XSS攻擊
阿新 • • 發佈：2017-06-28
aid splay post including itl ati lease one doc 
XSS又叫CSS (Cross Site Script) ，跨站腳本攻擊。它指的是惡意攻擊者往web頁面裏插入惡意的html代碼，當用戶瀏覽該頁之時，嵌入其中web裏面的html代碼會被執行，從而達到惡意用戶的特殊目的。
##############xss攻擊############# **************************************** #不帶if判斷進行關鍵字過濾代碼 msg=[] def comment(request): if request.method =="GET": return render(request,‘comment.htmlViews‘) else: v = request.POST.get(‘content‘) msg.append(v) return render(request,‘comment.html‘) def index(request): return render(request,‘index.html‘,{‘msg‘:msg}) ***************************************** ***************************************** #帶if判斷進行關鍵字過濾代碼 msg=[]def comment(request): if request.method =="GET": return render(request,‘comment.html‘) else: v = request.POST.get(‘content‘) if "script" in v: return render(request,‘comment.html‘,{‘error‘:‘黑你大爺‘}) else: msg.append(v) returnrender(request, ‘comment.html‘) def index(request): return render(request,‘index.html‘,{‘msg‘:msg}) ********************************************* ********************************************* #測試： def test(request): from django.utils.safestring import mark_safe temp = "<a href=‘http://www.baidu.com‘>百度</a>" newtemp = mark_safe(temp) return render(request, ‘test.html‘, {‘temp‘: newtemp}) ******************************************** 註： # 1.用<script>alert(11222)</script>模擬攻擊代碼 # 2.過濾攻擊方式： a.在接受評論端（前端代碼）不要寫 |safe. 比如：<div>{{ item|safe }}</div> #b.在後臺代碼中進行if關鍵字過濾判斷 3.test.html： # 裏面如果不加|safe,渲染出來的只是普通字符“ <a href=‘http://www.baidu.com‘>百度</a>” # 如果加|safe,渲染出來的是<a>標簽連接 #後端標記字符串安全： （前端不加safe,後端加safe） #導入模塊 ：from django.utils.safestring import mark_safe #說明安全：ewtemp = mark_safe(temp)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> <form method="POST" action="/comment/"> <input type="text" name="content"> <input type="submit" value="提交"/>{{ error }} </form> </body> </htcomment.html
<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> <h3>評論</h3> {% for item in msg %} <div>{{ item }}</div> {# <div>{{ item|safe }}</div>#} {% endfor %} </body> </htindex.html
<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> {# {{ temp|safe }}#} {{ temp }} </body> </htmtest.html
"""day73 URL Configuration The `urlpatterns` list routes URLs to views. For more information please see: https://docs.djangoproject.com/en/1.10/topics/http/urls/ Examples: Function views 1. Add an import: from my_app import views 2. Add a URL to urlpatterns: url(r‘^$‘, views.home, name=‘home‘) Class-based views 1. Add an import: from other_app.views import Home 2. Add a URL to urlpatterns: url(r‘^$‘, Home.as_view(), name=‘home‘) Including another URLconf 1. Import the include() function: from django.conf.urls import url, include 2. Add a URL to urlpatterns: url(r‘^blog/‘, include(‘blog.urls‘)) """ from django.conf.urls import url from django.contrib import admin from app01 import views urlpatterns = [ url(r‘^admin/‘, admin.site.urls), url(r‘^test/‘,views.test), url(r‘^comment/‘,views.comment), url(r‘^index/‘,views.index), ]urls
XSS攻擊