bWAPP之环境搭建及HTML注入

一、环境搭建

在phpstudy这一集成环境中搭建此漏洞练习靶场
（1）下载链接：

https://sourceforge.net/projects/bwapp/files/latest/download

（2）安装步骤：

下载后解压文件，将文件放在WWW目录下
在admin/settings．php下更改数据库连接设置
username和password设置成自己数据库的用户名和密码

3. 运行PHPStudy，然后在浏览器打开http://127.0.0.1/bWAPP/install.php

点击here创建数据库
4. 安装成功，进入靶场主界面
输入用户名（bee）和密码（bug）

二、开始做题

HTML Injection - Reflected (GET)

那我们直接开始第一题吧

这里有两个框让我们输入，先看看源码

这里把我们输入的fistname和lastname直接带进htmli了

Htmli是按照我们等级来给函数的，我们看看no_check函数

没有过滤就直接输入了,所以我们直接输入xss代码即可

<script>alert(/xss/)</script>

我们再把难度设置成medium也就是中等难度

这里用了把尖括号换成实体了，但是用了urldecode函数，我们可以把代码先编码成url形式再输入进去

%3cscript%3ealert(%2fxss%2f)%3c%2fscript%3e

再把难度设置成高

看看源码，这里把我们的符号都设置成实体了，所以这是安全的

HTML Injection - Reflected (POST)

这关和上一关是一样的就是换成了POST运输过来了，这里就不一一说明了

HTML Injection - Reflected (URL)

low

我们可以发现通关url可以传输，所以我们在url中构造语句

但是由于url栏里直接构造代码会被进行url编码，所以通过burp抓包来修改url信息进行提交请求

在burp抓到的包里修改url，如图所示

好，成功了

medium&&High

查看源代码
这个就是过滤条件了，可以看到对发出请求的url包进了<script></script>>里，无法绕过，说明此过滤方式可以保证页面防御XSS攻击的安全性。
高等也是如此，中等和高等都无法绕过，是安全的

HTML Injection - Stored (Blog)

LOW

查看源码

<?php/*bWAPP, or a buggy web application, is a free and open source deliberately insecure web application.
It helps security enthusiasts, developers and students to discover and to prevent web vulnerabilities.
bWAPP covers all major known web vulnerabilities, including all risks from the OWASP Top 10 project!
It is for security-testing and educational purposes only.Enjoy!Malik Mesellem
Twitter: @MME_ITbWAPP is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License (http://creativecommons.org/licenses/by-nc-nd/4.0/). Copyright © 2014 MME BVBA. All rights reserved.*/include("security.php");
include("security_level_check.php");
include("selections.php");
include("functions_external.php");
include("connect_i.php");$entry = "";
$owner = "";
$message = "";function htmli($data)
{include("connect_i.php");switch($_COOKIE["security_level"]){case "0" :$data = sqli_check_3($link, $data);break;case "1" :$data = sqli_check_3($link, $data);// $data = xss_check_4($data);break;case "2" :$data = sqli_check_3($link, $data);// $data = xss_check_3($data);break;default :$data = sqli_check_3($link, $data);break;}return $data;}if(isset($_POST["entry_add"]))
{$entry = htmli($_POST["entry"]);$owner = $_SESSION["login"];if($entry == ""){$message =  "<font color=\"red\">Please enter some text...</font>";}else            { $sql = "INSERT INTO blog (date, entry, owner) VALUES (now(),'" . $entry . "','" . $owner . "')";$recordset = $link->query($sql);if(!$recordset){die("Error: " . $link->error . "<br /><br />");}// Debugging// echo $sql;$message = "<font color=\"green\">Your entry was added to our blog!</font>";}}else
{if(isset($_POST["entry_delete"])){$sql = "DELETE from blog WHERE owner = '" . $_SESSION["login"] . "'";$recordset = $link->query($sql);if(!$recordset){die("Error: " . $link->error . "<br /><br />");}// Debugging// echo $sql;$message = "<font color=\"green\">All your entries were deleted!</font>";}}?>
<!DOCTYPE html>
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><!--<link rel="stylesheet" type="text/css" href="https://fonts.googleapis.com/css?family=Architects+Daughter">-->
<link rel="stylesheet" type="text/css" href="stylesheets/stylesheet.css" media="screen" />
<link rel="shortcut icon" href="images/favicon.ico" type="image/x-icon" /><!--<script src="//html5shiv.googlecode.com/svn/trunk/html5.js"></script>-->
<script src="js/html5.js"></script><title>bWAPP - HTML Injection</title></head><body><header><h1>bWAPP</h1><h2>an extremely buggy web app !</h2></header><div id="menu"><table><tr><td><a href="portal.php">Bugs</a></td><td><a href="password_change.php">Change Password</a></td><td><a href="user_extra.php">Create User</a></td><td><a href="security_level_set.php">Set Security Level</a></td><td><a href="reset.php" onclick="return confirm('All settings will be cleared. Are you sure?');">Reset</a></td><td><a href="credits.php">Credits</a></td><td><a href="http://itsecgames.blogspot.com" target="_blank">Blog</a></td><td><a href="logout.php" onclick="return confirm('Are you sure you want to leave?');">Logout</a></td><td><font color="red">Welcome <?php if(isset($_SESSION["login"])){echo ucwords($_SESSION["login"]);}?></font></td></tr></table></div><div id="main"><h1>HTML Injection - Stored (Blog)</h1><form action="<?php echo($_SERVER["SCRIPT_NAME"]);?>" method="POST"><table><tr><td colspan="6"><p><textarea name="entry" id="entry" cols="80" rows="3"></textarea></p></td></tr><tr><td width="79" align="left"><button type="submit" name="blog" value="submit">Submit</button></td><td width="85" align="center"><label for="entry_add">Add:</label><input type="checkbox" id="entry_add" name="entry_add" value="" checked="on"></td><td width="100" align="center"><label for="entry_all">Show all:</label><input type="checkbox" id="entry_all" name="entry_all" value=""></td><td width="106" align="center"><label for="entry_delete">Delete:</label><input type="checkbox" id="entry_delete" name="entry_delete" value=""></td><td width="7"></td><td align="left"><?php echo $message;?></td></tr></table></form><br /><table id="table_yellow"><tr height="30" bgcolor="#ffb717" align="center"><td width="20">#</td><td width="100"><b>Owner</b></td><td width="100"><b>Date</b></td><td width="445"><b>Entry</b></td></tr><?php// Selects all the records$entry_all = isset($_POST["entry_all"]) ? 1 : 0;if($entry_all == false)
{$sql = "SELECT * FROM blog WHERE owner = '" . $_SESSION["login"] . "'";}else
{$sql = "SELECT * FROM blog";}$recordset = $link->query($sql);if(!$recordset)
{// die("Error: " . $link->connect_error . "<br /><br />");?><tr height="50"><td colspan="4" width="665"><?php die("Error: " . $link->error);?></td><!--<td></td><td></td><td></td>--></tr><?php}while($row = $recordset->fetch_object())
{if($_COOKIE["security_level"] == "1" or $_COOKIE["security_level"] == "2"){?><tr height="40"><td align="center"><?php echo $row->id; ?></td><td><?php echo $row->owner; ?></td><td><?php echo $row->date; ?></td><td><?php echo xss_check_3($row->entry); ?></td></tr><?php}else{?><tr height="40"><td align="center"><?php echo $row->id; ?></td><td><?php echo $row->owner; ?></td><td><?php echo $row->date; ?></td><td><?php echo $row->entry; ?></td></tr><?php}}$recordset->close();$link->close();?></table></div><div id="side"><a href="http://twitter.com/MME_IT" target="blank_" class="button"><img src="./images/twitter.png"></a><a href="http://be.linkedin.com/in/malikmesellem" target="blank_" class="button"><img src="./images/linkedin.png"></a><a href="http://www.facebook.com/pages/MME-IT-Audits-Security/104153019664877" target="blank_" class="button"><img src="./images/facebook.png"></a><a href="http://itsecgames.blogspot.com" target="blank_" class="button"><img src="./images/blogger.png"></a></div><div id="disclaimer"><p>bWAPP is licensed under <a rel="license" href="http://creativecommons.org/licenses/by-nc-nd/4.0/" target="_blank"><img style="vertical-align:middle" src="./images/cc.png"></a> &copy; 2014 MME BVBA / Follow <a href="http://twitter.com/MME_IT" target="_blank">@MME_IT</a> on Twitter and ask for our cheat sheet, containing all solutions! / Need an exclusive <a href="http://www.mmebvba.com" target="_blank">training</a>?</p></div><div id="bee"><img src="./images/bee_1.png"></div><div id="security_level"><form action="<?php echo($_SERVER["SCRIPT_NAME"]);?>" method="POST"><label>Set your security level:</label><br /><select name="security_level"><option value="0">low</option><option value="1">medium</option><option value="2">high</option></select><button type="submit" name="form_security_level" value="submit">Set</button><font size="4">Current: <b><?php echo $security_level?></b></font></form></div><div id="bug"><form action="<?php echo($_SERVER["SCRIPT_NAME"]);?>" method="POST"><label>Choose your bug:</label><br /><select name="bug"><?php// Lists the options from the array 'bugs' (bugs.txt)
foreach ($bugs as $key => $value)
{$bug = explode(",", trim($value));// Debugging// echo "key: " . $key;// echo " value: " . $bug[0];// echo " filename: " . $bug[1] . "<br />";echo "<option value='$key'>$bug[0]</option>";}?></select><button type="submit" name="form_bug" value="submit">Hack</button></form></div></body></html>

核心过滤机制

过滤代码

function sqli_check_3($link, $data)
{return mysqli_real_escape_string($link, $data);}

没有任何过滤，所以我们可以直接在文本框中输入payload

<script>alert('xss')</script>

Medium&&High

过滤代码

function xss_check_4($data)
{// addslashes - returns a string with backslashes before characters that need to be quoted in database queries etc.// These characters are single quote ('), double quote ("), backslash (\) and NUL (the NULL byte).// Do NOT use this for XSS or HTML validations!!!return addslashes($data);}

addslashes函数会对单引号、双引号以及反斜杠进行转义

addslashes() 函数返回在预定义字符之前添加反斜杠的字符串。

预定义字符是：

单引号（'）
双引号（"）
反斜杠（\）
NULL

高等也是如此，所以中等高等无法绕过，是安全的