first commit
This commit is contained in:
OPSXCQ
parent
985a5c928c
commit
f40a84879c
551 changed files with 72374 additions and 24 deletions
56
dvwa/vulnerabilities/xss_s/help/help.php
Normal file
56
dvwa/vulnerabilities/xss_s/help/help.php
Normal file
|
|
@ -0,0 +1,56 @@
|
|||
<div class="body_padded">
|
||||
<h1>Help - Cross Site Scripting (Stored)</h1>
|
||||
|
||||
<div id="code">
|
||||
<table width='100%' bgcolor='white' style="border:2px #C0C0C0 solid">
|
||||
<tr>
|
||||
<td><div id="code">
|
||||
<p>"Cross-Site Scripting (XSS)" attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites.
|
||||
XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script,
|
||||
to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application using input from a user in the output,
|
||||
without validating or encoding it.</p>
|
||||
|
||||
<p>An attacker can use XSS to send a malicious script to an unsuspecting user. The end user's browser has no way to know that the script should not be trusted,
|
||||
and will execute the JavaScript. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other
|
||||
sensitive information retained by your browser and used with that site. These scripts can even rewrite the content of the HTML page.</p>
|
||||
|
||||
<p>The XSS is stored in the database. The XSS is permanent, until the database is reset or the payload is manually deleted.</p>
|
||||
|
||||
<br /><hr /><br />
|
||||
|
||||
<h3>Objective</h3>
|
||||
<p>Redirect everyone to a web page of your choosing.</p>
|
||||
|
||||
<br /><hr /><br />
|
||||
|
||||
<h3>Low Level</h3>
|
||||
<p>Low level will not check the requested input, before including it to be used in the output text.</p>
|
||||
<pre>Spoiler: <span class="spoiler">Either name or message field: <script>alert("XSS");</script></span>.</pre>
|
||||
|
||||
<br />
|
||||
|
||||
<h3>Medium Level</h3>
|
||||
<p>The developer had added some protection, however hasn't done every field the same way.</p>
|
||||
<pre>Spoiler: <span class="spoiler">name field: <sCriPt>alert("XSS");</sCriPt></span>.</pre>
|
||||
|
||||
<br />
|
||||
|
||||
<h3>High Level</h3>
|
||||
<p>The developer believe they have disabled all script usage by removing the pattern "<s*c*r*i*p*t".</p>
|
||||
<pre>Spoiler: <span class="spoiler">HTML events</span>.</pre>
|
||||
|
||||
<br />
|
||||
|
||||
<h3>Impossible Level</h3>
|
||||
<p>Using inbuilt PHP functions (such as "<?php echo dvwaExternalLinkUrlGet( 'https://secure.php.net/manual/en/function.htmlspecialchars.php', 'htmlspecialchars()' ); ?>"),
|
||||
its possible to escape any values which would alter the behaviour of the input.</p>
|
||||
</div></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</div>
|
||||
|
||||
<br />
|
||||
|
||||
<p>Reference: <?php echo dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)' ); ?></p>
|
||||
</div>
|
||||
79
dvwa/vulnerabilities/xss_s/index.php
Normal file
79
dvwa/vulnerabilities/xss_s/index.php
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
<?php
|
||||
|
||||
define( 'DVWA_WEB_PAGE_TO_ROOT', '../../' );
|
||||
require_once DVWA_WEB_PAGE_TO_ROOT . 'dvwa/includes/dvwaPage.inc.php';
|
||||
|
||||
dvwaPageStartup( array( 'authenticated', 'phpids' ) );
|
||||
|
||||
$page = dvwaPageNewGrab();
|
||||
$page[ 'title' ] = 'Vulnerability: Stored Cross Site Scripting (XSS)' . $page[ 'title_separator' ].$page[ 'title' ];
|
||||
$page[ 'page_id' ] = 'xss_s';
|
||||
$page[ 'help_button' ] = 'xss_s';
|
||||
$page[ 'source_button' ] = 'xss_s';
|
||||
|
||||
dvwaDatabaseConnect();
|
||||
|
||||
$vulnerabilityFile = '';
|
||||
switch( $_COOKIE[ 'security' ] ) {
|
||||
case 'low':
|
||||
$vulnerabilityFile = 'low.php';
|
||||
break;
|
||||
case 'medium':
|
||||
$vulnerabilityFile = 'medium.php';
|
||||
break;
|
||||
case 'high':
|
||||
$vulnerabilityFile = 'high.php';
|
||||
break;
|
||||
default:
|
||||
$vulnerabilityFile = 'impossible.php';
|
||||
break;
|
||||
}
|
||||
|
||||
require_once DVWA_WEB_PAGE_TO_ROOT . "vulnerabilities/xss_s/source/{$vulnerabilityFile}";
|
||||
|
||||
$page[ 'body' ] .= "
|
||||
<div class=\"body_padded\">
|
||||
<h1>Vulnerability: Stored Cross Site Scripting (XSS)</h1>
|
||||
|
||||
<div class=\"vulnerable_code_area\">
|
||||
<form method=\"post\" name=\"guestform\" onsubmit=\"return validate_form(this)\">
|
||||
<table width=\"550\" border=\"0\" cellpadding=\"2\" cellspacing=\"1\">
|
||||
<tr>
|
||||
<td width=\"100\">Name *</td>
|
||||
<td><input name=\"txtName\" type=\"text\" size=\"30\" maxlength=\"10\"></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td width=\"100\">Message *</td>
|
||||
<td><textarea name=\"mtxMessage\" cols=\"50\" rows=\"3\" maxlength=\"50\"></textarea></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td width=\"100\"> </td>
|
||||
<td><input name=\"btnSign\" type=\"submit\" value=\"Sign Guestbook\" onClick=\"return checkForm();\"></td>
|
||||
</tr>
|
||||
</table>\n";
|
||||
|
||||
if( $vulnerabilityFile == 'impossible.php' )
|
||||
$page[ 'body' ] .= " " . tokenField();
|
||||
|
||||
$page[ 'body' ] .= "
|
||||
</form>
|
||||
{$html}
|
||||
</div>
|
||||
<br />
|
||||
|
||||
" . dvwaGuestbook() . "
|
||||
<br />
|
||||
|
||||
<h2>More Information</h2>
|
||||
<ul>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'https://en.wikipedia.org/wiki/Cross-site_scripting' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'http://www.cgisecurity.com/xss-faq.html' ) . "</li>
|
||||
<li>" . dvwaExternalLinkUrlGet( 'http://www.scriptalert1.com/' ) . "</li>
|
||||
</ul>
|
||||
</div>\n";
|
||||
|
||||
dvwaHtmlEcho( $page );
|
||||
|
||||
?>
|
||||
24
dvwa/vulnerabilities/xss_s/source/high.php
Normal file
24
dvwa/vulnerabilities/xss_s/source/high.php
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_POST[ 'btnSign' ] ) ) {
|
||||
// Get input
|
||||
$message = trim( $_POST[ 'mtxMessage' ] );
|
||||
$name = trim( $_POST[ 'txtName' ] );
|
||||
|
||||
// Sanitize message input
|
||||
$message = strip_tags( addslashes( $message ) );
|
||||
$message = mysql_real_escape_string( $message );
|
||||
$message = htmlspecialchars( $message );
|
||||
|
||||
// Sanitize name input
|
||||
$name = preg_replace( '/<(.*)s(.*)c(.*)r(.*)i(.*)p(.*)t/i', '', $name );
|
||||
$name = mysql_real_escape_string( $name );
|
||||
|
||||
// Update database
|
||||
$query = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );";
|
||||
$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
|
||||
|
||||
//mysql_close();
|
||||
}
|
||||
|
||||
?>
|
||||
31
dvwa/vulnerabilities/xss_s/source/impossible.php
Normal file
31
dvwa/vulnerabilities/xss_s/source/impossible.php
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_POST[ 'btnSign' ] ) ) {
|
||||
// Check Anti-CSRF token
|
||||
checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
|
||||
|
||||
// Get input
|
||||
$message = trim( $_POST[ 'mtxMessage' ] );
|
||||
$name = trim( $_POST[ 'txtName' ] );
|
||||
|
||||
// Sanitize message input
|
||||
$message = stripslashes( $message );
|
||||
$message = mysql_real_escape_string( $message );
|
||||
$message = htmlspecialchars( $message );
|
||||
|
||||
// Sanitize name input
|
||||
$name = stripslashes( $name );
|
||||
$name = mysql_real_escape_string( $name );
|
||||
$name = htmlspecialchars( $name );
|
||||
|
||||
// Update database
|
||||
$data = $db->prepare( 'INSERT INTO guestbook ( comment, name ) VALUES ( :message, :name );' );
|
||||
$data->bindParam( ':message', $message, PDO::PARAM_STR );
|
||||
$data->bindParam( ':name', $name, PDO::PARAM_STR );
|
||||
$data->execute();
|
||||
}
|
||||
|
||||
// Generate Anti-CSRF token
|
||||
generateSessionToken();
|
||||
|
||||
?>
|
||||
22
dvwa/vulnerabilities/xss_s/source/low.php
Normal file
22
dvwa/vulnerabilities/xss_s/source/low.php
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_POST[ 'btnSign' ] ) ) {
|
||||
// Get input
|
||||
$message = trim( $_POST[ 'mtxMessage' ] );
|
||||
$name = trim( $_POST[ 'txtName' ] );
|
||||
|
||||
// Sanitize message input
|
||||
$message = stripslashes( $message );
|
||||
$message = mysql_real_escape_string( $message );
|
||||
|
||||
// Sanitize name input
|
||||
$name = mysql_real_escape_string( $name );
|
||||
|
||||
// Update database
|
||||
$query = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );";
|
||||
$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
|
||||
|
||||
//mysql_close();
|
||||
}
|
||||
|
||||
?>
|
||||
24
dvwa/vulnerabilities/xss_s/source/medium.php
Normal file
24
dvwa/vulnerabilities/xss_s/source/medium.php
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
<?php
|
||||
|
||||
if( isset( $_POST[ 'btnSign' ] ) ) {
|
||||
// Get input
|
||||
$message = trim( $_POST[ 'mtxMessage' ] );
|
||||
$name = trim( $_POST[ 'txtName' ] );
|
||||
|
||||
// Sanitize message input
|
||||
$message = strip_tags( addslashes( $message ) );
|
||||
$message = mysql_real_escape_string( $message );
|
||||
$message = htmlspecialchars( $message );
|
||||
|
||||
// Sanitize name input
|
||||
$name = str_replace( '<script>', '', $name );
|
||||
$name = mysql_real_escape_string( $name );
|
||||
|
||||
// Update database
|
||||
$query = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );";
|
||||
$result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' );
|
||||
|
||||
//mysql_close();
|
||||
}
|
||||
|
||||
?>
|
||||
Loading…
Add table
Add a link
Reference in a new issue