Repository navigation
Expand file tree
/
Copy path15428712896668.html
More file actions
451 lines (276 loc) · 14.7 KB
/
Copy path15428712896668.html
File metadata and controls
451 lines (276 loc) · 14.7 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
<!doctype html>
<html class="no-js" lang="en">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>
CRLF注入 - lonelyorのblog
</title>
<link href="atom.xml" rel="alternate" title="lonelyorのblog" type="application/atom+xml">
<link rel="stylesheet" href="asset/css/foundation.min.css" />
<link rel="stylesheet" href="asset/css/docs.css" />
<script src="asset/js/vendor/modernizr.js"></script>
<script src="asset/js/vendor/jquery.js"></script>
<script src="asset/highlightjs/highlight.pack.js"></script>
<link href="asset/highlightjs/styles/github.css" media="screen, projection" rel="stylesheet" type="text/css">
<script>hljs.initHighlightingOnLoad();</script>
<script type="text/javascript">
function before_search(){
var searchVal = 'site:www.lonelyor.org/lonelyorNotes ' + document.getElementById('search_input').value;
document.getElementById('search_q').value = searchVal;
return true;
}
</script>
</head>
<body class="antialiased hide-extras">
<div class="marketing off-canvas-wrap" data-offcanvas>
<div class="inner-wrap">
<nav class="top-bar docs-bar hide-for-small" data-topbar>
<section class="top-bar-section">
<div class="row">
<div style="position: relative;width:100%;"><div style="position: absolute; width:100%;">
<ul id="main-menu" class="left">
<li id=""><a target="_self" href="index.html">主页</a></li>
<li id=""><a target="_self" href="archives.html">归档</a></li>
<li id=""><a target="_self" href="lost.html">失乐园</a></li>
<li id=""><a target="_self" href="about.html">关于</a></li>
</ul>
<ul class="right" id="search-wrap">
<li>
<form target="_blank" onsubmit="return before_search();" action="https://google.com/search" method="get">
<input type="hidden" id="search_q" name="q" value="" />
<input tabindex="1" type="search" id="search_input" placeholder="Search"/>
</form>
</li>
</ul>
</div></div>
</div>
</section>
</nav>
<nav class="tab-bar show-for-small">
<a href="javascript:void(0)" class="left-off-canvas-toggle menu-icon">
<span> lonelyorのblog</span>
</a>
</nav>
<aside class="left-off-canvas-menu">
<ul class="off-canvas-list">
<li><a target="_self" href="index.html">主页</a></li>
<li><a target="_self" href="archives.html">归档</a></li>
<li><a target="_self" href="lost.html">失乐园</a></li>
<li><a target="_self" href="about.html">关于</a></li>
<li><label>Categories</label></li>
<li><a href="Web%E6%94%BB%E9%98%B2.html">Web攻防</a></li>
<li><a href="%E6%93%8D%E4%BD%9C%E7%B3%BB%E7%BB%9F.html">操作系统</a></li>
<li><a href="%E8%99%9A%E6%8B%9F%E5%AE%9E%E9%AA%8C%E5%AE%A4.html">虚拟实验室</a></li>
<li><a href="CTF.html">CTF</a></li>
<li><a href="%E5%BC%80%E5%8F%91.html">开发</a></li>
<li><a href="%E6%B5%8F%E8%A7%88%E5%99%A8.html">浏览器</a></li>
<li><a href="%E5%A5%87%E6%B7%AB%E5%B7%A7%E6%8A%80.html">奇淫巧技</a></li>
</ul>
</aside>
<a class="exit-off-canvas" href="#"></a>
<section id="main-content" role="main" class="scroll-container">
<script type="text/javascript">
$(function(){
$('#menu_item_index').addClass('is_active');
});
</script>
<div class="row">
<div class="large-8 medium-8 columns">
<div class="markdown-body article-wrap">
<div class="article">
<h1>CRLF注入</h1>
<div class="read-more clearfix">
<span class="date">2018/11/22 15:21 下午</span>
<span>posted in </span>
<span class="posted-in"><a href='%E6%B3%A8%E5%85%A5.html'>注入</a></span>
<span class="comments">
</span>
</div>
</div><!-- article -->
<div class="article-content">
<blockquote>
<p>文章翻译自OWASP的<a href="https://www.owasp.org/index.php/CRLF_Injection">CRLF_Injection</a></p>
</blockquote>
<p>CRLF即回车Carriage Return (ASCII 13, \r) 和 换行 Line Feed (ASCII 10, \n)。他们被用于注释掉一行的终止。不过不同系统的处理方式有点不同。windows中，CR和LF都被用于注释掉一行的结尾，而linux/unix中只需要一个LF。在HTTP协议中，CRLF序列始终用于一行的终止。<br/>
当用户设法将CRLF提交到应用程序时，可能发生CRLF注入攻击，这通常是通过修改HTTP参数或URL来完成。</p>
<p>CRLF注入可能产生这样的问题：</p>
<ul>
<li>HTTP响应拆分</li>
<li>日志注入<br/>
## HTTP响应拆分<br/>
通常，当出现以下情况时会发生HTTP响应拆分</li>
<li>数据通过不受信任的来源进入Web应用程序，如HTTP请求。</li>
<li>数据包含在发送给Web用户的HTTP响应标头中，而不会对恶意字符进行验证。<br/>
HTTP响应拆分是达到目的的手段而不是目的本身。<br/>
攻击方式如下：攻击者将恶意数据传递给易受攻击的应用程序，应用程序将数据包含在HTTP响应中。<br/>
要成功利用漏洞，应用程序必须允许<strong>包含有 CR（回车，即 %0d 或者 \r\n）和 LF（换行符，%0a 或者 \n）的输入在header中</strong>和<strong>底层平台必须容易注入这样的字符</strong>。</li>
</ul>
<p><em>大多数现代应用程序服务器(无论用什么语言编写的代码)，都已经不存在HTTP响应拆分漏洞。</em></p>
<p>下面上一段java代码来举例说明：</p>
<pre class="line-numbers"><code class="language-java">String author = request.getParameter(AUTHOR_PARAM);
...
Cookie cookie = new Cookie("author", author);
cookie.setMaxAge(cookieExpiration);
response.addCookie(cookie);
</code></pre>
<p>上述代码的意思是：从客户端HTTP请求中接受参数（author），并将其设置在HTTP响应的cookie头中。<br/>
如果我们正常提交数据(author=lonelyor)，HTTP响应应该是这样：</p>
<pre class="line-numbers"><code class="language-java">HTTP/1.1 200 OK
...
Set-Cookie: author=Jane Smith
...
</code></pre>
<p>但是，由于源代码中的cookie是由未经验证的用户输入组成的，因此如果我们提交恶意代码<code>Hacker By xxx\r\nContent-Length:45\r\n\r\n...</code>则HTTP响应将被拆分为原始响应和伪造响应。</p>
<pre class="line-numbers"><code class="language-java">HTTP/1.1 200 OK
...
Set-Cookie: author=Hacker By xxx
Content-Length: 999
<html>恶意内容...</html> (这个例子中为第999个字符)
原始内容以1000开头, 现在被浏览器忽略了...
</code></pre>
<h3 id="toc_0">危害</h3>
<p>攻击者构建任意HTTP响应的能力可能导致以下攻击：<br/>
跨用户污染（Cross-User_Defacement）——利用条件很苛刻<br/>
缓存中毒（Cache_Poisoning）——利用条件很苛刻<br/>
XSS跨站脚本攻击<br/>
页面劫持</p>
<h2 id="toc_1">日志注入</h2>
<p>将未经验证的用户输入写入日志文件可能导致攻击者伪造日志或者将恶意内容注入日志。<br/>
以下情况可能导致日志伪造漏洞：</p>
<ul>
<li>数据从不受信任的来源进入应用程序</li>
<li>数据将写入应用程序或者系统日志文件</li>
</ul>
<p>下面上一段java代码来举例说明：</p>
<pre class="line-numbers"><code class="language-java">...
String val = request.getParameter("val");
try {
int value = Integer.parseInt(val);
}
catch (NumberFormatException) {
log.info("Failed to parse val = " + val);
}
...
</code></pre>
<p>上述代码的功能是，从请求对象中读取整数值，如果该值无法解析为整数，则会记录输入，并显示一条错误信息。<br/>
如果用户提交字符串“one”，则会记录以下条目<br/>
<code>INFO: Failed to parse val=one</code><br/>
然而，如果攻击者提交字符串<code>one%0a%0aINFO:+User+logged+out%3dbadguy</code>则会在日志中显示：</p>
<pre class="line-numbers"><code class="language-text"> INFO: Failed to parse val=one
INFO: User logged out=badguy
</code></pre>
<p>显然攻击者可以使用相同机制插入任意日志条目。</p>
</div>
<div class="row">
<div class="large-6 columns">
<p class="text-left" style="padding:15px 0px;">
<a href="15428714021434.html"
title="Previous Post: linux将shell脚本添加到系统命令的方法">« linux将shell脚本添加到系统命令的方法</a>
</p>
</div>
<div class="large-6 columns">
<p class="text-right" style="padding:15px 0px;">
<a href="15428711597348.html"
title="Next Post: burpsuite设置上游代理">burpsuite设置上游代理 »</a>
</p>
</div>
</div>
<div class="comments-wrap">
<div class="share-comments">
</div>
</div>
</div><!-- article-wrap -->
</div><!-- large 8 -->
<link rel="bookmark" href="http://images.lonelyor.org/favicon.ico" />
<link rel="shortcut icon" href="http://images.lonelyor.org/favicon.ico" />
<script id="dsq-count-scr" src="//lonelyor.disqus.com/count.js" async></script>
<div class="large-4 medium-4 columns">
<div class="hide-for-small">
<div id="sidebar" class="sidebar">
<div id="site-info" class="site-info">
<div class="site-a-logo"><img src="http://images.lonelyor.org/lonelyornotesico.jpeg" /></div>
</br>
<h1>lonelyorのblog</h1>
<div class="site-des">一个用来记录学习笔记的网站</div>
<div class="social">
<a target="_blank" class="github" target="_blank" href="https://github.com/AlShelley/lonelyorNotes" title="GitHub">GitHub</a>
<a target="_blank" class="email" href="mailto:lonelyor.org@gmail.com" title="Email">Email</a>
<a target="_blank" class="rss" href="atom.xml" title="RSS">RSS</a>
</div>
</div>
<div id="site-categories" class="side-item ">
<div class="side-header">
<h2>分类</h2>
</div>
<div class="side-content">
<p class="cat-list">
<a href="Web%E6%94%BB%E9%98%B2.html"><strong>Web攻防</strong></a>
<a href="%E6%93%8D%E4%BD%9C%E7%B3%BB%E7%BB%9F.html"><strong>操作系统</strong></a>
<a href="%E8%99%9A%E6%8B%9F%E5%AE%9E%E9%AA%8C%E5%AE%A4.html"><strong>虚拟实验室</strong></a>
<a href="CTF.html"><strong>CTF</strong></a>
<a href="%E5%BC%80%E5%8F%91.html"><strong>开发</strong></a>
<a href="%E6%B5%8F%E8%A7%88%E5%99%A8.html"><strong>浏览器</strong></a>
<a href="%E5%A5%87%E6%B7%AB%E5%B7%A7%E6%8A%80.html"><strong>奇淫巧技</strong></a>
</p>
</div>
</div>
<div id="site-categories" class="side-item">
<div class="side-header">
<h2>最新文章</h2>
</div>
<div class="side-content">
<ul class="posts-list">
<li class="post">
<a href="15453720146052.html">Pycharm编程遇到的技巧</a>
</li>
<li class="post">
<a href="15453717965995.html">npm Cannot find module 'semver' --解决方案</a>
</li>
<li class="post">
<a href="15453716917526.html">mongodb安装配置（arch）</a>
</li>
<li class="post">
<a href="15453714645346.html">linux安装配置aria2及其Web图形界面（debian为例）</a>
</li>
<li class="post">
<a href="15453713553710.html">linux下搜狗输入法不能用的解决办法</a>
</li>
</ul>
</div>
</div>
</div><!-- sidebar -->
</div><!-- hide for small -->
</div><!-- large 4 -->
</div><!-- row -->
<div class="page-bottom clearfix">
<div class="row">
<p class="copyright">Copyright © 2018
Powered by <a target="_blank" href="http://www.mweb.im">MWeb</a>,
Theme used <a target="_blank" href="http://github.com">GitHub CSS</a>,
Author is <a target="_blank" href="http://lonelyor.org">lonelyor</a>
</p>
</div>
</div>
</section>
</div>
</div>
<script src="asset/js/foundation.min.js"></script>
<script>
$(document).foundation();
function fixSidebarHeight(){
var w1 = $('.markdown-body').height();
var w2 = $('#sidebar').height();
if (w1 > w2) { $('#sidebar').height(w1); };
}
$(function(){
fixSidebarHeight();
})
$(window).load(function(){
fixSidebarHeight();
});
</script>
<div class="bdsharebuttonbox"><a href="#" class="bds_more" data-cmd="more">分享到：</a><a href="#" class="bds_qzone" data-cmd="qzone" title="分享到QQ空间">QQ空间</a><a href="#" class="bds_weixin" data-cmd="weixin" title="分享到微信">微信</a><a href="#" class="bds_tsina" data-cmd="tsina" title="分享到新浪微博">新浪微博</a><a href="#" class="bds_tqq" data-cmd="tqq" title="分享到腾讯微博">腾讯微博</a><a href="#" class="bds_fbook" data-cmd="fbook" title="分享到Facebook">Facebook</a></div>
<script>window._bd_share_config={"common":{"bdSnsKey":{},"bdText":"来自：http://www.lonelyor.org/","bdMini":"1","bdMiniList":["sqq","weixin","fbook","twi","qzone","tsina","tqq","tieba","douban","tsohu","linkedin","mshare","copy"],"bdPic":"http://images.lonelyor.org/lonelyornotesico.jpeg","bdStyle":"1","bdSize":"16"},"share":{"bdSize":16},"image":{"viewList":["qzone","weixin","tsina","tqq","fbook"],"viewText":"分享到：","viewSize":"24"},"selectShare":{"bdContainerClass":null,"bdSelectMiniList":["qzone","weixin","tsina","tqq","fbook"]}};with(document)0[(getElementsByTagName('head')[0]||body).appendChild(createElement('script')).src='http://bdimg.share.baidu.com/static/api/js/share.js?v=89860593.js?cdnversion='+~(-new Date()/36e5)];</script>
</body>
</html>