首页 > 代码库 > XSS攻击
XSS攻击
XSS又叫CSS (Cross Site Script) ,跨站脚本攻击。它指的是恶意攻击者往web页面里插入恶意的html代码,当用户浏览该页之时,嵌入其中web里面的html代码会被执行,从而达到恶意用户的特殊目的。
##############xss攻击############# **************************************** #不带if判断进行关键字过滤代码 msg=[] def comment(request): if request.method =="GET": return render(request,‘comment.html‘) else: v = request.POST.get(‘content‘) msg.append(v) return render(request,‘comment.html‘) def index(request): return render(request,‘index.html‘,{‘msg‘:msg}) ***************************************** ***************************************** #带if判断进行关键字过滤代码 msg=[] def comment(request): if request.method =="GET": return render(request,‘comment.html‘) else: v = request.POST.get(‘content‘) if "script" in v: return render(request,‘comment.html‘,{‘error‘:‘黑你大爷‘}) else: msg.append(v) return render(request, ‘comment.html‘) def index(request): return render(request,‘index.html‘,{‘msg‘:msg}) ********************************************* ********************************************* #测试: def test(request): from django.utils.safestring import mark_safe temp = "<a href=http://www.mamicode.com/‘http://www.baidu.com‘>百度" newtemp = mark_safe(temp) return render(request, ‘test.html‘, {‘temp‘: newtemp}) ******************************************** 注: # 1.用<script>alert(11222)</script>模拟攻击代码 # 2.过滤攻击方式: a.在接受评论端(前端代码)不要写 |safe. 比如:<div>{{ item|safe }}</div> #b.在后台代码中进行if关键字过滤判断 3.test.html: # 里面如果不加|safe,渲染出来的只是普通字符“ <a href=http://www.mamicode.com/‘http://www.baidu.com‘>百度</a>” # 如果加|safe,渲染出来的是<a>标签连接 #后端标记字符串安全: (前端不加safe,后端加safe) #导入模块 :from django.utils.safestring import mark_safe #说明安全:ewtemp = mark_safe(temp)
<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> <form method="POST" action="/comment/"> <input type="text" name="content"> <input type="submit" value=http://www.mamicode.com/"提交"/>{{ error }} </form> </body> </ht
<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> <h3>评论</h3> {% for item in msg %} <div>{{ item }}</div> {# <div>{{ item|safe }}</div>#} {% endfor %} </body> </ht
<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> {# {{ temp|safe }}#} {{ temp }} </body> </htm
"""day73 URL Configuration The `urlpatterns` list routes URLs to views. For more information please see: https://docs.djangoproject.com/en/1.10/topics/http/urls/ Examples: Function views 1. Add an import: from my_app import views 2. Add a URL to urlpatterns: url(r‘^$‘, views.home, name=‘home‘) Class-based views 1. Add an import: from other_app.views import Home 2. Add a URL to urlpatterns: url(r‘^$‘, Home.as_view(), name=‘home‘) Including another URLconf 1. Import the include() function: from django.conf.urls import url, include 2. Add a URL to urlpatterns: url(r‘^blog/‘, include(‘blog.urls‘)) """ from django.conf.urls import url from django.contrib import admin from app01 import views urlpatterns = [ url(r‘^admin/‘, admin.site.urls), url(r‘^test/‘,views.test), url(r‘^comment/‘,views.comment), url(r‘^index/‘,views.index), ]
XSS攻击
声明:以上内容来自用户投稿及互联网公开渠道收集整理发布,本网站不拥有所有权,未作人工编辑处理,也不承担相关法律责任,若内容有误或涉及侵权可进行投诉: 投诉/举报 工作人员会在5个工作日内联系你,一经查实,本站将立刻删除涉嫌侵权内容。