Shulou(Shulou.com)06/01 Report--

What are the basic knowledge of XSS vulnerabilities, many novices are not very clear about this, in order to help you solve this problem, the following editor will explain for you in detail, people with this need can come to learn, I hope you can gain something.

I. XSS vulnerability harm

1. Steal all kinds of user accounts

2. Steal user cookie

3. Hijack user session

4. Brush the flow rate and execute the pop-up window

Second, vulnerability verification

1. Enter the following code in the login box and click Log in

Alert (123)

2. A pop-up dialog box indicates that there is a xss vulnerability.

III. Classification of vulnerabilities

1. Reflective type

It can only be used once, and special connections must be constructed for the target to click on, such as the login interface above.

2. Storage type

Special statements are stored on the page, and as long as the target visits the page, it will be attacked, such as a message board.

3. Dom type

Do not interact with the server, using the trigger when rendering the web page locally

IV. Payload construction

Pseudo protocol

Aiyou

Event

Fifth, bypass protection

1. Case bypass

Alert (123)

2. The use of quotation marks

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.