{"id":3810,"date":"2020-10-14T11:25:00","date_gmt":"2020-10-14T11:25:00","guid":{"rendered":"http:\/\/the-codest.localhost\/blog\/web-app-security-xss-vulnerability\/"},"modified":"2026-04-27T10:24:05","modified_gmt":"2026-04-27T10:24:05","slug":"web-lietojumprogrammu-drosiba-xss-ievainojamiba","status":"publish","type":"post","link":"https:\/\/thecodest.co\/lv\/blog\/web-app-security-xss-vulnerability\/","title":{"rendered":"Web lietojumprogrammu dro\u0161\u012bba - XSS ievainojam\u012bba"},"content":{"rendered":"

Uzbrukuma scen\u0101rijs<\/h2>\n\n\n\n
    \n
  1. Uzbruc\u0113js atrod XSS ievainojam\u012bbu upura izmantotaj\u0101 t\u012bmek\u013ca vietn\u0113, piem\u0113ram, bankas t\u012bmek\u013ca vietn\u0113.<\/li>\n\n\n\n
  2. Cietu\u0161ais pa\u0161laik ir pieteicies \u0161aj\u0101 lap\u0101.<\/li>\n\n\n\n
  3. Uzbruc\u0113js nos\u016bta upurim viltotu URL adresi.<\/li>\n\n\n\n
  4. Upuris noklik\u0161\u0137ina uz URL<\/li>\n\n\n\n
  5. Par cietu\u0161\u0101 banka<\/a> t\u012bmek\u013ca vietne, JavaScript<\/a> kods<\/a> s\u0101k izpild\u012bt, lai p\u0101rtvertu lietot\u0101ja dati<\/a> vai veikt p\u0101rskait\u012bjumu uzbruc\u0113ja v\u0101rd\u0101 uz uzbruc\u0113ja kontu.<\/li>\n<\/ol>\n\n\n\n

    J\u0101atz\u012bm\u0113, ka cietu\u0161\u0101 v\u0101rd\u0101 veikt\u0101s oper\u0101cijas var b\u016bt cietu\u0161ajam neredzamas, jo t\u0101s var notikt fon\u0101, izmantojot bankas API<\/a>, vai uzbruc\u0113js tos var veikt v\u0113l\u0101k, izmantojot autentifik\u0101cijai nepiecie\u0161amos datus, \u017eetonus, s\u012bkfailus utt.<\/p>\n\n\n\n

    XSS veidi<\/h2>\n\n\n\n

    1. Atspogu\u013cots XSS <\/h3>\n\n\n\n

    Atbild\u0113 tiek par\u0101d\u012bts HTML\/JavaScript kods, kas ietverts jebkur\u0101 parametr\u0101 (piem\u0113ram, GET, POST vai s\u012bkfail\u0101).<\/p>\n\n\n\n

    Lapa ar teksta ievadi, lai mekl\u0113tu kaut ko, kas liek parametru ?search=foo<\/code> URL galotn\u0113, kad tiek veikta API vaic\u0101\u0161ana. P\u0113c jebkuras fr\u0101zes ievad\u012b\u0161anas, ja t\u0101 nav atrasta, HTML form\u0101t\u0101 tiek ievietots atgrie\u0161anas zi\u0146ojums ex.<\/p>\n\n\n\n

    <div>Nav atrasts neviens rezult\u0101ts <b>foo<\/b><\/div><\/code><\/pre>\n\n\n\n
    M\u0113s varam m\u0113\u0123in\u0101t ievietot URL ?search=<\/code>..<\/p>\n\n\n\n
    2.DOM XSS <\/h3>\n\n\n\n
    Tas ir tad, ja t\u0101s izpilde ir iesp\u0113jota, izmantojot b\u012bstamas JavaScript funkcijas, piem\u0113ram. `eval`<\/code> vai `innerHtml`<\/code>. T\u0101l\u0101k dotaj\u0101 \u201cTie\u0161raides piem\u0113r\u0101\u201d ir par\u0101d\u012bts DOM XSS uzbrukums, kura pamat\u0101 ir `innerHtml`<\/code> funkcija.<\/p>\n\n\n\n
    3. Saglab\u0101ts XSS <\/h3>\n\n\n\n
    \u0160aj\u0101 gad\u012bjum\u0101 \u013caunpr\u0101t\u012bgs kods tiek rakst\u012bts servera pus\u0113. Piem\u0113ram, m\u0113s varam nos\u016bt\u012bt koment\u0101ru ar \u013caunpr\u0101t\u012bgu kodu bloga ierakstam, kas ir aug\u0161upiel\u0101d\u0113ts server\u012b. T\u0101 uzdevums ir, piem\u0113ram, sagaid\u012bt administratora moder\u0113\u0161anu un p\u0113c tam nozagt vi\u0146a sesijas datus utt.<\/p>\n\n\n\n
    Injekcijas metodes<\/h2>\n\n\n\n
    1. Birkas satur\u0101<\/p>\n\n\n\n
    `onerror = br\u012bdin\u0101jums('XSS')`<\/code>uz<\/p>\n\n\n\n
    <img src onerror="alert('XSS')" \/><\/code><\/pre>\n\n\n\n
    2. Atrib\u016bta satur\u0101<\/p>\n\n\n\n
    `\" onmouseover=alert('XSS')`<\/code> uz<\/p>\n\n\n\n
    <div class="" onmouseover="alert('XSS')""><\/div><\/code><\/pre>\n\n\n\n
    <\/p>\n\n\n\n
      \n
    1. Atrib\u016bta satur\u0101 bez p\u0113di\u0146\u0101m<\/li>\n<\/ol>\n\n\n\n
      x onclick = br\u012bdin\u0101jums('XSS')<\/code>uz<\/p>\n\n\n\n
      <div class="x" onclick="alert('XSS')"><\/div><\/code><\/pre>\n\n\n\n
      <\/p>\n\n\n\n
        \n
      1. In the href<\/code>ef atrib\u016bts<\/li>\n<\/ol>\n\n\n\n
        javascript:alert('XSS')<\/code> uz<\/p>\n\n\n\n
        <a href="javascript:alert('XSS')"><\/a><\/code><\/pre>\n\n\n\n
        <\/p>\n\n\n\n
          \n
        1. JavaScript koda iek\u0161pus\u0113 eso\u0161aj\u0101 rind\u0101<\/li>\n<\/ol>\n\n\n\n
          \";alert('XSS')\/\/<\/code> uz<\/p>\n\n\n\n
          <script>let username=\"\";alert('XSS')\/\/\";<\/script><\/code><\/pre>\n\n\n\n
            \n
          1. Atrib\u016bt\u0101 ar JavaScript notikumu<\/li>\n<\/ol>\n\n\n\n
            ');alert('XSS')\/\/<\/code> kur '<\/code> ir viena p\u0113di\u0146a, uz<\/p>\n\n\n\n
            <div onclick="change('&#39;);alert('XSS')\/\/')">D\u017eons<\/div><\/code><\/pre>\n\n\n\n
            <\/p>\n\n\n\n
              \n
            1. In the href<\/code> atrib\u016bts JavaScript protokol\u0101<\/li>\n<\/ol>\n\n\n\n
              );alert(1)\/\/<\/code> kur %27<\/code> ir viena p\u0113di\u0146a, uz<\/p>\n\n\n\n
              <a href="javascript:change('%27);alert(1)\/\/')">noklikš\u0137iniet uz<\/a><\/code><\/pre>\n\n\n\n

               <\/code><\/p>\n\n\n\n
              Tie\u0161raides piem\u0113rs<\/h3>\n\n\n\n
              \n