webgoat-Cross Site Scripting XSS 跨站脚本攻击

本文介绍: 本节课讲述了什么是XSS，并使用XSS执行那些非开发者本意的任务。

本节课讲述了什么是XSS，并使用XSS执行那些非开发者本意的任务。

了解什么是XSS，XSS如何工作？
学习反射型XSS及注入，基于DOM的XSS注入

Cross-Site Sc riptin g也叫XSS是一种漏洞，允许将未经编码或者过滤的HTML或者script 标签作为输入渲染至浏览器。

XSS是最流行和有害的web 应用安全问题，尽管对于这种攻击有简单而知名的防护，但是仍然有很多XSS攻击问题。

Especi ally as ‘Rich Internet Applications’ a re more and more com m onplace, privileged function calls linked to via JavaSc ript may be com promise d. And if not adequately protected, sensitive data (such as your authentication cookies) can be stolen and used for some one else’s purpose.

随着富internet应用越来越普遍，如果没有充足的保护，敏感数据如认证 cookie可能被窃取，并被利用。

routes: {
            'welcome': 'welcomeRoute',
            'lesson/:name': 'lessonRoute',
            'lesson/:name/:pageNum': 'lessonPageRoute',
            'test/:param': 'testRoute',
            'reportCard': 'reportCard'
        }

testRoute: function (param) {
    this.lessonController.testHandler(param);
    // this.menuController.updateMenu(name);
}

this.testHandler = function(param) {
    console.log('test handler');
    this.lessonContentView.showTestParam(param);
};

/* 测试 */
showTestParam: function (param) {
    this.$el.find('.lesson-content').html('test:' + param);
}

<html>
   <body>
      <form action = "main.jsp" method = "POST">
         First Name: <input type = "text" name = "first_name">
         <br />
         Last Name: <input type = "text" name = "last_name" />
         <input type = "submit" value = "Submit" />
      </form>
   </body>
</html>

<html>

<head>
    <title>Using GET and POST Method to Read Form Data</title>
</head>

<body>
    <h1>Using POST Method to Read Form Data</h1>
    <table>
        <tbody>
            <tr>
                <td><b>First Name:</b></td>
                <td><%= request.getParameter("first_name")%></td>
            </tr>
            <tr>
                <td><b>Last Name:</b></td>
                <td>
                    <%= request.getParameter("last_name")%>
                </td>
            </tr>
        </tbody>
    </table>
</body>

</html>

http://hostname.com/mywebapp/main.jsp?first_name=John&last_name=Smith

http://hostname.com/mywebapp/main.jsp?first_name=<script>alert("XSS Test")</script>


<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %>
<html>
<head>
    <title>Using GET and POST Method to Read Form Data</title>
</head>
<body>
    <h1>Using POST Method to Read Form Data</h1>
    <table>
        <tbody>
            <tr>
                <td><b>First Name:</b></td>
                <td>${e:forHtml(param.first_name)}</td>
            </tr>
            <tr>
                <td><b>Last Name:</b></td>
                <td>${e:forHtml(param.last_name)}</td>
            </tr>
        </tbody>
    </table>
</body>
</html>

<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %>：这一行引入了一个JSP标签库，其前缀为”e”，URI为”https://www.owasp.org/index.php/OWASP_Java_Encoder_Project”。这个标签库用于对输入进行编码，以防止XSS（跨站脚本）攻击。

${e:forHtml(param.first_name)} 和 ${e:forHtml(param.last_name)}：这些是JSTL（JSP Standard Tag Library）中的表达式，用于从请求参数中获取“first_name”和”last_name”的值，并使用前面引入的OWASP Java Encoder标签库对它们进行编码，以防止XSS攻击。然后，这些编码后的值将被插入到HTML表格中。

public class MyCommentDAO {

    public static void addComment(int threadID, int userID, String newComment) {

                String sql = "INSERT INTO COMMENTS(THREADID, USERID, COMMENT) VALUES(?,?,?);";

                try {
                        PreparedStatement stmt = connection.prepareStatement(sql);

                        stmt.setInt(1, threadID);
                        stmt.setInt(2, userID);
                        stmt.setString(3, newComment);

                        stmt.executeUpdate();
                } catch (SQLException e) {
                        e.printStackTrace();
                }
        }
}

import org.owasp.validator.html.*;
import MyCommentDAO;

public class AntiSamyController {
    ...
    public void saveNewComment(int threadID, int userID, String newComment){
        MyCommentDAO.addComment(threadID, userID, newComment);
    }
    ...
}

import org.owasp.validator.html.*;
import MyCommentDAO;

public class AntiSamyController {
    public void saveNewComment(int threadID, int userID, String newComment){
        Policy policy = Policy.getInstance("antisamy-slashdot.xml");
        AntiSamy as = new AntiSamy();
        CleanResults cr = as.scan(newComment, policy);
        MyCommentDAO.addComment(threadID, userID, cr.getCleanHTML());
    }
}

显示所有内容

声明：本站所有文章，如无特殊说明或标注，均为本站原创发布。任何个人或组织，在未征得本站同意时，禁止复制、盗用、采集、发布本站内容到任何网站、书籍等各类媒体平台。如若本站内容侵犯了原著者的合法权益，可联系我们进行处理。

Char	Escape string
<	&lt;
>	&gt;
“	&quot;
‘	'
&	&
/	/

01

目标

02

What is XSS?

Cross-Site Scripting (XSS) is the most prevalent and pernicious web application security issue

XSS has significant impact

例子s:

Try It! Using Chrome or Firefox

03

Most common locations XSS漏洞常出现的地方

04

Why should we care?

XSS attacks may result in

XSS 攻击导致网络钓鱼

05

XSS类型

Reflected反射型

DOM-based (also technically reflected)基于DOM的XSS

Stored or persistent 存储型XSS或者永久型

06

Reflected XSS scenario

07

Try It! Reflected XSS

08

Self XSS or reflected XSS?

09

Reflected and DOM-Based XSS

10

识别基于 DOM 的 XSS

11

Try It! DOM-Based XSS

12

Cross Site Scripting (stored)

Stored XSS

Stored XSS Scenario

Cross Site Scripting (mitigation) XSS防御

XSS defense

Why?

What to encode?

When/Where?

How?

What is encoding?

Escaping

Special characters

Relevant XML/HTML special characters

XSS defense资源

Java OWASP Encoder

General XSS prevention Cheat Sheet

DOM XSS Prevention Cheat Sheet

XSS Filter Evasion

Javascript Framework Specifics

jQuery

Backbone.js

Angular

Reflective XSS

Stored XSS

相关文章

发表回复 取消回复

Cross-Site Sc riptin g (XSS) is the most pre valent and pernic ious web application security iss ue

XSS has significant imp a ct

Why should we ca re?

发表回复取消回复