Shulou(Shulou.com)06/03 Report--

A problem that can quickly verify cross-site scripting, along with link injection and framework phishing. An important requirement to be able to verify cross-site quickly is that you need to know how to use burpsuite's proxy module.

The role of four more important buttons.

Forward: submit packets to the server

Drop: discards the current packet and does not upload it to the server

Intercept off/on: truncate the agent. Intercepts packets from the client requesting the server.

Action: send packets to other functional modules, and so on.

Let's test a problem.

First of all, we need to make sure that the parameter cityName is in that position on the page.

I won't say much about how to find this cityName parameter and how to find it. Please take a look at the picture.

Next, we will trigger this parameter and pass it to the server

Open burpsuite, and then click the button to pass the parameter

Look, it's been intercepted. (note: burpsuite does not display Chinese properly)

Let's submit it first, because we don't need this packet. (note: you can also try to add cross-site code here, but it won't work.)

(note: don't be surprised, there is no problem with the self-testing function, but some packets have not interacted during the truncation process.) then, I will choose the market.

Then we put a piece of xss code under the target parameter

Then, all we have to do is keep submitting it.

The following picture is the wrong information.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.