├── README.md ├── xss10_mvm └── index.php ├── xss13_request_uri └── index.php ├── xss14_hidden └── index.php ├── xss15_frameBuster └── index.php ├── xss16_phpself └── index.php ├── xss17_passiveElement └── index.php ├── xss18_graduate └── index.php ├── xss19_party └── index.php ├── xss1_uploadfiles └── index.php ├── xss20_theend └── index.php ├── xss21_othersJquery └── index.php ├── xss2_getallheaders └── index.php ├── xss3_json └── index.php ├── xss4_referer └── index.php ├── xss5_redirect └── index.php ├── xss6_forcedownload └── index.php ├── xss7_textplain └── index.php ├── xss8_tag └── index.php └── xss9_plaintext └── index.php /README.md: -------------------------------------------------------------------------------- 1 | ## 阿里云先知社区xss挑战题源码 2 | 3 | @L3m0n师傅的wp 4 | >https://xianzhi.aliyun.com/forum/read/2044.html 5 | 6 | 微信公众号阅读地址: 7 | >http://mp.weixin.qq.com/s/d_UCJusUdWCRTo3Vutsk_A 8 | 9 | @LoRexxar师傅的解读 10 | >https://lorexxar.cn/2017/08/31/xss-ali/ 11 | 12 | 在线挑战地址 13 | >http://t.r00tuserclient.xyz/xianzhi_xss/ 14 | 15 | ### 题目uri 16 | 1. xss1_uploadfiles 17 | 2. xss2_getallheaders 18 | 3. xss3_json 19 | 4. xss4_referer 20 | 5. xss5_redirect 21 | 6. xss6_forcedownload 22 | 7. xss7_textplain 23 | 8. xss8_tag 24 | 9. xss9_plaintext 25 | 10. xss10_mvm 26 | 13. xss13_request_uri 27 | 14. xss14_hidden 28 | 15. xss15_frameBuster 29 | 16. xss16_phpself 30 | 17. xss17_passiveElement 31 | 18. xss18_graduate 32 | 19. xss19_party 33 | 20. xss20_theend 34 | 21. xss21_othersJquery 35 | 36 | ex: 37 | 题目1：http://t.r00tuserclient.xyz/xianzhi_xss/xss1_uploadfiles/ 38 | -------------------------------------------------------------------------------- /xss10_mvm/index.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | '" placeholder="username" maxlength="11" type="text"> 8 | 9 | -------------------------------------------------------------------------------- /xss13_request_uri/index.php: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /xss14_hidden/index.php: -------------------------------------------------------------------------------- 1 | 5 | 6 | 7 | 8 | 9 | 22 | 27 | 28 | -------------------------------------------------------------------------------- /xss16_phpself/index.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 |

10 | ",">",$output); 13 | echo $output; 14 | ?> 15 |

16 | 17 | -------------------------------------------------------------------------------- /xss17_passiveElement/index.php: -------------------------------------------------------------------------------- 1 | "; 8 | ?> -------------------------------------------------------------------------------- /xss18_graduate/index.php: -------------------------------------------------------------------------------- 1 | 7 | 8 | 9 | 10 | 11 | 12 | 21 | 22 | -------------------------------------------------------------------------------- /xss19_party/index.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 30 | 31 | 32 | ';?> 33 | 34 | -------------------------------------------------------------------------------- /xss1_uploadfiles/index.php: -------------------------------------------------------------------------------- 1 | "; 12 | $uploadOk = 1; 13 | } else { 14 | echo "File is not an image."; 15 | $uploadOk = 0; 16 | } 17 | } 18 | // Check if file already exists 19 | if (file_exists($target_file)) { 20 | echo "Sorry, file already exists."; 21 | $uploadOk = 0; 22 | } 23 | // Check file size 24 | if ($_FILES["fileToUpload"]["size"] > 500000) { 25 | echo "Sorry, your file is too large."; 26 | $uploadOk = 0; 27 | } 28 | // Allow certain file formats 29 | if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg" 30 | && $imageFileType != "gif" ) { 31 | echo "Sorry, only JPG, JPEG, PNG & GIF files are allowed."; 32 | $uploadOk = 0; 33 | } 34 | // Check if $uploadOk is set to 0 by an error 35 | if ($uploadOk == 0) { 36 | echo "Sorry, your file was not uploaded."; 37 | // if everything is ok, try to upload file 38 | } else { 39 | echo "The file ". basename( $_FILES["fileToUpload"]["name"]). " has been uploaded."; 40 | } 41 | ?> -------------------------------------------------------------------------------- /xss20_theend/index.php: -------------------------------------------------------------------------------- 1 | 11 | 12 | 13 | 14 | 15 | 18 | 19 | 20 | -------------------------------------------------------------------------------- /xss21_othersJquery/index.php: -------------------------------------------------------------------------------- 1 | 7 | 8 | 9 | 10 | 11 | 14 | 15 | 16 | 21 | 22 | -------------------------------------------------------------------------------- /xss2_getallheaders/index.php: -------------------------------------------------------------------------------- 1 | 6 | 7 | 8 | 9 | 10 | 11 | $value) { 19 | echo "$name: $value\n"; 20 | } 21 | } 22 | ?> 23 | 24 | -------------------------------------------------------------------------------- /xss3_json/index.php: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /xss4_referer/index.php: -------------------------------------------------------------------------------- 1 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | -------------------------------------------------------------------------------- /xss5_redirect/index.php: -------------------------------------------------------------------------------- 1 | 8 | 9 | 10 | 11 | 12 | 13 | 如果跳转失败请点我";?> 14 | 15 | -------------------------------------------------------------------------------- /xss6_forcedownload/index.php: -------------------------------------------------------------------------------- 1 | "http://0" && substr($_GET["url"],0,8)<>"http://1" && substr($_GET["url"],0,8)<>"http://l" && strpos($_GET["url"], '@') === false) 5 | { 6 | $opts = array('http' => 7 | array( 8 | 'method' => 'GET', 9 | 'max_redirects' => '0', 10 | 'ignore_errors' => '1' 11 | ) 12 | ); 13 | $context = stream_context_create($opts); 14 | $url=str_replace("..","",$_GET["url"]); 15 | $stream = fopen($url, 'r', false, $context); 16 | echo stream_get_contents($stream); 17 | } 18 | else 19 | { 20 | echo "Bad URL!"; 21 | } 22 | ?> -------------------------------------------------------------------------------- /xss7_textplain/index.php: -------------------------------------------------------------------------------- 1 | "http://0" && substr($_GET["url"],0,8)<>"http://1" && substr($_GET["url"],0,8)<>"http://l" && strpos($_GET["url"], '@') === false) 5 | { 6 | $opts = array('http' => 7 | array( 8 | 'method' => 'GET', 9 | 'max_redirects' => '0', 10 | 'ignore_errors' => '1' 11 | ) 12 | ); 13 | $context = stream_context_create($opts); 14 | $url=str_replace("..","",$_GET["url"]); 15 | $stream = fopen($url, 'r', false, $context); 16 | echo stream_get_contents($stream); 17 | } 18 | else 19 | { 20 | echo "Bad URL!"; 21 | } 22 | ?> -------------------------------------------------------------------------------- /xss8_tag/index.php: -------------------------------------------------------------------------------- 1 | "http://0" && substr($_GET["url"],0,8)<>"http://1" && substr($_GET["url"],0,8)<>"http://l" && strpos($_GET["url"], '@') === false) 5 | { 6 | $rule="/<[a-zA-Z]/"; 7 | $opts = array('http' => 8 | array( 9 | 'method' => 'GET', 10 | 'max_redirects' => '0', 11 | 'ignore_errors' => '1' 12 | ) 13 | ); 14 | $context = stream_context_create($opts); 15 | $url=str_replace("..","",$_GET["url"]); 16 | $stream = fopen($url, 'r', false, $context); 17 | $content=stream_get_contents($stream); 18 | if(preg_match($rule,$content)) 19 | { 20 | echo "XSS Detected!"; 21 | } 22 | else 23 | { 24 | echo $content; 25 | } 26 | } 27 | else 28 | { 29 | echo "Bad URL!"; 30 | } 31 | ?> -------------------------------------------------------------------------------- /xss9_plaintext/index.php: -------------------------------------------------------------------------------- 1 | 5 | <?php echo $_GET["text"];?> --------------------------------------------------------------------------------