lay_loge的博客

题目：Stage 1: Bypass Presentational Layer Access Control. As regular employee ‘Tom’, exploit weak access control to use the Delete function from the Staff List page. Verify that Tom’s profile can be de...

一、题目This lesson is an example of how a website might support a phishing attackBelow is an example of a standard search feature.Using XSS and HTML insertion, your goal is to:Insert html to that req...

一、Insure Communication不安全的通信——Insecure Login不安全的登录1.题目：For this lesson you need to have a server client setup. Please refer to theTomcat Configuration in the Introduction section.Stage1: In this st...

四、Multi Level Login 1（1）题目：STAGE 1: This stage is just to show how a classic multi login works. Your goal is to do a regular login as Jane login works. Your goal is to do a regular login as Jane wit...

一、Password Strength 密码强度（1）题目：The Accounts of your Webapplication are only as save as the passwords. For this exercise, your job is to test several passwords on https://www.cnlab.ch/codecheck. You m...

一、Code Quality 代码质量1.题目：Below is an example of a forms based authentication form. Look for clues to help you log in.以下是基于认证登录表单中的一个代表，尝试着寻找蛛丝马迹以帮助你的登录。2.课程目标：课程标题：如何从html源码中发现线索课程主题：开发人员因将TODO，...

一、OWASP TOP 10(2017)关于XSS（跨站脚本）的描述XSS漏洞发生在当应用程序发送给浏览器的页面中包含用户提供的数据，而这些数据没有经过适当的验证或转义（escape)或者没有使用安全的JavaScript API,就会导致跨站脚本漏洞。主要有两种已知的跨站漏洞类型：1）存储式；2）反射式。这两种类型既可以发生在服务器上也可以发生在客户端。大部分服务器类型跨站脚本漏洞通过测试或代...

一、Silent Transactions Attacks 静默交易攻击（1）题目：This is a sample internet banking application - money transfer page.It shows below your balance, the account you are transferring to and amount you will t...

一、同源策略保护 Same Origin Policy Protection（1）题目：This exercise demonstrates the Same Origin Policy Protection. XHR requests can only be passed back to the originating server. Attempts to pass data to a no...

Cross-site scripting简称跨站脚本攻击，通常也称为XSS。参考一、XSS的危害1、盗取各类用户帐号，如机器登录帐号、用户网银帐号、各类管理员帐号2、控制企业数据，包括读取、篡改、添加、删除企业敏感数据的能力3、盗窃企业重要的具有商业价值的资料4、非法转账5、强制发送电子邮件6、网站挂马7、控制受害者机器向其它网站发起攻击二、XSS的分类XSS主要可分为三种，...

题目：The ‘guest’ user has access to all the files in the lesson_plans directory. Try to break the access control mechanism and access a resource that is not in the listed directory. After selecting a f...

题目：This lesson has two stages. Stage 1 teaches you how to do HTTP Splitting attacks while stage 2 builds on that to teach you how to elevate HTTP Splitting to Cache Poisoning.Enter a language for the ...

LAB：Cross Site Scripting跨站脚本攻击一、题目Stage1：执行一个存储式的跨站脚本攻击。作为TOM，在编辑个人简历的页面“街区”信息一栏中，实施一个存储式跨站脚本攻击。验证用户“Jerry”受到这一攻击的影响。PS:用户的密码是账号名的首字母。二、课程主题课程计划：如何实现跨站脚本攻击概念：输入验证是一个很好的方法，尤其是验证那些以后将用作操作系统命令、脚...