├── example.png ├── how_to_work.png ├── xss_ctf1.php ├── xss_ctf4.php ├── xss_ctf2.php ├── xss_ctf3.php ├── readme.md ├── xss_hunter.js └── xss_test.php /example.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lcatro/XSS-hunter/HEAD/example.png -------------------------------------------------------------------------------- /how_to_work.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lcatro/XSS-hunter/HEAD/how_to_work.png -------------------------------------------------------------------------------- /xss_ctf1.php: -------------------------------------------------------------------------------- 1 | ') && strstr($_GET['keyword'],'')) 5 | echo ''; 6 | echo '

'.$_GET['keyword']; 7 | } else { 8 | echo ''; 9 | } 10 | 11 | ?> -------------------------------------------------------------------------------- /xss_ctf4.php: -------------------------------------------------------------------------------- 1 | 2 |
'.$_POST['Comment']; 5 | $comment_file=fopen('./data.txt','a'); 6 | fwrite($comment_file,$comment_data); 7 | fclose($comment_file); 8 | } 9 | ?> 10 | 11 | 12 | 13 |
14 | 18 |
19 |
20 | Comment:
21 | 22 |
23 | 24 | 25 | -------------------------------------------------------------------------------- /xss_ctf2.php: -------------------------------------------------------------------------------- 1 | 2 | ') && strstr($_POST['username'],'')) 5 | echo ''; 6 | if (strstr($_POST['password'],'')) 7 | echo ''; 8 | } 9 | ?> 10 | 11 | 12 | 13 |
14 | Username:
15 | Password:
16 | 17 |
18 | 19 | 20 | -------------------------------------------------------------------------------- /xss_ctf3.php: -------------------------------------------------------------------------------- 1 | 2 | ') && strstr($_POST['Comment'],'')) { 5 | echo ''; 6 | } else { 7 | $comment_data='

'.$_POST['Comment']; 8 | $comment_file=fopen('./data.txt','a'); 9 | fwrite($comment_file,$comment_data); 10 | fclose($comment_file); 11 | } 12 | } 13 | ?> 14 | 15 | 16 | 17 |
18 | 22 |
23 |
24 | Comment:
25 | 26 |
27 | 28 | 29 | -------------------------------------------------------------------------------- /readme.md: -------------------------------------------------------------------------------- 1 | 2 | ###XSS-hunter 3 | --- 4 | 5 | 目前国内的Android APP 较为广泛使用Webview 的方法快速开发产品,如果产品本身在Webview 上的设计出现了安全问题,很有可能会产生XSS 跨站甚至是跨域的脚本注入(对于Webview 上展示的页面来说,出现XSS 的危害不亚于RCE 远程代码执行[PK AV 浏览器专辑:疗一疗本土瘤览器](https://github.com/lcatro/Hacker_Document/blob/master/Browser/%E7%96%97%E4%B8%80%E7%96%97%E6%9C%AC%E5%9C%9F%E7%98%A4%E8%A7%88%E5%99%A8.pdf),所有的Webview 上的元素和执行逻辑都可以被XSS 所控制,如果XSS 出现在特权域,同样也可以导致RCE 安全问题[KCon-2013 黑哥议题:去年跨过的客户端](https://github.com/lcatro/Hacker_Document/blob/master/Browser/%E5%8E%BB%E5%B9%B4%E8%B7%A8%E8%BF%87%E7%9A%84%E5%AE%A2%E6%88%B7%E7%AB%AF.pptx)).`XSS-hunter` 通过分析Webview 页面上的XSS 特征,向开发人员提供APP 在发布之后来自用户使用的过程中回传有关APP Webview 里面的XSS 信息收集报告,加速热补丁更新速度,及时止损..
6 | 下面是常见的反射型XSS 测试用例:
7 | 8 | http://127.0.0.1/xss_test.php?xss_test_1= -- 基本测试 9 | http://127.0.0.1/xss_test.php?xss_test_1= -- DOM 元素事件XSS 执行测试 10 | http://127.0.0.1/xss_test.php?xss_test_1=