Shulou(Shulou.com)05/31 Report--

This article shows you how to build and use XSS Platform in Web security. The content is concise and easy to understand, which will definitely brighten your eyes. I hope you can get something through the detailed introduction of this article.

Practice of Building and using XSS Platform in Web Security

I. background

XSS Platform is a very classic XSS penetration test management system, which was developed by the original author in 2011, but it can not run in PHP7 environment because it has not been maintained for a long time.

The author recently spent some time porting the source code to the PHP7 environment, while adding installation features; in addition, I also fixed some loose syntax problems in the previous code, and adjusted the style of some forms, while putting the source code into GitHub for peer research in need. In order to simplify the installation steps, I specially wrote an article to help you.

II. Summary of operation

Source code download

Installation configuration

Attack testing

Download the source code

Github address: https://github.com/78778443/xssplatform

First, use the cd command to place the code in the specified location. Refer to the command as follows

Cd / Users/song/mycode/safe/

Then download the source code through git. Refer to the command as follows:

Git clone https://github.com/78778443/xssplatform.git IV. Install configuration 4.1 to add virtual hosts

XSS Platform needs to run in the root directory, so you need to add a separate virtual host. Taking the nginx environment as an example, the configuration code for configuring a virtual host is as follows:

Server {listen 80; server_name xss.localhost; root / Users/song/mycode/safe/xssplatform/; rewrite "^ / ([0-9a-zA-Z] {6}) $" / index.php?do=code&urlKey=$1 last; rewrite "^ / do/auth/ (\ w?) (/ domain/ ([\ w\.] +?))? $" / index.php?do=do&auth=$1&domain=$3 last Rewrite "^ / register/ (. *?) $" / index.php?do=register&key=$1 last; rewrite "^ / register-validate/ (. *?) $" / index.php?do=register&act=validate&key=$1 last; location / {index index.html index.htm index.php;} location ~\ .php$ {fastcgi_pass 127.0.0.1 register-validate/ 9000; fastcgi_index index.php Fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params;}}

After modifying the configuration file, you need to restart nginx for its configuration to take effect. For more information on restart commands, please see below:

Nginx-s reload4.2 add HOST record

The hosts file location is / etc/hosts, which is edited by the vim command, as shown in the following reference command:

Vim / etc/hosts

Add a line of records to the file as follows:

127.0.0.1 xss.localhost4.3 system installation

After adding a virtual host and host resolution, the platform can be accessed through a browser. When the URL address is opened as http://xss.localhost/, it will automatically jump to the installation interface, as shown in the following figure.

After clicking the I agree to this agreement button, you will jump to the second step to fill in the configuration information interface, where you need to fill in the database information and administrator account information, as shown in the following figure

If the database information is filled in correctly, you will see a successful mention of the imported data, as shown in the following figure

This means that the installation is successful.

4.4 functional introduction

First, get familiar with some of the functions of XSS Platform. Click on the installation interface to enter the home page, and you will be required to log in first. Enter the administrator account information you just filled in in the login interface, click to log in, and automatically jump to the home page after successful login, as shown in the following figure.

You can see a default project on the home page. After clicking default, you can see the list of victims, but there must be no data for the installation, as shown in the following figure.

There is a link to view the code at the top right of the figure. Click in to view the attack code prepared by XSS Platform, as shown in the following figure.

Fifth, attack testing

Now the author will start some practical demonstrations. First of all, he will find out a XSS vulnerability in the permeate penetration testing system and insert the attack code of XSS Platform into it.

Then impersonate the victim to visit the attacked page, check the cookie value received in the XSS platform system, and finally use the received cookie to impersonate the victim.

The source code of permeate penetration testing system and the address of building tutorial can be found in: https://github.com/78778443/permeate

5.1 insert XSS code

The author has successfully built the permeate penetration testing system before. Here we will post a post and insert the attack code prepared in XSS Platform into the title of the post, as shown in the following figure.

Click the publish button to post the post successfully. Assume that you are a victim and visit the list of posts. The title of the post will be read in the list, and the tag of the post will not be displayed by the browser, as shown in the following figure.

5.2 receive cookie

You can see that it is not shown. Go back to XSS Platform and look at the list of victims in the default project. You can see a victim, as shown in the following figure.

It indicates that the victim has been successfully hit, and the cookie value and header information of the other party have been obtained through the attack code.

5.3 replace cookie

After having the cookie value, the author will use another browser to log in to the victim's account by modifying cookie, as shown in the following figure to modify the operation of cookie

When it is refreshed again, it has become the login identity, as shown in the following figure

The above is what the practice of building and using XSS Platform in Web security is like. Have you learned any knowledge or skills? If you want to learn more skills or enrich your knowledge reserve, you are welcome to follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.