如何使用键盘记录器制作XSS脆弱网站？

发布于 2025-01-26 11:35:42 字数 1388 浏览 2 评论 0原文

我想创建一个容易受到XSS攻击的网站，在该网站上，攻击者试图注入一个钥匙记录员，该钥匙记录员记录了本网站上每个受害者的击键。

在这里是已部署的网站，并遵循代码：

function submitted(){
    alert("Submitted!");
}

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Document</title>
    <script src="index.js"></script>
</head>
<body>
    <h1>XSS keylogger test website</h1>
    <form id="form">
        <input type="text" id="fname" name="fname">
        <input type="submit" value="Submit" onclick="submitted()">
    </form>
</body>
</html>

JS脚本的一个示例，其中包含可以注入键盘记录器的代码：

<script>
    function keyPressed(){
    alert("key pressed");
    }
    window.captureEvents (Event.KEYPRESS); 
    window.onkeypress=keyPressed; 
</script>

如果我只是将代码放入输入字段中，则什么都不会发生。如何将代码嵌入实际工作的网站中？

信息

该项目仅用于演示和学习目的。

原文

I want to create an website which is vulnerable to an XSS attack where the attacker tries to inject an keylogger who logs the keystrokes of every victim on this website.

Here is the deployed website and following the code:

function submitted(){
    alert("Submitted!");
}

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Document</title>
    <script src="index.js"></script>
</head>
<body>
    <h1>XSS keylogger test website</h1>
    <form id="form">
        <input type="text" id="fname" name="fname">
        <input type="submit" value="Submit" onclick="submitted()">
    </form>
</body>
</html>

An example of an JS script which contains code for an keyboard logger who could be injected:

<script>
    function keyPressed(){
    alert("key pressed");
    }
    window.captureEvents (Event.KEYPRESS); 
    window.onkeypress=keyPressed; 
</script>

If I just put the code in the input field nothing happens. How can I embed the code into the website that it actually works?

INFO

The project is only used for demonstration and learning purposes.

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

没企图 2025-02-02 11:35:42

keylogger记录了本网站上每个受害者的击键。

鉴于您的设置，这并不是XSS的工作方式。 XSS可以通过：

一个用户提交内容，然后以不安全的方式向其他用户渲染该内容的服务器。由于您的服务器没有保存用户生成的内容（例如在数据库中），然后将其显示给其他访问者，甚至考虑考虑此方法是一种启动器，因为您没有做任何这样的事情。
或者，用户被欺骗到提交内容中，然后导致任意代码执行。这是一个问题，因为例如，用户的登录凭据和其他数据可能会被盗（如果网站具有此类功能）。考虑到任何不设计的前端设置，此是合理可行的 - 例如，通过将用户的文本插入无卫生化的HTML（例如使用TODO列表或其他内容）。（如果您不将用户的文本插入到某个地方的DOM，则XSS不在表格）

const fname = document.querySelector('#fname');
function submitted(){
    document.querySelector('.current-input-text').innerHTML = 'You submitted: ' + fname.value;
    fname.value = '';
}
fname.value = `
  <img src="bad" onerror='window.onkeypress = (e) => console.log(e.key + " PRESSED");'>`;

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Document</title>
    <script src="index.js"></script>
</head>
<body>
    <h1>XSS keylogger test website</h1>
    <form id="form" onsubmit="return false;">
        <input type="text" id="fname" name="fname">
        <input type="submit" value="Submit" onclick="submitted()">
    </form>
    <div class="current-input-text"></div>
</body>
</html>

keylogger who logs the keystrokes of every victim on this website.

Given your setup, that isn't really how XSS works. XSS works by either:

One user submitting content, then the server rendering that content to other users in an unsafe manner. Since your server isn't saving user-generated content (like in a database) and then displaying it to other visitors, even considering this approach is a non-starter because you aren't doing anything like that.
Or, a user being tricked into submitting content that then results in arbitrary code execution. This is a problem because, for example, that user's login credentials and other data could then be stolen (if the site had such features). This is reasonably feasible given any badly designed front-end setup - for example, by inserting the user's text as HTML without sanitization (like with a todo list or something). (If you don't insert the user's text into the DOM somewhere, XSS is off the table)

const fname = document.querySelector('#fname');
function submitted(){
    document.querySelector('.current-input-text').innerHTML = 'You submitted: ' + fname.value;
    fname.value = '';
}
fname.value = `
  <img src="bad" onerror='window.onkeypress = (e) => console.log(e.key + " PRESSED");'>`;

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Document</title>
    <script src="index.js"></script>
</head>
<body>
    <h1>XSS keylogger test website</h1>
    <form id="form" onsubmit="return false;">
        <input type="text" id="fname" name="fname">
        <input type="submit" value="Submit" onclick="submitted()">
    </form>
    <div class="current-input-text"></div>
</body>
</html>

回复收藏 0 原文