DVWA靶场之XSS（Stored）通关

Low：

<?php

if( isset( $_POST[ 'btnSign' ] ) ) {

// Get input

$message = trim( $_POST[ 'mtxMessage' ] );

$name    = trim( $_POST[ 'txtName' ] );

// Sanitize message input

$message = stripslashes( $message );

$message = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $message ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

// Sanitize name input

$name = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $name ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

// Update database

$query  = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );";

$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

//mysql_close();

}

?>

trim用于移除字符串两侧空白字符和其他预定义字符

mysql_real_escape_string对字符串中特殊符号转义

stripslashes删除字符串中的反斜杠

但是对过滤XSS没用，还存到数据库里了。直接在message中输入<script>alert(/xss/)</script>就会弹框

Name对输入有长度限制，抓包改包传

一返回这个界面就弹框，是为存储型XSS

Medium：

<?php

if( isset( $_POST[ 'btnSign' ] ) ) {

// Get input

$message = trim( $_POST[ 'mtxMessage' ] );

$name    = trim( $_POST[ 'txtName'
] );

// Sanitize message input

$message = strip_tags( addslashes( $message ) );

$message = ((isset($GLOBALS["___mysqli_ston"]) &&
is_object($GLOBALS["___mysqli_ston"])) ?
mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $message ) :
((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call!
This code does not work.", E_USER_ERROR)) ? "" : ""));

$message = htmlspecialchars( $message );

// Sanitize name input

$name = str_replace( '<script>', '', $name );

$name = ((isset($GLOBALS["___mysqli_ston"]) &&
is_object($GLOBALS["___mysqli_ston"])) ?
mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $name ) :
((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call!
This code does not work.", E_USER_ERROR)) ? "" : ""));

// Update database

$query  = "INSERT INTO
guestbook ( comment, name ) VALUES ( '$message', '$name' );";

$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"]))
? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res =
mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

//mysql_close();

}

?>

strip_tags清理了HTML\XML\PHP 的标签，但保留<b>标签的使用权限

addslashes在预定义字符前加反斜杠转义

htmlspecialchars把预定义字符转为HTML实体

还把name 的<script>过滤了

message惨遭毒手，可以从name下手

抓包改包加绕过

<sc<script>ript>alert(/xss/)</script>

<Script>alert(/xss/)</script>

High：

<?php

if( isset( $_POST[ 'btnSign' ] ) ) {

// Get input

$message = trim( $_POST[ 'mtxMessage' ] );

$name    = trim( $_POST[ 'txtName'
] );

// Sanitize message input

$message = strip_tags( addslashes( $message ) );

$message = ((isset($GLOBALS["___mysqli_ston"]) &&
is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $message ) :
((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call!
This code does not work.", E_USER_ERROR)) ? "" : ""));

$message = htmlspecialchars( $message );

// Sanitize name input

$name = preg_replace(
'/<(.*)s(.*)c(.*)r(.*)i(.*)p(.*)t/i', '', $name );

$name = ((isset($GLOBALS["___mysqli_ston"]) &&
is_object($GLOBALS["___mysqli_ston"])) ?
mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $name ) : ((trigger_error("[MySQLConverterToo]
Fix the mysql_escape_string() call! This code does not work.",
E_USER_ERROR)) ? "" : ""));

// Update database

$query  = "INSERT INTO
guestbook ( comment, name ) VALUES ( '$message', '$name' );";

$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' .
((is_object($GLOBALS["___mysqli_ston"])) ?
mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res =
mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

//mysql_close();

}

?>

把name的<script>彻底过滤了

可以换别的标签

<img src=1 onerror=alert(1)>

Impossible：

<?php

if( isset( $_POST[ 'btnSign' ] ) ) {

// Check Anti-CSRF token

checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ],
'index.php' );

// Get input

$message = trim( $_POST[ 'mtxMessage' ] );

$name    = trim( $_POST[ 'txtName'
] );

// Sanitize message input

$message = stripslashes( $message );

$message = ((isset($GLOBALS["___mysqli_ston"]) &&
is_object($GLOBALS["___mysqli_ston"])) ?
mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $message ) :
((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call!
This code does not work.", E_USER_ERROR)) ? "" : ""));

$message = htmlspecialchars( $message );

// Sanitize name input

$name = stripslashes( $name );

$name = ((isset($GLOBALS["___mysqli_ston"]) &&
is_object($GLOBALS["___mysqli_ston"])) ?
mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $name ) :
((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call!
This code does not work.", E_USER_ERROR)) ? "" : ""));

$name = htmlspecialchars( $name );

// Update database

$data = $db->prepare( 'INSERT INTO guestbook ( comment, name ) VALUES
( :message, :name );' );

$data->bindParam( ':message', $message, PDO::PARAM_STR );

$data->bindParam( ':name', $name, PDO::PARAM_STR );

$data->execute();

}

// Generate Anti-CSRF token

generateSessionToken();

?>

这回厉害了，升到impossible级别，之前打进数据库的语句，打开页面都不弹框了

就全员htmlspecialchars呗

但要注意htmlspecialchars使用位置，不要被绕过了