Google XSS game writeup

鐢ㄨ繃Chrome鐨勫簲璇ョ煡閬撳畠鐨刋SS Auditor锛屽畠鍙槸鐏帀浜嗕笉灏慩SS浠ｇ爜鍛�……Google瀵筙SS鏄緢鏈夌爺绌剁殑锛屼笉鐒朵篃涓嶆暍澶у紶鏃楅紦鐨勬偓璧忥紙7500鍒�鍝︿翰锛夛紝杩樺紑鍙戜簡涓�涓猉SS灏忔父鎴� http://xss-game.appspot.com/ 锛堥渶FQ……锛夛紝涓�鍏辨湁6鍏筹紝鍋氬畬鏈�“澶ц泲绯�”濂栧姳鍝︼紒涓嬮潰灏辨潵鐪嬩竴涓嬨��

Level 1: Hello, world of XSS

鏃㈢劧鏄�“Hello world”绾у埆鐨勶紝鎯冲繀灏辨槸绠�绠�鍗曞崟寮逛釜妗嗗湪杈撳叆妗嗛噷杈撳叆<script>alert(1)</script>锛岀劧鍚庣偣鍑绘寜閽彁浜わ紝寮规浜嗭紝杞绘澗鎰夊揩銆�

Level 2: Persistence is key

杩欎釜绫讳技璇勮妗嗭紝<script>琚繃婊や簡锛岃瘯璇曟彃鍏ュ浘鐗囨爣绛�<img src=# onerror=alert(1) />锛屾彁浜ゅ悗鎴愬姛寮圭獥浜嗭紝鑰屼笖鏄瓨鍌ㄥ瀷XSS锛屾瘡娆℃煡鐪嬮兘浼氬脊妗�

Level 3: That sinking feeling…

娌℃湁杈撳叆妗嗭紝鏈変笁寮犲浘鐗囧彲浠ュ垏鎹紝鍙互鐪嬪埌鍥剧墖鍒囨崲璺烾RL涓�#涔嬪悗鐨勬暟瀛楁湁鍏崇郴锛屾煡鐪嬫簮浠ｇ爜涔嬪悗鍙戠幇<script>鏍囩涓湁杩欎箞涓�鍙�html += "<img src='/static/level3/cloud" + num + ".jpg' />";锛屽緢鏄庢樉鏄喅瀹氬浘鐗囧湴鍧�鐨勶紝鑰宯um鏉ヨ嚜浜�#鍚庣殑杈撳叆锛屾垜浠皾璇曟敞鍏ワ紝娉ㄥ叆鐨勬椂鍊欒闂悎璇彞锛屼笉瑕佸紕鍑鸿娉曢敊璇紝鎴戠殑璇彞鏄�1.jpg' onload=alert(1) '1锛岃繖鏍峰氨鍙樻垚<img src='/static/level3/cloud1.jpg' onload=alert(1) '1.jpg' ?>锛岃繖鏍凤紝璁块棶http://xss-game.appspot.com/level3/frame#1.jpg‘ onload=alert(1) ‘1锛屽嵆鍙脊妗�

Level 4: Context matters

鏈夎緭鍏ユ锛屾槸涓畾鏃跺櫒绋嬪簭锛屾煡鐪媡imer.html鐨勬簮浠ｇ爜鍙戠幇<img src="/static/loading.gif" onload="startTimer('{{ timer }}');" />锛屽叾涓殑timer灏辨槸杈撳叆妗嗙殑杈撳叆锛屽皾璇曟敞鍏ュ苟娉ㄦ剰闂悎璇彞锛屽湪杈撳叆妗嗕腑杈撳叆1'),alert(1) ('渚垮彲寮规銆�

Level 5: Breaking protocol

杩欎釜铏界劧涔熸湁杈撳叆妗嗭紝浣嗘槸鎻愪氦鍚庡彂鐢熻烦杞紝鑰屼笖璺宠浆鍒扮殑缃戦〉璺熷垰鎵嶈緭鍏ョ殑涓滆タ濂藉儚娌″暐鍏崇郴……鏌ョ湅signup.html婧愪唬鐮佸彂鐜帮紝鏄湡鐨勬病鍏崇郴……涓嶈繃鍙戠幇杩欎箞涓�鍙�<a href="{{ next }}">Next >></a>锛孨ext璺宠浆鍚庣殑鍦板潃鏄敱URL涓殑鍙橀噺next鍐冲畾鐨勶紝浜庢槸鎴戜究鎯冲湪姝ゆ敞鍏�signup" onmouseover=alert(1) "锛岀粨鏋滃弻寮曞彿琚浆鎹㈡垚浜�&quot锛屽confirm.html椤甸潰鐨勬敞鍏ヤ緷鏃ф棤鏁堬紝椤甸潰璺虫潵璺冲幓鐨勫氨鏄笉寮规……鏃犲涔嬩笅鐪嬩簡鐪嬫彁绀猴紝鎯宠捣瀵�鏍囩杩樻湁href="javascript:alert(1)"杩欑鎵цjs鐨勬柟寮忓晩锛屾妸next璧嬪�兼垚javascript:alert(1)锛屽埛鏂拌缃戦〉锛岀劧鍚庣偣鍑�“NEXT”锛屽脊妗嗭紒

Level 6: Follow the 馃悋

杩欎釜鐨勬剰鎬濆氨鏄鍔犺浇涓�涓閮ㄧ殑js浠ｇ爜鏉ュ脊妗嗭紝澶栭儴浠ｇ爜鐨勫湴鍧�涓篣RL涓�#鍚庨潰鐨勫唴瀹广�傚閮╦s浠ｇ爜鍙互浣跨敤XSS骞冲彴鑾峰緱锛堟悳涓�涓嬪氨鑳芥壘鍒帮級锛屼絾鏄�氳繃鏌ョ湅婧愮爜鎴戜滑鍙戠幇瀹冨http(s)杩涜浜嗘鏌ヨ繃婊わ紝鐩稿叧浠ｇ爜濡備笅

if (url.match(/^https?:\/\//)) {
 setInnerText(document.getElementById("log"),
          "Sorry, cannot load a URL containing \"http\".");
        return;
      }

鍏朵腑鐨勫彉閲弖rl灏辨槸URL涓�#涔嬪悗鐨勫唴瀹癸紝浠旂粏瑙傚療姝ｅ垯寮忔垜浠彂鐜板畠鏄粠寮�濮嬭繘琛屽尮閰嶇殑锛屽鏋滄垜浠湪#涔嬪悗鍔犱釜绌烘牸锛屽啀鍔犱笂鎴戜滑瑕佸姞杞界殑杩滅▼js鍏ㄥ湴鍧�锛屼細鎬庝箞鏍峰憿锛熸垚鍔熺粫杩囦簡璇ユ鏌ワ紝寮规锛�

涔嬪悗锛屼究鍑虹幇绁濊春鐨勮泲绯曞暒锛屽晩鍝堬紒

鈥�