Tag:csdn

Tag (csdn)'s result:

CSDN 存储型XSS分析

20190724,网上传出csdn貌似有存储型XSS,弹框链接: https://bbs.csdn.net/topics/390816889 解码是”提交成功” 搜索这个词 抓包判断该post包触发弹窗 尝试修改响应包 请求 https://bbs.csdn.net/topics/390816889 会发请求 GET /redisData/baiduLandingWord?url=https://bbs.csdn.net/topics/390816889&size=1 HTTP/1.1 Host: redisdatarecall.csdn.net Connection: close Accept: application/json, text/javascript, */*; q=0.01 Origin: https://bbs.csdn.net User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Referer: https://bbs.csdn.net/topics/390816889 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 这个请求是在百度站内查询 再请求,将查询内容写入redis 再请求,返回了推荐的关联帖子的内容,内容(‘提交成功’)经过了html实体编码,引号还原了。(不确定……) 该返回造成弹窗。 触发流程: 1.发布帖子写入payload(如Response.Write(“<script>alert(‘提交成功!’);window.location.href=window.location.href;window.opener.location=window.opener.location;</script>”);) 2.百度搜索引擎爬到该payload帖子。 3.某相关话题帖子推荐到payload帖子,加载到某相关话题帖子的页面。 4.触发payload。   相关链接 https://redisdatarecall.csdn.net/redisData/baiduLandingWord?url=https://bbs.csdn.net/topics/390816889&size=1 https://event.csdn.net/logstores/csdn-pc-tracking-page-exposure/track https://zhannei-dm.csdn.net/recommend/baidu_zhannei_search?keyword=%E5%85%B3%E4%BA%8Ewindow.location.href%E7%9A%84xss https://recsidebar.csdn.net/getSideBarRecommend.html   不确定分析的对不对,如有错漏,强烈建议指出…….