如果只有同一用户会看到 XSS 输入，那么它是否会构成威胁？
如果恶意用户输入的 XSS 输入只有他自己能看到，他究竟能获得什么好处？他能有什么收获吗？
我了解当所有站点用户都会查看恶意用户输入时，XSS 会成为一个问题。但如果每个用户只查看自己的输入，那么他的恶意输入将只有他自己看到，所以我的问题是：
- 这会以某种方式间接影响其他用户吗？
- 他能从中得到什么？
What exactly can a malicious user gain if the XSS input he enters will be viewed only by him? Is there anything he can gain?
I understand how XSS is a problem when the malicious user input will be viewed by all site users. But if each user view only his own input, his malicious input will be viewed only by him, so my questions:
- can this affect other users indirectly in some way?
- what can he gain from this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
攻击者通过查看他发现的 xss 攻击向量可以得到什么，就是这样:-)但是！然后他就可以使用该攻击向量，并且有多种方法可以做到这一点。
如果它是非持久性 XSS 漏洞（也称为反射漏洞），那么可能会通过向潜在受害者发送链接（很可能通过 urlshortener 进行混淆）来实现。
如果这是一个持久的 XSS 漏洞（即像我现在写的那样作为评论存储），那么他只会发表帖子并等待。
现在，他能得到的，就是大话了。试想一下，如果您可以将脚本标记插入网页中，您可以做什么。然后您可以从服务器加载整个 javascript 文件。
然后，恶意代码可能会窃取一些 cookie（如果未设置这些 cookie httponly），并立即通过 ajax 将它们发布到后端应用程序..可能会通知攻击者，谁知道呢..这些cookie可能足以作为受害者登录该网站。
好吧..攻击者可以做很多事情..所以请消除您可能拥有的所有 XSS 漏洞。
XSS漏洞主要利用人们对其他网站的信任。
不要低估 XSRF 漏洞，这些漏洞取决于网站对您的浏览器的信任度（另一个大话题）和 Sql注入攻击。
一些提示（我相信您知道所有这些，但为了完整起见：
一些
更新：
可以提供帮助的工具：
（我推荐 SkipFish）
What an attacker can gain with viewing that the xss attack vector he found works, is just that :-) But! Then he can use that attack vector, and there are several ways to do that.
If it's a non-persistent XSS vulnerability (aka reflected), then probably by sending a link (most probably obfuscated via a urlshortener) to potential victims.
If it's a persistent XSS vulnerability (i.e. stored as a comment like the one I'm writing now), then he would just make his post and wait.
Now, what he can gain is a big talk. Just think what you could do if you could inject a script tag into a web page. You could then load a whole javascript file from your server.
The malicious code would then steal some cookies perhaps (if those are not set httponly) and immediately post them via ajax to a backend application..which would probably notify the attacker and who knows..those cookies might be enough to login into that website as the victim.
Well..there are many things an attacker can do..so please eliminate all XSS vulnerabilities you might have.
XSS vulnerabilities mainly take advantage of the trust people have in other websites.
Don't underestimate the XSRF vulnerabilities which depend on the trust a website has on your browser (another big talk), and Sql Injection attacks.
A few tips (I'm sure you know all about it but for the sake of completeness:
Good luck!
UPDATE:
A few tools that can help:
(I recommend SkipFish)
我想不是，但这不是 A/B 的事情。谁知道“XSS”的“脚本”部分是做什么的。也许攻击者在您的 AJAX/javascript 中发现了漏洞，并且他正在使用 XSS 类型的攻击来获取您主机上的工具包。同样，我们可以整天推测注入型攻击会造成什么危害，最重要的是，如果您可以防范它，那就这样做。我们在这里能想到的每一个技巧都将是攻击者使用的技巧列表中的一个。
为你可以预测的事情做好准备，防御已知的事情。
I guess not, but this isn't an A/B thing. Who knows WHAT the "script" part of that "XSS" does. Maybe the attacker found a vulnerability in your AJAX/javascript, and he is using an XSS-type attack to get a toolkit on your host. Again, we can speculate about what harm can befall from injection-type attacks all day, the bottom line is that if you can secure against it, do so. Every trick we can think of here is going to be one trick short of the list that an attacker is using.
Prepare for what you can predict, defend against the known.
是的，绝对是。注入可能由第三方发起，就像 反射型 XSS 的情况一样。
Yes, it definitely is. The injection could be initiated by a third party as is the case with reflected XSS.
+1 @Gumbo 指出的内容 - 反映了 XSS，但也要考虑用户帐户被盗的情况，攻击者提供恶意输入，当他或她返回站点时，这些输入将返回给（合法）用户。
这只是另一个潜在的攻击媒介......
+1 on what @Gumbo pointed out - reflected XSS, but also consider the scenario where a user's account is compromised, and the attacker provides malicious input that will be given back to the (legitimate) user when he or she returns to the site.
Just another potential attack vector ...
作为直接威胁……可能没什么，因为他们无法以直接方式更轻松地完成任何事情。
但无论如何它都应该被修复，因为几个月后需求可能会发生变化，或者新的开发人员重新使用相同的代码，然后你就会遇到真正的问题。
As an immediate threat... Probably nothing, since they can't accomplish anything they couldn't do more easily in a direct fashion.
But it should be fixed anyway, since it is possible that a few months down the line requirements change or a new developer re-purposes the same code and then you've got a real problem.
我想你在问：
反射（XSS）代码可以有
之前对其他访客的影响
分发链接 - 即在测试期间
和
为恶意用户实现
如果我没理解错的话，我的回答如下：
XSS 是关于运行客户端的
代码 - 通常是 JavaScript - 在
毫无戒心的用户浏览器和
对其他用户没有影响
超出了所实现的目标
通过链接分发它，
说服用户输入
直接或找到一种方法
保留在给定页面上。
如果你问是否可以
导致某种形式的命令执行
在服务器上，这将是 代码
注入 或者命令注入
比XSS；恶意用户会
要么需要足够幸运
发现网站的用途
服务器端 JavaScript 或者会很糟糕
足够擅长编码
实际上完全在做某事
和他们想的不一样！
无论哪种方式，这都需要
网站容易受到这种形式的攻击
注射并且超出范围
XSS 是什么。
如果我们谈论 XSS，测试允许
恶意用户正确制作
他们的最终代码/链接就是这样
尽可能隐蔽并且确实
无论他们意图做什么恶行
至。
除非某人或某个系统
密切关注日志
例如多个奇怪的 HTTP 请求，
恶意用户将能够
完善他们的利用，以便当
他们的推文/电子邮件/无论发生什么
病毒式传播，它具有预期的效果。
华泰
I think you're asking:
Can reflected (XSS) code have
an effect on other visitors prior to
distributing the link - i.e. during testing
and
What advantage such testing may
achieve for the malicious user
If I'm reading you correctly, my answer would be as follows:
XSS is about running client-side
code - usually JavaScript - in an
unsuspecting user's browser and
will have no effect on other users
beyond what is achieved either by
distributing it via a link,
persuading a user to enter it
directly or finding a way for it to
persist on a given page.
If you are asking whether it could
cause some form of command execution
on the server, that would be code
injection or command injection rather
than XSS; the malicious user would
either need to be fortunate enough
to discover the site uses
Server-side JavaScript or be bad
enough at coding that they're
actually doing something entirely
different to what they thought!
Either way, this would require the
site to be vulnerable to this form
of injection and is beyond the scope
of what XSS is about.
If we're talking XSS, testing allows
the malicious user to properly craft
their final code / link so it is
as covert as possible and does
whatever evil deed they intend it
to.
Unless someone or some system is
keeping a watchful eye on the logs
for e.g. multiple strange HTTP requests,
the malicious user will be able to
perfect their exploit so that when
their tweet / email / whatever goes
viral it has the desired effect.
HTH