如何在DVWA中将XSS打破到不可能的水平?

时间:2018-08-16 10:16:19

标签: php xss csrf csrf-protection

GET /dvwa/vulnerabilities/xss_r/index.php?name=lourdu&user_token=5803a9aef27c4484fd606489ce024206 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/dvwa/vulnerabilities/xss_r/index.php?name=jkhgd&user_token=f46423116ffe583ff4377707fc38aa0e
Cookie: security=impossible; security_level=0; PHPSESSID=fd0ajavett3eevi9qtt125jun1
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

这是上面的查询

HTTP/1.1 302 Found
Date: Thu, 16 Aug 2018 09:35:25 GMT
Server: Apache/2.4.33 (Win32) OpenSSL/1.1.0h PHP/7.2.7
X-Powered-By: PHP/7.2.7
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: index.php
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

我得到了这个结果

我是否使用burb西装打破了结果。

0 个答案:

没有答案