Walks

网络安全爱好者

XSS笔记

XSS~TOP10大漏洞常驻成员,危害有多大我就不必多加强调了。

既然这么大的危害,那我们做个一个新世纪的少年肯定要对其有所了解。

          那什么是XSS?

借用百度百科上的解释

XSS~跨站脚本攻击(Cross Site Scripting),为不和层叠样式表(Cascading Style Sheets, CSS)的缩写混淆,故将跨站脚本攻击缩写为XSS。恶意攻击者往Web页面里插入恶意Script代码,当用户浏览该页之时,嵌入其中Web里面的Script代码会被执行,从而达到恶意攻击用户的目的。

自己对其的理解:就是往WEB网页中写入JS语言,从而利用JS来达到自己的目的。当浏览器解析HTML代码的时候,是不会自己识别里面的内容是好还是坏的,所以当我们绕过了WEB端的防御,就可以成为一个XSS漏洞。

           那XSS漏洞分为几种?

XSS漏洞分为三种,分别为:

1:反射型

输入的数据-》经过后端-》返回到浏览器-》浏览器解析

缺点就是利用较为困难,但还是可以用来钓鱼等利用的。

2:存储型

输入的数据-》经过后端-》存储到数据库-》返回到浏览器-》浏览器解析

博客上面的留言就是存储型,每当我们打开一个留言板的时候,都可以看到一些人写的留言,这些留言是存储到数据库一直存在的。

3:基于DOM类型(Document Object Model,文档对象模型)

客户端的脚本程序可以通过DOM来动态修改页面内容,从客户端获取DOM中的数据并在本地执行。基于这个特性,就可以利用JS脚本来实现XSS漏洞的利用。

          XSS能用来干什么?

就这样说吧,JS能做的XSS都能做。

最老生常谈的,莫过于盗取COOKIE,当然在如今HTTP ONLY的时代盗取COOKIE也只能在一些小站点上使用了。

XSS是很强大的,下面列出一些XSS能做什么:

1:DDOS(分布式拒绝服务攻击指借助于客户/服务器技术,将多个计算机联合起来作为攻击平台,对一个或多个目标发动DDoS攻击,从而成倍地提高拒绝服务攻击的威力。)

2:XSS钓鱼

3:获取用户系统信息

4:XSS Worm

等等     上面也说过,JS能做的,XSS都可以做。


上面,我们已经对XSS有了一个初步的了解,下面将要对XSS的绕过与防御来叙说一下。

既然有XSS这门攻击方法,那么防御也是必然的。

      在XSS的防御中,就是对输入过滤,对输出也同样过滤

    那么有下面的一些方法

  PHP直接输出html的,可以采用以下的方法进行过滤

  •      PHP直接输出html的,可以采用以下的方法进行过滤:
         1.htmlspecialchars函数
         2.htmlentities函数
         3.HTMLPurifier.auto.php插件
         4.RemoveXss函数(百度可以查到)
  •      PHP输出到JS代码中,或者开发Json API的,则需要前端在JS中进行过滤:
         1.尽量使用innerText(IE)和textContent(Firefox),也就是jQuery的text()来输出文本内容
         2.必须要用innerHTML等等函数,则需要做类似php的htmlspecialchars的过滤(参照@eechen的答案)
       
  •      其它的通用的补充性防御手段
         1.在输出html时,加上Content Security Policy的Http Header
        (作用:可以防止页面被XSS攻击时,嵌入第三方的脚本文件等)
        (缺陷:IE或低版本的浏览器可能不支持)
         2.在设置Cookie时,加上HttpOnly参数
        (作用:可以防止页面被XSS攻击时,Cookie信息被盗取,可兼容至IE6)
        (缺陷:网站本身的JS代码也无法操作Cookie,而且作用有限,只能保证Cookie的安全)
         3.在开发API时,检验请求的Referer参数
        (作用:可以在一定程度上防止CSRF攻击)
        (缺陷:IE或低版本的浏览器中,Referer参数可以被伪造)

这是对网上一篇文章的转载,原文地址:https://segmentfault.com/q/1010000004067521

说了防御,那么肯定也要谈谈绕过的方法了

       下面谈谈 XSS绕过

绕过的方法总结起来很麻烦,但有个几种类型。

 1:大小写绕过(利用了正则的完全匹配)

     2:编码绕过

     3:闭合标签等

     真的有点麻烦,我也就不重复造轮子了,下面给大家一个绕过总结的很好的网页,大家自己看看

XSS绕过文章地址:http://blog.csdn.net/qq_29277155/article/details/51320064

防止文章失效转载到了本博客,本博客XSS绕过文章地址:http://www.bywalks.com/89.html

 

点赞
  1. hyperdunks说道:

    My spouse and i were absolutely fulfilled when Jordan managed to round up his investigation because of the precious recommendations he received while using the weblog. It is now and again perplexing to simply happen to be offering secrets and techniques which usually people may have been making money from. We do understand we now have the website owner to appreciate because of that. The type of illustrations you have made, the simple blog navigation, the friendships your site assist to foster - it's got mostly great, and it's facilitating our son and the family imagine that that theme is cool, and that is particularly important. Thank you for everything!

  2. yeezy boost 350说道:

    I as well as my guys were actually following the best tactics from the blog and then came up with a terrible suspicion I had not expressed respect to the site owner for those tips. All of the women ended up as a result joyful to see all of them and already have truly been loving them. Thank you for really being very kind and for settling on certain marvelous tips most people are really needing to discover. My personal honest apologies for not expressing appreciation to you earlier.

  3. jordan 6说道:

    I in addition to my friends were looking at the nice items located on the website and so suddenly I got a terrible feeling I never thanked the website owner for those tips. My men appeared to be certainly very interested to learn them and have definitely been loving these things. Thank you for being quite accommodating and also for finding certain good things millions of individuals are really desperate to discover. My very own sincere regret for not saying thanks to earlier.

  4. jordan 12说道:

    My spouse and i ended up being really more than happy that Louis could carry out his homework through the entire precious recommendations he discovered through the web site. It's not at all simplistic to simply always be freely giving tips and tricks which some people may have been selling. We already know we have got the writer to give thanks to because of that. The type of illustrations you have made, the straightforward web site navigation, the friendships your site assist to instill - it is everything amazing, and it's assisting our son and us do think that matter is fun, and that is tremendously essential. Thanks for everything!

  5. bape hoodie说道:

    I have to express appreciation to this writer for rescuing me from this circumstance. Because of looking throughout the world-wide-web and getting recommendations which are not beneficial, I thought my life was over. Being alive without the approaches to the issues you've solved through this article is a crucial case, and those which may have badly affected my career if I hadn't noticed your blog post. Your actual natural talent and kindness in touching all the details was very useful. I'm not sure what I would have done if I had not come upon such a solution like this. I can at this point look forward to my future. Thanks so much for the impressive and amazing guide. I will not think twice to refer your web page to any individual who needs to have support on this topic.

  6. yeezy boost说道:

    I precisely needed to thank you so much again. I am not sure the things I could possibly have accomplished in the absence of the thoughts documented by you over such a theme. This was a very challenging dilemma in my circumstances, nevertheless viewing the well-written manner you dealt with that made me to cry over joy. Now i am grateful for the information and in addition have high hopes you recognize what an amazing job your are providing instructing the mediocre ones via your website. I'm certain you've never got to know any of us.

  7. Thanks a lot for giving everyone an exceptionally marvellous opportunity to check tips from this blog. It's always so excellent and stuffed with a great time for me and my office acquaintances to search your website on the least three times in one week to study the fresh things you have got. Not to mention, I'm certainly pleased with the unbelievable methods you give. Certain two points in this posting are truly the simplest we have all had.

  8. pandora charms说道:

    I not to mention my buddies were actually analyzing the great advice located on your web site and so quickly I got a horrible feeling I never expressed respect to the blog owner for those strategies. The guys came as a result passionate to study them and have in effect definitely been enjoying those things. We appreciate you turning out to be indeed thoughtful and then for deciding on certain magnificent subject areas millions of individuals are really desirous to discover. My very own honest regret for not saying thanks to sooner.

  9. yeezy boost说道:

    My husband and i felt very peaceful that Emmanuel could round up his basic research through the precious recommendations he acquired out of the web page. It's not at all simplistic to simply choose to be giving freely guidance that many most people might have been selling. We do understand we need the blog owner to thank for that. The type of explanations you made, the simple blog navigation, the relationships you will help to promote - it's mostly astounding, and it is assisting our son in addition to the family do think the article is enjoyable, and that is seriously important. Thanks for the whole lot!

  10. yeezy说道:

    Thanks so much for giving everyone remarkably splendid possiblity to read articles and blog posts from here. It's usually very pleasant and also full of a great time for me and my office colleagues to visit the blog on the least three times a week to read the fresh secrets you will have. And indeed, I'm so actually satisfied concerning the tremendous tips you give. Selected 3 areas on this page are in fact the most suitable we have all ever had.

  11. hermes belt说道:

    I enjoy you because of all your valuable effort on this blog. My daughter delights in conducting investigation and it's really simple to grasp why. My partner and i learn all regarding the compelling method you render simple tactics on this web site and even recommend contribution from others on that subject then our own girl has been becoming educated a great deal. Take advantage of the remaining portion of the year. Your conducting a really good job.

  12. adidas superstar说道:

    Thank you so much for providing individuals with such a memorable chance to read critical reviews from this site. It's always so nice and stuffed with amusement for me and my office peers to visit your site a minimum of thrice in one week to see the new items you will have. And indeed, I am certainly impressed considering the good opinions served by you. Some 2 areas in this article are basically the most suitable we have all ever had.

  13. yeezy boost 350说道:

    I'm just writing to make you understand of the excellent experience my wife's princess undergone checking your webblog. She came to find such a lot of issues, most notably how it is like to have a very effective coaching nature to let a number of people really easily understand a variety of tricky matters. You actually surpassed our own expectations. Many thanks for coming up with such warm and friendly, safe, revealing not to mention easy tips on that topic to Emily.

  14. nike air max 90说道:

    I and my guys were looking through the excellent key points found on your web site while at once I got a horrible feeling I never thanked the site owner for those strategies. Those women are already consequently stimulated to read all of them and have in effect in actuality been using those things. Thanks for getting simply considerate and also for making a decision on this form of fabulous subject areas millions of individuals are really desperate to be aware of. My personal honest apologies for not saying thanks to you earlier.

  15. jordan shoes说道:

    Thanks for all of your work on this blog. Kate takes pleasure in making time for research and it's really easy to see why. We all hear all concerning the powerful mode you create very important guidance by means of your blog and as well cause response from visitors about this topic and my daughter is really learning a lot of things. Take advantage of the remaining portion of the year. You are performing a superb job.

  16. adidas nmd r1说道:

    My husband and i have been so fulfilled that Edward could conclude his web research while using the precious recommendations he had through the web page. It's not at all simplistic to just possibly be giving for free helpful hints which some other people may have been trying to sell. Therefore we keep in mind we have the writer to thank for this. The main explanations you have made, the straightforward website navigation, the relationships your site help to foster - it's most amazing, and it's really helping our son in addition to the family reckon that that concept is cool, which is certainly seriously serious. Thank you for the whole thing!

  17. ferragamo sale说道:

    I simply wanted to send a brief message so as to say thanks to you for these splendid guides you are giving out on this website. My prolonged internet lookup has now been rewarded with good quality know-how to share with my friends and classmates. I would point out that many of us readers are unequivocally fortunate to dwell in a very good network with so many outstanding people with valuable tips. I feel truly blessed to have seen your webpage and look forward to so many more cool times reading here. Thanks again for everything.

  18. I must express some thanks to the writer just for bailing me out of this particular problem. Just after looking throughout the search engines and coming across ways that were not beneficial, I thought my entire life was well over. Existing devoid of the solutions to the difficulties you have sorted out by means of your posting is a critical case, and those which could have adversely damaged my entire career if I hadn't encountered the blog. Your personal competence and kindness in handling all things was very helpful. I am not sure what I would have done if I hadn't come across such a subject like this. I am able to at this moment relish my future. Thanks for your time very much for this skilled and result oriented help. I will not hesitate to refer the website to any individual who needs guide on this problem.

  19. offwhite说道:

    Thanks so much for giving everyone an extremely pleasant opportunity to read in detail from this website. It's usually very superb and full of a great time for me personally and my office mates to search your blog not less than 3 times every week to find out the newest guidance you have got. And of course, I am just actually amazed with all the amazing information you give. Certain 1 tips in this post are really the most effective I've ever had.

  20. yeezy shoes说道:

    My husband and i have been relieved when Chris could finish up his basic research from your precious recommendations he had from your very own site. It's not at all simplistic to simply be handing out tricks that many others could have been trying to sell. So we do understand we've got the blog owner to thank for this. Those explanations you made, the simple blog menu, the friendships you help promote - it's mostly fabulous, and it is assisting our son in addition to the family understand the theme is satisfying, and that is extremely essential. Thanks for everything!

  21. converse outlet说道:

    I precisely wished to appreciate you all over again. I am not sure what I could possibly have carried out in the absence of the secrets contributed by you on that concern. It previously was a very distressing situation in my circumstances, nevertheless taking note of a new well-written manner you solved the issue forced me to weep for joy. I will be happy for this support and hope you realize what an amazing job that you are accomplishing instructing the others thru your web page. I am sure you've never encountered any of us.

  22. kd shoes说道:

    A lot of thanks for all your hard work on this website. Betty delights in going through internet research and it's really obvious why. All of us learn all relating to the dynamic tactic you give very important tactics via this web blog and as well as improve response from visitors on that idea so our girl has always been understanding a lot. Have fun with the remaining portion of the year. You are always doing a brilliant job.

  23. I just wanted to compose a simple message to thank you for the nice tips and hints you are showing here. My extended internet lookup has at the end of the day been recognized with really good details to exchange with my company. I would express that most of us website visitors are rather fortunate to exist in a fine site with very many wonderful people with great hints. I feel extremely fortunate to have discovered your website and look forward to some more enjoyable moments reading here. Thank you once again for everything.

  24. I want to get across my love for your kindness in support of individuals who must have guidance on this one topic. Your personal commitment to getting the solution around appears to be quite useful and have all the time made employees like me to reach their ambitions. This valuable report entails a great deal a person like me and far more to my peers. Many thanks; from each one of us.

发表评论

电子邮件地址不会被公开。 必填项已用*标注