XSS BOT编写
ctf中xss题目常常需要一个管理员小机器点击用户点击的url
之前没有接触过,刚好最近又有这个需要,所以这次尝试写写小机器人的写法
环境准备
首先需要selenium
这个python的库
pip install selenium==2.48.0
它的作用是用来webdriver接口的,简而言之是用来控制浏览器的
而它支持chrome webdriver、firefox webdirver、PhantomJS等,但是呢前2个就需要有桌面,而我们的docker环境是没有桌面的,所以就只能选择PhantomJS了
安装PhantomJS
wget https://bitbucket.org/ariya/phantomjs/downloads/phantomjs-2.1.1-linux-x86_64.tar.bz2 tar -xjvf phantomjs-2.1.1-linux-x86_64.tar.bz2 ln -s phantomjs-2.1.1-linux-x86_64/bin/phantomjs /usr/local/bin/phantomjs
第一句是从官网下载压缩包,第二句是解压压缩包,第三句是创建link对象
题目准备
首先写个简单的环境
提交xss的页面
<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>XSS game</title> </head> <body> <form method="POST" action=""> <input name=‘content‘ type=‘text‘ /><br><br> <input type=‘submit‘ value="留言"/> </form> <br> <?php $db = mysqli_connect("localhost:3306","root","root","xss"); if (!$db){ die(‘Could not connect: ‘ . mysql_error()); } if(isset($_POST[‘content‘])){ $content = $_POST[‘content‘]; $sql = "INSERT INTO text(text) VALUES (‘".$content."‘)"; mysqli_query($db,$sql); } ?> </body> </html>
然后写上admin页面,是个登录,登录上去就是admin,会添加flag到cookie
<?php $db = mysqli_connect("localhost:3306","root","root","xss"); if(!$db){ die("connect wrong"); } if(isset($_POST[‘username‘]) && isset($_POST[‘password‘])){ $username = addslashes($_POST[‘username‘]); $password = addslashes($_POST[‘password‘]); $sql = "SELECT password FROM user WHERE username=‘$username‘"; $result = mysqli_query($db,$sql); $ans = mysqli_fetch_assoc($result); if($password === $ans[‘password‘]){ setcookie("flag","NSCTF{1436d30d970974a13d9e2c07808c4931}"); header("Location: mi04dmin.php"); } } if($_COOKIE[‘flag‘] === ‘NSCTF{1436d30d970974a13d9e2c07808c4931}‘){ $sql = "SELECT * FROM text"; $result = mysqli_query($db,$sql); while($ans = mysqli_fetch_assoc($result)){ echo $ans["text"] . "<br>"; $t = $ans["text"]; $sql_delete = "DELETE FROM text where text=‘$t‘"; $result = mysqli_query($db,$sql_delete); } die(); } ?> <html> <head> <meta charset="utf-8"> </head> <body> <form action="" method="POST"> <input type="text" name="username" /> <input type="password" name="password" /> <input type="submit" name="submit" value="login" /> </form> </body> </html>
这段代码可能比较垃圾,因为没有借鉴过比赛中xss的脚本,凭着自己的感觉写的,隔离性不是太好
逻辑大致是这样的,因为用户传的内容直接到数据库了,admin的页面功能就是先登录,登录后有个flag的cookie,然后会浏览数据库中的留言,看一条打印一条,然后马上删除
咱数据库里面是这样的
最后附上小机器人杂技脚本,这里使用的是py和sh配合,我在py里面直接写while循环如果nc -lvvp port
监听端口后,机器人会挂掉(不是这样监听还是会抛出异常),所以我使用sh来循环执行py脚本
bot.py
from selenium import webdriver import time from selenium.webdriver.common.keys import Keys url = "http://127.0.0.1/mi04dmin.php" driver = webdriver.PhantomJS() def visit(): driver.get(url) driver.find_element_by_name(‘username‘).send_keys("admin") driver.find_element_by_name(‘password‘).send_keys("mi0sijidou") data = driver.find_element_by_name(‘submit‘).click() time.sleep(2) driver.quit() if __name__ == ‘__main__‘: visit()
bot.sh
while true do python bot.py done
最后能够多次弹cookie,xss平台可以收到
参考资料:
https://www.cnblogs.com/hackxf/p/10429408.html
相关推荐
sswqycbailong 2020-07-28
csxiaoqiang 2020-07-26
码农成长记 2020-07-19
layloge 2020-07-05
layloge 2020-06-26
liangjielaoshi 2020-06-25
csxiaoqiang 2020-06-16
ItBJLan 2020-06-11
layloge 2020-06-07
csxiaoqiang 2020-06-03
sswqycbailong 2020-06-01
layloge 2020-05-30
码农成长记 2020-05-28
qidu 2020-05-26
zhuangnet 2020-05-20
zhuangnet 2020-05-19
xiaoemo0 2020-05-16
码农成长记 2020-05-10
today0 2020-05-04