7.3 存儲(chǔ)型跨站腳本攻擊（XSS）滲透測(cè)試

存儲(chǔ)型跨站腳本攻擊（XSS）滲透測(cè)試Web滲透與防護(hù)WebPenetrationTesting&Protection目錄2存儲(chǔ)型XSS滲透測(cè)試環(huán)境13存儲(chǔ)型XSS滲透測(cè)試初級(jí)分析4存儲(chǔ)型XSS滲透測(cè)試流程存儲(chǔ)型XSS滲透測(cè)試中級(jí)分析5存儲(chǔ)型XSS滲透測(cè)試高級(jí)分析6存儲(chǔ)型XSS滲透測(cè)試總結(jié)存儲(chǔ)型XSS滲透測(cè)試環(huán)境DVWA平臺(tái)中XSS跨站腳本攻擊環(huán)境用戶端虛擬機(jī)中的Win10操作系統(tǒng)IP地址192.168.200.106/24IP地址192.168.200.1/24物理機(jī)PC存儲(chǔ)型跨站腳本攻擊（XSS）滲透測(cè)試流程：

尋找輸入點(diǎn)尋找頁(yè)面中的用戶輸入點(diǎn)尋找輸出點(diǎn)尋找頁(yè)面中對(duì)應(yīng)的信息輸出點(diǎn)構(gòu)造執(zhí)行構(gòu)造JavaScript腳本并運(yùn)行存儲(chǔ)型XSS滲透測(cè)試流程……$message=trim($_POST['mtxMessage']);$name=trim($_POST['txtName']);//Sanitizemessageinput

$message=stripslashes($message);$message=((isset($GLOBALS["___mysqli_ston"])&&is_object($GLOBALS["___mysqli_ston"]))?mysqli_real_escape_string($GLOBALS["___mysqli_ston"],$message):((trigger_error("[MySQLConverterToo]Fixthemysql_escape_string()call!Thiscodedoesnotwork.",E_USER_ERROR))?"":""));//Sanitizenameinput$name=((isset($GLOBALS["___mysqli_ston"])&&is_object($GLOBALS["___mysqli_ston"]))?mysqli_real_escape_string($GLOBALS["___mysqli_ston"],$name):((trigger_error("[MySQLConverterToo]Fixthemysql_escape_string()call!Thiscodedoesnotwork.",E_USER_ERROR))?"":""));//Updatedatabase$query="INSERTINTOguestbook(comment,name)VALUES('$message','$name');";……存儲(chǔ)型XSS滲透測(cè)試初級(jí)分析對(duì)輸入的“name”和“message”參數(shù)值進(jìn)行處理初級(jí)防護(hù)措施stripslashes()函數(shù)：刪除字符串中的反斜杠trim()函數(shù)：刪除字符串兩側(cè)的空白字符mysqli_real_escape_string()函數(shù)：轉(zhuǎn)義特殊字符無法實(shí)現(xiàn)JavaScript腳本的過濾，將輸入的惡意腳本插入到了數(shù)據(jù)庫(kù)……$message=trim($_POST['mtxMessage']);$name=trim($_POST['txtName']);//Sanitizemessageinput

$message=strip_tags(addslashes($message));$message=((isset($GLOBALS["___mysqli_ston"])&&is_object($GLOBALS["___mysqli_ston"]))?mysqli_real_escape_string($GLOBALS["___mysqli_ston"],$message):((trigger_error("[MySQLConverterToo]Fixthemysql_escape_string()call!Thiscodedoesnotwork.",E_USER_ERROR))?"":""));

$message=htmlspecialchars($message);//Sanitizenameinput

$name=str_replace('<script>','',$name);……//Updatedatabase$query="INSERTINTOguestbook(comment,name)VALUES('$message','$name');";……存儲(chǔ)型XSS滲透測(cè)試中級(jí)分析“message”參數(shù)中級(jí)防護(hù)措施strip_tags()函數(shù)：刪除字符串中的HTML、XML以及PHP的標(biāo)簽addslashes()函數(shù)：在每個(gè)雙引號(hào)“"”前添加反斜杠htmlspecialchars()函數(shù)：將所有的預(yù)定義字符轉(zhuǎn)換成了HTML實(shí)體，不會(huì)將其作為腳本執(zhí)行“name”參數(shù)str_replace()函數(shù)：將“<script>”字符串替換成空字符串繞過方法BurpSuite修改數(shù)據(jù)包，繞過長(zhǎng)度限制“name”參數(shù)：大小寫繞過、雙寫繞過……$message=trim($_POST['mtxMessage']);$name=trim($_POST['txtName']);//Sanitizemessageinput$message=strip_tags(addslashes($message));$message=((isset($GLOBALS["___mysqli_ston"])&&is_object($GLOBALS["___mysqli_ston"]))?mysqli_real_escape_string($GLOBALS["___mysqli_ston"],$message):((trigger_error("[MySQLConverterToo]Fixthemysql_escape_string()call!Thiscodedoesnotwork.",E_USER_ERROR))?"":""));$message=htmlspecialchars($message);//Sanitizenameinput

$name=preg_replace('/<(.*)s(.*)c(.*)r(.*)i(.*)p(.*)t/i','',$name);……//Updatedatabase$query=“INSERTINTOguestbook(comment,name)VALUES(‘$message’,‘$name’);”;……存儲(chǔ)型XSS滲透測(cè)試高級(jí)分析“name”參數(shù)高級(jí)防護(hù)措施不區(qū)分大小寫，防止大小寫繞過preg_replace()函數(shù)：基于正則表達(dá)式替換<script>標(biāo)簽，防止雙寫繞過繞過方法BurpSuite修改數(shù)據(jù)包，繞過長(zhǎng)度限制“name”參數(shù)：標(biāo)簽繞過測(cè)試XSS頁(yè)面功能判斷頁(yè)面中的用戶輸入點(diǎn)尋找頁(yè)面輸入點(diǎn)尋找輸出點(diǎn)XSS攻擊存儲(chǔ)型XSS滲透測(cè)試總結(jié)測(cè)試用戶輸入對(duì)應(yīng)的