|
|
) H& w0 V9 i" @! o6 ?( R( x
<p>当网站过滤了大部分的HTML标签和属性,我们就尝试爆破一下,看哪些标签和属性没有没过滤。</p>2 A0 V7 i( d8 o. f4 B; G9 H( X
<h2>爆破的步骤:</h2>8 R" H" j Z: |9 \8 q
<p> 1. 首先在测试点输入我们正常的exp,并抓包发送到Intruder模块。</p> i) H. M7 |! V% D0 @
<p><img src="https://img2022.cnblogs.com/blog/2742124/202202/2742124-20220211213553022-1529348382.png" ></p>
6 L! _% }3 Z, q<p> 2. 将exp改为 <§§> ,以创建有效载荷位置。</p>9 ~. L( {/ @ {
<p><img src="https://img2022.cnblogs.com/blog/2742124/202202/2742124-20220211213706671-202348246.png" ></p>
, |2 l p# M, D/ M<p> 3. 在xss备忘单中点击:Copy tags to clipboard,点击Paste粘贴到Intruder的payload位置。</p>
* O8 e+ C. N% K9 \5 ~, a9 X<p> https://portswigger.net/web-security/cross-site-scripting/cheat-sheet</p>
3 [. M6 X# C6 G! w9 f u<p><img src="https://img2022.cnblogs.com/blog/2742124/202202/2742124-20220211213910208-9621953.png" ></p>
8 e3 b2 t7 [% @% U M& b<p> 4. 进行爆破。发现body标签没有被过滤。</p>2 q1 ^: M- q) o+ w H3 v/ ?4 e
<p><img src="https://img2022.cnblogs.com/blog/2742124/202202/2742124-20220211214019819-944940889.png" ></p>0 Q, Q' Q, X) `$ r8 D
<p> 5. 将有效载荷设置为:<body%20§§=1></p>' m6 ?, M v. Z: P
<p><img src="https://img2022.cnblogs.com/blog/2742124/202202/2742124-20220211214230292-1546309510.png" ></p>" R+ H' w/ K( M: e
<p> 6. 在xss备忘单中点击:将事件复制到粘贴板,点击Paste粘贴到Intruder的payload位置。</p>$ q" _5 h6 A, I: y0 P2 j" u6 ]
<p><img src="https://img2022.cnblogs.com/blog/2742124/202202/2742124-20220211214535613-35221747.png" ></p>
+ o8 o6 g0 O9 [<p> 7. 进行攻击。发现onresize属性没有被过滤。</p>; r6 ^( b, \# }7 R
<p><img src="https://img2022.cnblogs.com/blog/2742124/202202/2742124-20220211215313601-1834234454.png" ></p>
3 G$ R X/ K) T1 _<p> 8. 构造payload,在测试位置输入,并用F12打开调试窗口时,就会弹窗。</p># G8 O" b' `1 ?
<p> 因为onresize属性就是窗口或框架被调整大小时触发。</p>5 n. b7 K1 W( q' b2 @! g
<div class="cnblogs_code">
* h. s, D( y9 q7 @<pre><body onresize=alert(3)></pre>
7 J! T9 [ }# W6 @</div>3 t7 `8 M( A. z0 {( ]2 S+ s! l
<p><img src="https://img2022.cnblogs.com/blog/2742124/202202/2742124-20220211220602121-1842422690.png" ></p>
: p6 ~: W- g( U- Y<p> </p>/ t3 j0 ~$ w: g; N) i; G# [; D
|
|