XSS测试环境（Flask实现）

最新推荐文章于 2023-07-04 02:34:53 发布

weixin_33815613

最新推荐文章于 2023-07-04 02:34:53 发布

阅读量316

点赞数

文章标签： python

原文链接：http://www.cnblogs.com/devlige/p/8433405.html

版权

文档结构：

XSS.html

 1 from flask import Flask,render_template,request
 2 from flask_wtf import FlaskForm
 3 from wtforms import StringField,SubmitField
 4 app=Flask(__name__)
 5 app.config['SECRET_KEY'] = 'hard to guess string'
 6 class InputForm(FlaskForm):
 7     string=StringField()
 8     sub=SubmitField('submit')
 9     
10 @app.route('/',methods=['GET', 'POST'])    
11 def fontPage():
12     info=InputForm()
13     if request.method=='POST':
14         string=request.form['string']
15         return render_template('show.html',string=string)
16     return render_template('form.html',info=info)
17 
18 if __name__=='__main__':
19     app.run()

form.html

 1 <!DOCTYPE html>
 2 <html lang="en">
 3 <head>
 4     <meta charset="UTF-8">
 5     <meta name="viewport" content="width=device-width, initial-scale=1.0">
 6     <meta http-equiv="X-UA-Compatible" content="ie=edge">
 7     <title>Document</title>
 8 </head>
 9 <body>
10     <form method="POST">
11         {{info.string()}}
12         {{info.sub()}}
13     </form>
14 </body>
15 </html>

show.html

 1 <!DOCTYPE html>
 2 <html lang="en">
 3 <head>
 4     <meta charset="UTF-8">
 5     <meta name="viewport" content="width=device-width, initial-scale=1.0">
 6     <meta http-equiv="X-UA-Compatible" content="ie=edge">
 7     <title>Document</title>
 8 </head>
 9 <body>
10     what you input is:
11     {{string|safe}}  <!--注意这里"|safe"关闭jinja2自动转义功能-->
12 </body>
13 </html>

测试：

1.运行：

2.输入测试脚本：

3.提交触发漏洞：

一个简单的Python实现的XSS漏洞环境就完成了！

转载于:https://www.cnblogs.com/devlige/p/8433405.html

weixin_33815613

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
XSS测试环境（Flask实现）

文档结构：XSS.html 1 from flask import Flask,render_template,request 2 from flask_wtf import FlaskForm 3 from wtforms import StringField,SubmitField 4 app=Flask(__name__) 5 app.config['SECR...
复制链接

扫一扫