FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Update 【03】XSS 漏洞原理与实际案例介绍.md · AshMOB/JavaCodeAudit@a79a7b9 · GitHub

  1. AshMOB
  2. JavaCodeAudit

Repository navigation

Commit a79a7b9

Browse files
cn-panda
committed
Update 【03】XSS 漏洞原理与实际案例介绍.md
1 parent ca75cad commit a79a7b9

1 file changed

Lines changed: 18 additions & 18 deletions

File tree

‎【03】XSS 漏洞原理与实际案例介绍/【03】XSS 漏洞原理与实际案例介绍.md‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -58,17 +58,17 @@ https://github.com/cn-panda/JavaCodeAudit
5858

5959
导入项目，可以得到以下目录
6060

61-
![image-20191211175109762](/Users/panda/Library/Application Support/typora-user-images/image-20191211175109762.png)
61+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/1.png?raw=true)
6262

6363
修改连接数据库的账号密码：
6464

6565
`MessageInfoDaoImpl.java 23 行`:
6666

67-
![image-20191211175202986](/Users/panda/Library/Application Support/typora-user-images/image-20191211175202986.png)
67+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/2.png?raw=true)
6868

6969
`MessageInfoDaoImpl.java 69 行`:
7070

71-
![image-20191211175247716](/Users/panda/Library/Application Support/typora-user-images/image-20191211175247716.png)
71+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/3.png?raw=true)
7272

7373

7474

@@ -103,15 +103,15 @@ public void Message(HttpServletRequest req, HttpServletResponse resp) {
103103

104104
如下图所示，是上述代码的功能界面：
105105

106-
![image-20191211201657650](/Users/panda/Library/Application Support/typora-user-images/image-20191211201657650.png)
106+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/4.png?raw=true)
107107

108108
当我们输入正常字符的时候，返回我们刚才输入的字符：
109109

110-
![image-20191211201751498](/Users/panda/Library/Application Support/typora-user-images/image-20191211201751498.png)
110+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/5.png?raw=true)
111111

112112
但是如果我们输入的内容中含有可执行代码，如：`<script>alert('xss')</script>`
113113

114-
![image-20191211201856050](/Users/panda/Library/Application Support/typora-user-images/image-20191211201856050.png)
114+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/6.png?raw=true)
115115

116116
浏览器就会执行这段 js代码，所以我们只要控制输入的内容，就可以达到攻击效果。
117117

@@ -236,17 +236,17 @@ try {
236236

237237
如下图，我们提交含有可执行代码的数据：
238238

239-
![image-20191211205121835](/Users/panda/Library/Application Support/typora-user-images/image-20191211205121835.png)
239+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/7.png?raw=true)
240240

241241
然后在输出页面查看：
242242

243-
![image-20191211205207586](/Users/panda/Library/Application Support/typora-user-images/image-20191211205207586.png)
243+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/8.png?raw=true)
244244

245245
成功执行 XSS，且点击确定后，返回原本页面，再次刷新
246246

247-
![image-20191211205336068](/Users/panda/Library/Application Support/typora-user-images/image-20191211205336068.png)
247+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/9.png?raw=true)
248248

249-
![image-20191211205354207](/Users/panda/Library/Application Support/typora-user-images/image-20191211205354207.png)
249+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/10.png?raw=true)
250250

251251
依旧会执行插入数据中的 XSS 可执行代码，这也是和反射型 XSS 最大的区别。
252252

@@ -511,7 +511,7 @@ JEESNS是一款基于JAVA企业级平台研发的社交管理系统，在JEESNS
511511

512512
导入后软件会自动下载需要的 jar 包：
513513

514-
![11](/Users/panda/GitHub/JavaCodeAudit/【03】XSS 漏洞原理与实际案例介绍/img/11.png)
514+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/11.png?raw=true)
515515

516516
等待几分钟后即可下载完毕。然后在本地创建数据库：
517517

@@ -531,7 +531,7 @@ source /Users/panda/Downloads/jeesns-master_v1.3/jeesns-web/database/jeesns.sql
531531
Cause: org.springframework.jdbc.CannotGetJdbcConnectionException: Could not get JDBC Connection; nested exception is java.sql.SQLException: Connections could not be acquired from the underlying database!
532532
```
533533

534-
![12](/Users/panda/GitHub/JavaCodeAudit/【03】XSS 漏洞原理与实际案例介绍/img/12.png)
534+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/12.png?raw=true)
535535

536536
需要在`jeesns-web/pom.xml`文件添加以下内容：
537537

@@ -547,25 +547,25 @@ Cause: org.springframework.jdbc.CannotGetJdbcConnectionException: Could not get
547547

548548
如下图所示：
549549

550-
![image-20191212115736981](/Users/panda/Library/Application Support/typora-user-images/image-20191212115736981.png)
550+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/13.png?raw=true)
551551

552552
修改好保存后，配置 tomcat 服务，点击 run-->edit configurations，配置如下：
553553

554554
server 选项默认即可：
555555

556-
![image-20191212122207859](/Users/panda/Library/Application Support/typora-user-images/image-20191212122207859.png)
556+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/14.png?raw=true)
557557

558558
Deployment 选项中，导入 war 包，点击+号，选择Artifact...，然后选择第一个 war：
559559

560560
![image-20191212121900022](/Users/panda/Library/Application Support/typora-user-images/image-20191212121900022.png)
561561

562562
点击 OK 后可以修改路径：
563563

564-
![image-20191212122243095](/Users/panda/Library/Application Support/typora-user-images/image-20191212122243095.png)
564+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/16.png?raw=true)
565565

566566
点击应用后，即可运行本项目，如下图所示：
567567

568-
![image-20191212122401816](/Users/panda/Library/Application Support/typora-user-images/image-20191212122401816.png)
568+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/17.png?raw=true)
569569

570570

571571

@@ -683,7 +683,7 @@ public boolean save(HttpServletRequest request, Member loginMember, String conte
683683
<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">
684684
```
685685

686-
![image-20191212132148810](/Users/panda/Library/Application Support/typora-user-images/image-20191212132148810.png)
686+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/18.png?raw=true)
687687

688688
还比如：
689689

@@ -693,7 +693,7 @@ public boolean save(HttpServletRequest request, Member loginMember, String conte
693693
<img src="x" ONERROR=confirm(0)>
694694
```
695695

696-
![image-20191212132523550](/Users/panda/Library/Application Support/typora-user-images/image-20191212132523550.png)
696+
![1](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9003%E3%80%91XSS%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/19.png?raw=true)
697697

698698
### 4、修复方案
699699

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL