Web渗透测试与防护（慕课版） 课件 单元7 跨站脚本（XSS）攻击与防护.pptx

;引入;;XSS的基本定义;;;;XSS的分类;反射型XSS攻击的工作原理：;XSS攻击的工作原理;;;谢谢观看！;;引入;;;反射型跨站脚本攻击（XSS）渗透测试流程：;?php header (X-XSS-Protection: 0); // Is there any input? if( array_key_exists( name, $_GET ) $_GET[ name ] != NULL ) { // Feedback for end user echo preHello . $_GET[ name ] . /pre; } ?;?php header (X-XSS-Protection: 0); // Is there any input? if( array_key_exists( name, $_GET ) $_GET[ name ] != NULL ) { // Get input $name = str_replace( script, , $_GET[ name ] ); // Feedback for end user echo preHello ${name}/pre; } ?;?php header (X-XSS-Protection: 0); // Is there any input? if( array_key_exists( name, $_GET ) $_GET[ name ] != NULL ) { // Get input $name = preg_replace( /(.*)s(.*)c(.*)r(.*)i(.*)p(.*)t/i, , $_GET[ name ] ); // Feedback for end user echo preHello ${name}/pre; }?;;;谢谢观看！;;;;存储型跨站脚本攻击（XSS）渗透测试流程：; … … $message = trim( $_POST[ mtxMessage ] ); $name = trim( $_POST[ txtName ] ); // Sanitize message input $message = stripslashes( $message ); $message = ((isset($GLOBALS[___mysqli_ston]) is_object($GLOBALS[___ mysqli_ston])) ? mysqli_real_escape_string($GLOBALS[___mysqli_ston], $message ) : ((trigger_error([MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work., E_USER_ERROR)) ? : )); // Sanitize name input $name = ((isset($GLOBALS[___mysqli_ston]) is_object($GLOBALS[___ mysqli_ston])) ? mysqli_real_escape_string($GLOBALS[___mysqli_ston], $name ) : ((trigger_error([MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work., E_USER_ERROR)) ? : )); // Update database $query = INSERT INTO guestbook ( comment, name ) VALUES ( $message, $name );; … …; … … $message = trim( $_POST[ mtxMessage ] ); $name = trim( $_POST[ txtName ] ); // Sanitize message input $message = strip_tags( addslashes( $message ) ); $message = ((isset($GLOBALS[___mysqli_ston]) is_object($GLOBALS[___ mysqli_ston])) ? mysqli_real_escape_string($G