Shulou(Shulou.com)06/02 Report--

This article introduces the relevant knowledge of "what is the principle of storage XSS attacks in Web network security". In the operation of actual cases, many people will encounter such a dilemma, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!

Storage XSS attack

The function of the storage XSS page is to obtain the message information, title and content entered by the user, then insert the title and content into the database, and output the message information of the database to the page, as shown in figure 71.

When the user writes 1 at the title and 2 at the content, the data in the database is shown in figure 72.

Figure 72 Save message information to database

When the input title is

. Then when the title is output to the page, the page executes the

Resulting in a pop-up window At this point, the XSS here is persistent, that is, anyone accessing the modified URL will pop up a box showing "/ xss/", as shown in figure 73.

Code Analysis of Storage XSS

In the PHP code of the stored XSS, get the POST parameter title and parameter content, then insert the parameter into the database table XSS, and then query the data in the table XSS through the select query and display it on the page, as shown below.

Message board input message title: content:

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.