荣耀彩票代理

IT技术互动交流平台

XSS 前端防火墙 内联事件拦截

作者:佚名  发布日期:2016-08-02 21:13:29

荣耀彩票代理 GUANYU XSS ZENYANGXINGCHENG、RUHEZHURU、NENGZUOSHENME、RUHEFANGFAN,QIANRENYIYOUWUSHUDETANTAO,ZHEILIJIUBUZAILEISHULE。

JIHUMEIPIANTANLUN XSS DEWENZHANG,JIEWEIDUOSHAODOUHUITIDAORUHEFANGZHI,RANERDADUOWANBIANBULIQIZONG。YAOZHUANYISHENME,YAOGUOLVSHENME,BUYAOWANGLESHENMEZHILEIDE。JINGUANDOUSHIZHONGSUOZHOUZHIDEDAOLI,DAN XSS LOUDONGSHIJINIANLAIJIHUCONGWEIZHONGDUANGUO,BUFAYIXIEDAWANGZHANYESHICHANGBAOCHU,XIAOWANGZHANGENGSHIJIACHANGBIANFAN。

ERBENWENJIESHAODEZESHILINGYIZHONGYUFANGSILU —— TONGGUOQIANDUANJIANKONGJIAOBEN,RANGMEIYIGEYONGHUDOUCANYULOUDONGDEJIANKONGHESHANGBAO。

预警系统

SHISHISHANG,ZHIJINRENGWEIYOUYILAOYONGYIDEJIEJUEFANGAN,YAOBIMIANTAYIJIUSHIYONGZUIGULAODETUBANFA,ZHUGEDEGUOLV。RANERRENZONGYOUSHUHUDESHIHOU,MEIDANGCHANPINDIEDAIGENGXINSHI,NANMIANHUIYILOUYIXIEXINZIDUAN,DAOZHILOUDONGBEIYINRU。

荣耀彩票代理JISHISHENGRENQIANLVYEYOUYISHI,CHENGXUCHU BUG WANQUANKEYILIJIE,JISHIXIUFUJIUXING。DANLINGRENFEIJIEDESHI,WENTICHUXIANDAOBEIFAXIAN,QUEYAOJINGGUOXIANGDANGZHANGDESHIJIAN。LIRUBUJIUQIANTIEBA XSS RUCHONGJIAOBEN,ZHIDAODAGUIMOBAOFAHOUJINGYONGHUJUBAO,ZUIZHONGCAIDEZHI。QITAWANGZHANDADUOYELEISI,ZHIDAOBAIMAOZIMENWAJUECHULOUDONG,TIJIAODAOANQUANPINGTAISHANG,ZUIZHONGCHANGSHANGCAIBEIGAOZHI。RUOYUDAOHEIKESIXIALIUZHEZHEIXIELOUDONGMANMANLIYONG,NEIZHINENGTINGTIANYOUMINGLE。

YINCI,YAOSHINENGYOUYITAOSHISHIDEYUJINGXITONG,NEIJIUGENGHAOLE。JISHIWUFAZUZHILOUDONGDEFASHENG,DANNENGZAILOUDONGCHUFADEDIYISHIJIANLI,TONGZHIKAIFARENYUAN,JIKEZAIZUIDUANDESHIJIANLIXIUFU,JIANGSUNSHIJIANGDAOZUIDI。GESHIGEYANGDEYINGYONGCENGFANGHUOQIANG,YEYOUCICHANSHENG。

BUGUO,HECHUANTONGDEXITONGLOUDONGBUTONG,XSS ZUIZHONGSHIZAIYONGHUYEMIANZHONGCHUFADE。YINCI,WOMENBUFANGCHANGSHISHIYONGQIANDUANDESILU,JINXINGZAIXIANFANGYU。

XSS 内联事件

荣耀彩票代理XIANLAIJIASHEYIGEYOU BUG DEHOUTAI,MEIYOUHENHAOCHULIYONGHUSHURUDESHUJU,DAOZHI XSS NENGBEIZHURUDAOYEMIAN:

<imgsrc="{LUJING}"/>

<imgsrc="{LUJING"onload="alert(/xss/)}"/>

ZHIZHUANYIJIANKUOHAO,QUEWANGLEYINHAO,SHI XSS LIZUIWEICHANGJIANDE。GONGJIZHEMENKEYITIQIANGUANBISHUXING,BINGTIANJIAYIGEJIYICHUFADENEILIANSHIJIAN,KUAZHANJIAOBENJIUZHEIYANGBEIQINGYIZHIXINGLE。

NEIME,WOMENNENGFOUSHIYONGQIANDUANJIAOBENLAIBUHUO,SHENZHILANJIENI?

被动扫描

荣耀彩票代理ZUIJIANDANDEBANFA,JIUSHIBAYEMIANLISUOYOUYUANSUDOUSAOMIAOYIBIAN,JIANCENEIXIE on KAITOUDENEILIANSHUXING,KANKANSHIBUSHICUNZAIYICHANG:

荣耀彩票代理LIRUZIFUSHUFEICHANGDUO,ZHENGCHANGQINGKUANGXIAZHEISHIHENSHAOCHUXIANDE,DAN XSS WEILEDUOBIZHUANYIYOUSHIHUIBIANMADEHENZHANG;LIRUCHUXIANYIXIE XSS JINGCHANGSHIYONGDEGUANJIANZI,DANZAISHIJICHANPINLIJIHUBUHUIYONGDAODE。ZHEIXIEDOUKEYIZUOWEILOUDONGCHUXIANDEZHENGZHAO,TONGZHIJIKAIFARENYUAN。

荣耀彩票代理BUGUO,TUBANFAZHONGJIUCUNZAIHENDADEJUXIANXING。ZAIRUJINQINGYISEDE AJAX SHIDAI,YEMIANYUANSUCONGLAIDOUBUSHIGUDINGDE。BANSUIZHEYONGHUGEZHONGJIAOHU,XINNEIRONGSUISHIDOUKENENGDONGTAITIANJIAJINLAI。JISHIHUANCHENGDINGQISAOMIAOYICI,XSS YEKENENGZAIDINGSHIQIDEJIANGEZHONGCHUFA,BINGXIAOHUIZIJI,NEIYANGYONGYUANDOUWUFAGENZONGDAOLE。KUANGQIE,PINFANDESAOMIAODUIXINGNENGYINGXIANGYESHIJUDADE。

RUTONGZAOQIDEANQUANRUANJIANYIYANG,MEIGEJIMIAOSAOMIAOYICIZHUCEBIAOQIDONGXIANG,BUJINFEIXINGNENG,ERQIEDUIEYIRUANJIANJIHUBUQIZUOYONG;DANZHIHOUDEZHUDONGFANGYUXITONGJIUBUTONGLE,ZHIYOUZAIZHENZHENGDIAOYONG API SHICAIJINXINGFENXI,BUTONGGUOZEZHIJIELANJIE,WANQUANBIMIANLEDINGSHIQIDEJIANGEYILOU。

荣耀彩票代理YINCI,WOMENXUYAOZHEIZHONGLEISIDEYANSHICELVE —— JINZAI XSS JIJIANGCHUFASHIDUIQIFENXI,DUIBUFUHECELVEDEYUANSU,JINXINGLANJIEHUOZHEFANGXING,TONGSHIFASONGBAOJINGDAOHOUTAIRIZHI。

主动防御

荣耀彩票代理『ZHUDONGFANGYU』,ZHEIGAINIANFANGZAIQIANDUANJIAOBENLISIHUYOUXIEXUANHU。DANBUNANFAXIAN,ZHEIJINJINSHIZHIXINGYOUXIANJIDESHIERYI —— ZHIYAOFANGYUCHENGXUNENGYUNXINGZAIQITACHENGXUZHIQIAN,WOMENJIUYOULEKEJINKETUIDEZHUDONGQUAN。DUIYUWUBIQIANGDADE HTML5 HELINGHUODUOBIANDE JavaScript,ZHEIXIEGAINIANDOUKEYIBEIWANZHUANCHULAI。

继续回到刚才讨论的内联事件 XSS 上来。浏览器荣耀彩票代理虽然没提供可操控内联事件的接口,但内联事件的本质仍是一个事件,无论怎样变化都离不开 DOM 事件模型。

荣耀彩票代理CHEDAOMOXINGSHANGMIAN,YIQIEJIJIANGYINGRENERJIE。MOXINGSHIJIEJUEWENTIDEZUIKAOPUDEBANFA,YOUQISHIXIANG DOM-3-Event ZHEIZHONGZAOYIZHIDINGDEMOXING,QIWENDINGXINGWUYONGZHIYI。

JIBIANMEIZIXIYUEDUGUANFANGWENDANG,DANFANZUOGUOWANGYEDEDOUZHIDAO,YOUGE addEventListener DEJIEKOU,BINGQUDAILECENGJINGYIGEGULAODEJIAO attachEvent DEDONGXI。JINGUANZHISHIXINZENGLEYIGECANSHUERYI,DANZHENGSHIZHEIGECHABIECHENGLERENMENJINJINLEDAODEHUATI。MEIDANGMIANSHITANDAOSHIJIANSHI,ZONGSHAOBULEKAOCHAXIAZHEIGEXINCANSHUDEYONGTU。JINGUANZAIRICHANGKAIFAZHONGHENSHAOYONGDAOTA。

 

GUANYUSHIJIANBUHUOHEMAOPAODEXIJIE,JIUBUDUOTAOLUNLE。XIAMIANDEZHEIDUANDAIMA,HUOXUNENGJIFANIDUI『ZHUDONGFANGYU』DEXIAXIANG。

荣耀彩票代理<button onclick="console.log('target')">CLICK ME</button>

<script>

荣耀彩票代理   document.addEventListener('click',function(e {

       console.log('bubble');

   });

荣耀彩票代理   document.addEventListener('click',function(e {

       console.log('capture');//e.stopImmediatePropagation();

荣耀彩票代理   },true);

</script>

Run

JINGUANANNIUSHANGZHIJIEBANGLEYIGENEILIANDESHIJIAN,DANSHIJIANMOXINGBINGBUMAIZHANG,RENGRANDEANBIAOZHUNDELIUCHENGZOUYIBIAN。capture,target,bubble,MOXINGJIUSHINEIYANGGUZHI。

BUGUO,BANEIXINGZHUSHIDEDAIMAHUIFU,JIEGUOJIUZHISHENG capture LE。ZHEIGEJIANDANDEDAOLIDAJIADOUMINGBAI,YEMEISHENMEHAOJIESHIDE。

DANZIXICHUAIMOXIA,ZHEIBUJIUSHI『ZHUDONGFANGYU』DEGAINIANMA?BUHUOCHENGXUYUNXINGZAINEILIANSHIJIANCHUFAZHIQIAN,BINGQIEWANQUANYOUNENGLILANJIEZHIHOUDEDIAOYONG。

SHANGMIANDE Demo ZHISHIBUJIASISUOLANJIELESUOYOUDESHIJIAN。RUGUOWOMENZAIJIAYIXIECELVEPANDUAN,HUOXUJIUGENGMINGLANGLE:

<button onclick="console.log('xss')">

荣耀彩票代理   CLICK ME

</button>

荣耀彩票代理<script>

   document.addEventListener('click',function(e){

       console.log('bubble');

荣耀彩票代理   });

荣耀彩票代理   document.addEventListener('click',function(e){

       var element=e.target;

       var code=element.getAttribute('onclick');

荣耀彩票代理       if(/xss/.test(code)){

           e.stopImmediatePropagation();

荣耀彩票代理           alert('LANJIEKEYISHIJIAN: '+code);

荣耀彩票代理       }},true);

荣耀彩票代理</script>

Run

WOMENXIANZAIBUHUOJIEDUANSAOMIAONEILIANSHIJIANZIFU,RUOSHICHUXIANLE『xss』ZHEIGEGUANJIANZI,HOUXUDESHIJIANJIUBEILANJIELE;HUANCHENGQITAZIFU,RENGRANJIXUZHIXING。TONGLI,WOMENHAIKEYIPANDUANZIFUZHANGDUSHIFOUGUODUO,YIJIGENGXIANGXIDEHEIBAIMINGDANZHENGZE。

荣耀彩票代理ZENMEYANG,YIGEZHUDONGFANGYUDEYUANXINGDANSHENGLEBA。

BUGUO,SHANGMIANDEPIANDUANHAIYOUGEXIAOWENTI,JIUSHIBASHIJIANDEMAOPAOGUOCHENGYEJIPINGBILE,ERWOMENJINJINXIANGLANJIENEILIANSHIJIANERYI。JIEJUEBANFAYEHENJIANDAN,BA e.stopImmediatePropagation() HUANCHENG element.onclick = null JIUKEYILE。

当然,目前这只能防护 onclick,而现实中有太多的内联事件。鼠标、键盘、触屏、网络状态等等,不同浏览器荣耀彩票代理支持的事件也不一样,甚至还有私有事件,难道都要事先逐一列出并且都捕获吗?是的,可以都捕获,但不必事先都列出来。

荣耀彩票代理YINWEIWOMENJIANTINGDESHI document DUIXIANG,LIULANQISUOYOUNEILIANSHIJIANDOUDUIYINGZHE document.on*** ZHEILEISHUXING,YINCIZHIXUYUNXINGSHIBIANLIYIXIA document DUIXIANG,JIKEHUODESUOYOUDESHIJIANMING。

荣耀彩票代理<img src="*"onerror="alert('xss')"/>

<script>

   functionhookEvent(eventName){

       document.addEventListener(eventName.substr(2),function(e){

       var element=e.target;

荣耀彩票代理       if(element.nodeType!=Node.ELEMENT_NODE){

           return;

       }

荣耀彩票代理       var code=element.getAttribute(eventName);

       if(code&&/xss/.test(code)){

           element[eventName]=null;

           alert('LANJIEKEYISHIJIAN:',code);

       }},true);

荣耀彩票代理   }

   console.time('HAOSHI');

   for(varkindocument){

       if(/^on./.test(k)){

荣耀彩票代理           //console.log('JIANKONG:', k);

           hookEvent(k);

       }}

荣耀彩票代理   console.timeEnd('HAOSHI');

</script>

Run

XIANZAI,WULUNYEMIANZHONGNAGEYUANSUCHUFANAGENEILIANSHIJIAN,DOUNENGYUXIANBEIWOMENBUHUO,BINGGENJUCELVEKEJINKETUILE。(BUGUOZAI OSX 10.9+ DE Safari LIULANQIWUFAMEIJUCHU on KAITOUDESHUXING,KENENGSHIGE BUG BA~)

其他内联形式

荣耀彩票代理XIANSHIZHONG,CHULEYI on KAITOUZHEIZHONGNEILIANWAI,HAICUNZAIYIXIETESHUXINGSHI。ZUICHANGJIANDEJIUSHI javascript: DESHUXING,ZAIYIXIELISHIYILIUDEFEIBIAOZHUNLIULANQIZHONG,BAOSHOUGOUBING。

荣耀彩票代理LIRUCENGJINGDE IE LIULANQIJIUZHICHIZHEIYANGDE URL:

<img src="javascript:alert('hello')">

荣耀彩票代理<img src='vbscript:msgbox "hello"'>

荣耀彩票代理ZHEIZHONGHUASHETIANZUDESHEJI,CENGDAOZHIGUOQUWUSHUDELUNTANSHENSHOUQIHAI。

RUJINZHEIZHONGHAOWUYIYIDEGUODUSHEJI,ZAOYIBEIBIAOZHUNPAOQI。CHULEMOUXIEXIAOZHONGLIULANQIHUOXURENGYOUYILIU,KEYICANKAOZHEILI。

BUGUO,YOUYIGESHIYONGTEBIEGUANGFAN,YIZHIRUJINBIAOZHUNRENGYOUBAOLIU,NEIJIUSHI:

<ahref="javascript:">

 

荣耀彩票代理DUIYUZHEILEIQINGKUANG,WOMENJIUDEDANDUDUIDAI,ZUOQITESHUCHULI:

<a href="javascript:alert(/xss/)">Click Me</a><

script>functionhookEvent(eventName){

   varisClick=(eventName=='onclick');

   document.addEventListener(eventName.substr(2),function(e){

       varel=e.target;

       if(el.nodeType!=Node.ELEMENT_NODE){

           return;

荣耀彩票代理       }

荣耀彩票代理       // ...

荣耀彩票代理       // SAOMIAO <a href="javascript:"> DEJIAOBEN

       if(isClick&&el.tagName=='A'&&el.protocol=='javascript:'){

荣耀彩票代理           varcode=el.href.substr(11);

           if(/xss/.test(code)){

荣耀彩票代理               el.href='javascript:void(0)';

               alert('LANJIEKEYISHIJIAN:',code);

荣耀彩票代理           }}

荣耀彩票代理       },true);

   }

   for(varkindocument){

       if(/^on./.test(k)){

           hookEvent(k);

荣耀彩票代理       }

   }

</script>

Run

性能优化

HUOXUYOUXIESHIJIANMEIYOUBIYAOBUHUO,LIRUSHIPINBOFANG、YINLIANGDIAOJIEDENG,DANJIUSUANQUANDOUBUZHUOYEHAOBULEDUOSHAOSHIJIAN,JIBENDOUZAI 1ms ZUOYOU。

DANGRAN,ZHUCESHIJIANBENLAIJIUHUABULEDUOSHAOSHIJIAN,ZHENZHENGDEHAOFEIDOUSUANZAIHUIDIAOSHANGLE。JINGUANDADUOSHUSHIJIANCHUFADOUBUPINFAN,EWAIDESAOMIAOKEYIHULVBUJI。DANHESHUBIAOYIDONGXIANGGUANDESHIJIANNEIJIUBURONGHUSHILE,YINCIDEKAOLVXINGNENGYOUHUA。

XIANRAN,NEILIANSHIJIANDAIMAZAIYUNXINGGUOCHENGZHONGJIHUBUKENENGFASHENGBIANHUA。SHIYONGNEILIANSHIJIANDADUOWEILEJIANDAN,RUGUOHAIYAOZAIYUNXINGSHI setAttribute QUGAIBIANNEILIANDAIMA,WANQUANJIUSHIBUKELIYUDE。YINCI,WOMENZHIXUDUIMOUGEYUANSUDETEDINGSHIJIAN,SAOMIAOYICIJIUKEYILE。ZHIHOUGENJUBIAOZHI,JIKEZHIJIETIAOGUO。

 

荣耀彩票代理<div style="width:100%; height:100%; position:absolute; background: red" onmousemove="alert('xss')">

   <a href="javascript:alert(/xss/)">Click Me</a>

</div>

荣耀彩票代理<script>

   var mCheckMap = {};

荣耀彩票代理   var mCheckID = 0;

   function hookEvent(eventName, eventID) {

       var isClick = (eventName == 'onclick');

荣耀彩票代理       function scanElement(el) {

           //

荣耀彩票代理           // TIAOGUOYISAOMIAODESHIJIAN

           //

           var flag = el['_k'];

           if (!flag) {

               flag = el['_k'] = ++mCheckID;

荣耀彩票代理           }

           var hash = (flag << 8) | eventID;

           if (hash in mCheckMap) {

荣耀彩票代理               return;

荣耀彩票代理           }

           mCheckMap[hash] = true;

           // FEIYUANSUJIEDIAN

           if (el.nodeType != Node.ELEMENT_NODE) {

               return;

           }

荣耀彩票代理           // SAOMIAONEILIANDAIMA

           var code;

荣耀彩票代理           if (el[eventName]) {

荣耀彩票代理               code = el.getAttribute(eventName);

               if (code && /xss/.test(code)) {

                   el[eventName] = null;

荣耀彩票代理                   alert('LANJIEKEYISHIJIAN:' + code);

荣耀彩票代理               }

荣耀彩票代理           }

           // SAOMIAO <a href="javascript:"> DEJIAOBEN

           if (isClick && el.tagName == 'A' && el.protocol == 'javascript:') {

               var code = el.href.substr(11);

               if (/xss/.test(code)) {

                   el.href = 'javascript:void(0)';

荣耀彩票代理                   alert('LANJIEKEYISHIJIAN:' + code);

               }

           }

荣耀彩票代理           // SAOMIAOSHANGJIYUANSU

荣耀彩票代理           scanElement(el.parentNode);

荣耀彩票代理       }

       document.addEventListener(eventName.substr(2), function(e) {

           scanElement(e.target);

荣耀彩票代理       }, true);

荣耀彩票代理   }

   var i = 0;

荣耀彩票代理   for (var k in document) {

荣耀彩票代理       if (/^on./.test(k)) {

荣耀彩票代理           hookEvent(k, i++);

荣耀彩票代理       }

   }

</script>

 

Run

荣耀彩票代理ZHEIYANG,ZHIHOUDESAOMIAOJINJINSHIJIANCEYIXIA,MUBIAODUIXIANGSHIFOUCUNZAIBIAOJIERYI。JISHIFENGKUANGHUANGDONGSHUBIAO,CPU SHIYONGLVYEDOUHULVEBUJILE。

荣耀彩票代理YUZHIQIANBUTONGDESHI,ZHEILIWOMENZENGJIALEYIGEJIAO scanElement DEHANSHU,BINGDIGUISAOMIAOSHANGJIYUANSU。ZHISUOYIZHEIMEZUO,HAISHIYINWEIHEMAOPAOYOUGUAN。JISHIDANGQIANYUANSUBUCUNZAINEILIANSHIJIAN,DANBINGBUDAIBIAOSHANGJIRONGQIYEMEIYOU。YINCI,WOMENJIANGYUANSUZISHENJISUOYOUSHANGJI DOM DOUSAOMIAOYIBIAN,YIFANGWANYI。YOUYUSAOMIAOGUODEHUIYOUBIAOJI,SUOYIBINGBUHUIZENGJIAXINGNENGXIAOHAO。

DAOCI,ZAI XSS NEILIANSHIJIANZHEIKUAI,WOMENYISHIXIANZHUDONGFANGYU。

DUIYUYOUZHEDALIANGZIFU,HUOZHECHUXIANLEISI String.fromCharCode,$.getScript ZHEILEIDIANXING XSS DAIMADE,WANQUANKEYIJIANGQILANJIE;FAXIANYOU alert(/xss/),alert(123) ZHEIXIECESHIDAIMA,KEYIZANSHIFANGXING,BINGJIANGRIZHIFASONGDAOHOUTAI,QUEDINGSHIFOUNENGGOUFUXIAN。

荣耀彩票代理RUGUOFUXIAN,SHUOMINGYIYOURENFAXIAN XSS BINGCHENGGONGZHURULE,DANHAIMEIDAGUIMOKAISHILIYONG。CHENGXUYUANMENGANJINDIYISHIJIANXIU BUG BA,RANGHEIKEMANGHUOYIZHENZIHOUFAXIANLOUDONGYIJINGXIUFULE:)

字符策略的缺陷

荣耀彩票代理DANSHI,GUANGKAODAIMAZIFUCHUANLAIPANDUAN,HAISHIHUIYOUSHULOUDE。YOUQISHIHEIKEMENZHIDAOYOUZHEIMEGEWANYICUNZAI,HUIGENGJIAXIAOXINLE。BADAIMAZHUANYIYONGYIDUOBIGUANJIANZI,BINGJIANGZIFUCUNCHUZAIQITADIFANG,YIDUOGUOZHANGDUJIANCE,JIKEWANQUANRAOGUOWOMENDEJIANKONGLE:

<imgsrc="*"onerror="window['ev'+'al'](this.align)"align="alert('a mass of code...')">

YINCI,WOMENBUJINXUYAOFENXIGUANJIANZI。ZAIHUIDIAOZHIXINGSHI,HAIXUJIANKONG eval、setTimeout('...') DENGZHEILEINENGJIEXIDAIMADEHANSHUBEIDIAOYONG。

荣耀彩票代理BUGUO,TONGCHANGBUHUIZHURUTAIDUODEDAIMA,ERSHIZHIJIEYINRUYIGEWAIBUJIAOBEN,JIJIANDANYOUKAOPU,BINGQIENENGSHISHIXIUGAIGONGJINEIRONG:

<imgsrc="*"onerror="$['get'+'Script'](...)">

 

Tag标签:         
  • 专题推荐

About IT165 - 广告服务 - 隐私声明 - 版权申明 - 免责条款 - 网站地图 - 网友投稿 - 联系方式
本站内容来自于互联网,仅供用于网络技术学习,学习中请遵循相关法律法规