其实这个话题很早就想说说了，发现国内不少PHP站点都有XSS漏洞。今天偶然看到PHP5的一个XSS漏洞，在此小结一下。顺便提醒，使用PHP5的朋友最好打下补丁，或者升级一下。
如果你不懂什么是XSS，可以看这里，或者这里（中文的也许会好懂一些）。
国内不少论坛都存在跨站脚本漏洞，例如这里 有一个Google Hack+XSS的攻击例子，针对的是Discuz 4.0.0RC3。国外也很多这样的例子，甚至Google也出现过，不过在12月初时修正了。跨站攻击很容易就可以构造，而且非常隐蔽，不易被查觉（通常盗取信息后马上跳转回原页面）。
如何攻击，在此不作说明（也不要问我），主要谈谈如何防范。首先，跨站脚本攻击都是由于对用户的输入没有进行严格的过滤造成的，所以我们必须在所有数据进入我们的网站和数据库之前把可能的危险拦截。针对非法的HTML代码包括单双引号等，可以使用<font color="#000000"><font face="新宋体"><font color="#0000bb"><?php <BR>$str </font><font color="#007700">= </font><font color="#dd0000">"A quote is <b>bold</b>"</font></font><font face="新宋体" color="#007700">;<br><br></font><font face="新宋体"><font color="#ff8000">// Outputs: A quote is <b>bold</b><br></font><font color="#007700">echo </font><font style="BACKGROUND-COLOR: rgb(49,106,197)" color="#ffffff">htmlentities</font><font color="#007700">(</font><font color="#0000bb">$str</font></font><font face="新宋体" color="#007700">);<br><br></font><font face="新宋体"><font color="#ff8000">// Outputs: A 'quote' is <b>bold</b><br></font><font color="#007700">echo </font><font style="BACKGROUND-COLOR: rgb(49,106,197)" color="#ffffff">htmlentities</font><font color="#007700">(</font><font color="#0000bb">$str</font><font color="#007700">, </font><font color="#0000bb">ENT_QUOTES</font></font><font face="新宋体" color="#007700">);<br></font><font face="新宋体"><font color="#0000bb">?><br><br><br>这样可以使非法的脚本失效。<br></font> </font></font><font color="#000000"><font style="BACKGROUND-COLOR: rgb(49,106,197)" face="新宋体" color="#ffffff">htmlentities()</font></font>默认编码为 ISO-8859-1，如果你的非法脚本编码为其它，那么可能无法过滤掉，同时浏览器却可以识别和执行。这个问题我先找几个站点测试后再说。
这里提供一个过滤非法脚本的函数：function RemoveXSS($val) { <br> <font style="COLOR: rgb(51,153,102)" color="#6fe16f">// remove all non-printable characters. CR(0a) and LF(0b) and TAB(9) are allowed</font><span style="COLOR: rgb(51,153,102)"> </span><br style="COLOR: rgb(51,153,102)"><span style="COLOR: rgb(51,153,102)"> </span><font style="COLOR: rgb(51,153,102)" color="#6fe16f">// this prevents some character re-spacing such as <javascript></javascript></font><span style="COLOR: rgb(51,153,102)"> </span><br style="COLOR: rgb(51,153,102)"><span style="COLOR: rgb(51,153,102)"> </span><font style="COLOR: rgb(51,153,102)" color="#6fe16f">// note that you have to handle splits with
, , and later since they *are* allowed in some inputs</font><span style="COLOR: rgb(51,153,102)"> </span><br> $val = preg_replace(<font color="#cf41cf">/([x00-x08][x0b-x0c][x0e-x20])/</font>, <font color="#cf41cf"></font>, $val); <br> <br> <font color="#6fe16f">// straight replacements, the user should never need these since theyre normal characters</font> <br> <font color="#6fe16f">// this prevents like <img src="@avascript:alert('XSS')" alt="PHP和XSS跨站攻击" ></font> <br> $search = <font color="#cf41cf">abcdefghijklmnopqrstuvwxyz</font>; <br> $search .= <font color="#cf41cf">ABCDEFGHIJKLMNOPQRSTUVWXYZ</font>; <br> $search .= <font color="#cf41cf">1234567890!@#$%^&*()</font>; <br> $search .= <font color="#cf41cf">~`";:?+/={}[]-_|\</font>; <br> for ($i = 0; $i <font color="#6fe16f">// ;? matches the ;, which is optional</font> <br> <font color="#6fe16f">// 0{0,7} matches any padded zeros, which are optional and go up to 8 chars</font> <br> <br> <font color="#6fe16f">// @ @ search for the hex values</font> <br> $val = preg_replace(<font color="#cf41cf">/([x|X]0{0,8}</font>.dechex(ord($search[$i])).<font color="#cf41cf">;?)/i</font>, $search[$i], $val); <font color="#6fe16f">// with a ;</font> <br> <font color="#6fe16f">// @ @ 0{0,7} matches 0 zero to seven times</font> <br> $val = preg_replace(<font color="#cf41cf">/({0,8}</font>.ord($search[$i]).<font color="#cf41cf">;?)/</font>, $search[$i], $val); <font color="#6fe16f">// with a ;</font> <br> } <br> <br> <font color="#6fe16f">// now the only remaining whitespace attacks are ,
, and </font> <br> $ra1 = Array(<font color="#cf41cf">javascript</font>, <font color="#cf41cf">vbscript</font>, <font color="#cf41cf">expression</font>, <font color="#cf41cf">applet</font>, <font color="#cf41cf">meta</font>, <font color="#cf41cf">xml</font>, <font color="#cf41cf">blink</font>, <font color="#cf41cf">link</font>, <font color="#cf41cf">style</font>, <font color="#cf41cf">script</font>, <font color="#cf41cf">embed</font>, <font color="#cf41cf">object</font>, <font color="#cf41cf">iframe</font>, <font color="#cf41cf">frame</font>, <font color="#cf41cf">frameset</font>, <font color="#cf41cf">ilayer</font>, <font color="#cf41cf">layer</font>, <font color="#cf41cf">bgsound</font>, <font color="#cf41cf">title</font>, <font color="#cf41cf">base</font>); <br> $ra2 = Array(<font color="#cf41cf">onabort</font>, <font color="#cf41cf">onactivate</font>, <font color="#cf41cf">onafterprint</font>, <font color="#cf41cf">onafterupdate</font>, <font color="#cf41cf">onbeforeactivate</font>, <font color="#cf41cf">onbeforecopy</font>, <font color="#cf41cf">onbeforecut</font>, <font color="#cf41cf">onbeforedeactivate</font>, <font color="#cf41cf">onbeforeeditfocus</font>, <font color="#cf41cf">onbeforepaste</font>, <font color="#cf41cf">onbeforeprint</font>, <font color="#cf41cf">onbeforeunload</font>, <font color="#cf41cf">onbeforeupdate</font>, <font color="#cf41cf">onblur</font>, <font color="#cf41cf">onbounce</font>, <font color="#cf41cf">oncellchange</font>, <font color="#cf41cf">onchange</font>, <font color="#cf41cf">onclick</font>, <font color="#cf41cf">oncontextmenu</font>, <font color="#cf41cf">oncontrolselect</font>, <font color="#cf41cf">oncopy</font>, <font color="#cf41cf">oncut</font>, <font color="#cf41cf">ondataavailable</font>, <font color="#cf41cf">ondatasetchanged</font>, <font color="#cf41cf">ondatasetcomplete</font>, <font color="#cf41cf">ondblclick</font>, <font color="#cf41cf">ondeactivate</font>, <font color="#cf41cf">ondrag</font>, <font color="#cf41cf">ondragend</font>, <font color="#cf41cf">ondragenter</font>, <font color="#cf41cf">ondragleave</font>, <font color="#cf41cf">ondragover</font>, <font color="#cf41cf">ondragstart</font>, <fo>
</fo>
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
AI Hentai Generator
Generate AI Hentai for free.
Hot Article
Hot Tools
SublimeText3 Chinese version
Chinese version, very easy to use
mPDF
mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),
DVWA
Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is very vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, to help web developers better understand the process of securing web applications, and to help teachers/students teach/learn in a classroom environment Web application security. The goal of DVWA is to practice some of the most common web vulnerabilities through a simple and straightforward interface, with varying degrees of difficulty. Please note that this software
Dreamweaver Mac version
Visual web development tools
SecLists
SecLists is the ultimate security tester's companion. It is a collection of various types of lists that are frequently used during security assessments, all in one place. SecLists helps make security testing more efficient and productive by conveniently providing all the lists a security tester might need. List types include usernames, passwords, URLs, fuzzing payloads, sensitive data patterns, web shells, and more. The tester can simply pull this repository onto a new test machine and he will have access to every type of list he needs.
