Intigriti Easter XSS Challenge 详细解析<\/h1>

挑战概述<\/h2>
这是一个由Intigriti发布的XSS挑战，成功在限定时间内完成可以获得一年的Burp Suite正版证书。挑战要求利用跨站脚本漏洞绕过各种安全限制。<\/p>

代码分析<\/h2>

主要功能逻辑位于script.js<\/code>文件中：<\/p>

var<\/span> hash<\/span> =<\/span> document.location<\/span>.hash<\/span>.substr<\/span>(1<\/span>);
<\/span><\/span>if<\/span> (hash<\/span>){
<\/span><\/span>    displayReason<\/span>(hash<\/span>);
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>document.getElementById<\/span>("reasons"<\/span>).onchange<\/span> =<\/span> function<\/span>(e<\/span>){
<\/span><\/span>    if<\/span>(e<\/span>.target<\/span>.value<\/span> !=<\/span> ""<\/span>)
<\/span><\/span>        displayReason<\/span>(e<\/span>.target<\/span>.value<\/span>);
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>function<\/span> reasonLoaded<\/span>() {
<\/span><\/span>    var<\/span> reason<\/span> =<\/span> document.getElementById<\/span>("reason"<\/span>);
<\/span><\/span>    reason<\/span>.innerHTML<\/span> =<\/span> unescape<\/span>(this<\/span>.responseText<\/span>);
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>function<\/span> displayReason<\/span>(reason<\/span>){
<\/span><\/span>    window.location<\/span>.hash<\/span> =<\/span> reason<\/span>;
<\/span><\/span>    var<\/span> xhr<\/span> =<\/span> new<\/span> XMLHttpRequest<\/span>();
<\/span><\/span>    xhr<\/span>.addEventListener<\/span>("load"<\/span>, reasonLoaded<\/span>);
<\/span><\/span>    xhr<\/span>.open<\/span>("GET"<\/span>, `.\/reasons\/<\/span>${<\/span>reason<\/span>}<\/span>.txt`<\/span>);
<\/span><\/span>    xhr<\/span>.send<\/span>();
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>代码逻辑流程<\/h3>

从URL的hash部分获取参数<\/li>
如果有hash值，调用displayReason<\/code>函数<\/li>
displayReason<\/code>函数：

将reason存入window.location.hash<\/li>
发起AJAX请求获取.\/reasons\/${reason}.txt<\/code>文件<\/li>
请求完成后调用reasonLoaded<\/code>函数<\/li>
<\/ul>
<\/li>
reasonLoaded<\/code>函数：

获取id为"reason"的元素<\/li>
将响应文本unescape后设置为该元素的innerHTML<\/li>
<\/ul>
<\/li>
<\/ol>
漏洞分析<\/h2>
初始测试<\/h3>
直接尝试在URL的hash部分插入XSS payload：<\/p>
https:\/\/example.com\/#<script>alert(1)<\/script>
<\/code><\/pre>
发现404页面会对特殊字符进行编码处理，并将%<\/code>替换为_<\/code>，无法直接利用。<\/p>
突破点发现<\/h3>
尝试访问.htaccess<\/code>等受保护文件时，发现403响应中的XSS语句完整保留，未经过滤。<\/p>
关键发现：<\/p>

403错误页面不会对响应内容进行处理<\/li>
可以构造特殊请求使服务器返回403错误<\/li>
<\/ul>
利用限制<\/h3>

AJAX请求默认访问reasons<\/code>文件夹下内容，要访问.htaccess<\/code>需要跳转上级目录<\/li>
需要二次编码.htaccess<\/code>参数才能获取正确的response<\/li>
<\/ol>
绕过CSP限制<\/h2>
CSP规则为：<\/p>
default-src 'self';
<\/code><\/pre>
限制：<\/p>

所有资源必须来自同源<\/li>
无法直接执行内联脚本<\/li>
<\/ul>
解决方案<\/h3>
利用404页面返回的内容作为JS代码执行：<\/p>

通过404页面返回的内容构造JS语句<\/li>
使用script标签的src属性引入<\/li>
需要注意单引号的闭合<\/li>
<\/ol>
最终利用链<\/h2>
关键步骤<\/h3>

构造payload使服务器返回403错误<\/li>
从403响应中获取未过滤的内容<\/li>
利用这些内容构造JS执行环境<\/li>
<\/ol>
绕过innerHTML限制<\/h3>
由于innerHTML<\/code>插入的<script><\/code>标签不会执行，需要使用iframe<\/code>的srcdoc<\/code>属性：<\/p>
<iframe<\/span> srcdoc<\/span>=<\/span>'<script src="x%27-alert(document.domain)-%27"><\/script>'<\/span>>
<\/span><\/span><\/code><\/pre>完整Payload<\/h3>

构造iframe payload：<\/li>
<\/ol>
<iframe<\/span> srcdoc<\/span>=<\/span>'<script src="x%27-alert(document.domain)-%27"><\/script>'<\/span>>
<\/span><\/span><\/code><\/pre>

对payload进行二次URL编码<\/p>
<\/li>

放入location.hash中触发<\/p>
<\/li>
<\/ol>
总结<\/h2>
这个挑战展示了如何：<\/p>

利用服务器对不同错误页面的不同处理方式<\/li>
绕过CSP限制执行JS代码<\/li>
解决innerHTML对script标签的限制<\/li>
通过编码技巧绕过过滤机制<\/li>
<\/ol>
关键突破点在于发现403错误页面不会过滤响应内容，从而可以利用它来存储和传递XSS payload。<\/p>

Intigriti Easter XSS Challenge 详细解析<\/h1>

挑战概述<\/h2> 这是一个由Intigriti发布的XSS挑战，成功在限定时间内完成可以获得一年的Burp Suite正版证书。挑战要求利用跨站脚本漏洞绕过各种安全限制。<\/p>

漏洞分析<\/h2>

最终利用链<\/h2>

挑战概述<\/h2>
这是一个由Intigriti发布的XSS挑战，成功在限定时间内完成可以获得一年的Burp Suite正版证书。挑战要求利用跨站脚本漏洞绕过各种安全限制。<\/p>