpm by using an interface tailored to the individual, such as an adaptation software developed by Stephenson hawking, a physically paralyzed physicist with electrical keys and Walt Woltosz. Due. Due to his slow operation, its input interface was later upgraded to an infrared camera for eye detection. Of course, we have nowhere to know the actual wpm.