I study security and share my knowledge.

Recent posts

(bWAPP)Stored (Cookies)

μ’‹μ•„ν•˜λŠ” μ˜μ–΄λ₯Ό μΆ”μ²œν•˜λ„λ‘ λ˜μ–΄ μžˆλ‹€. /xss_stored_2.php?genre=action&form=like λ”°λ‘œ 좜λ ₯λ˜λŠ” λ¬ΈμžλŠ” μ—†μœΌλ©° Cookie 값에 μΆ”κ°€λ˜μ–΄ μ „μ†‘λœλ‹€. 전솑될 λ•Œ GET ν˜•μ‹μœΌλ‘œ μ „μ†‘λ˜λ©° GENRE νŒŒλΌλ―Έν„°μ™€ FORM 파...

(bWAPP)Stored (Change secret)

μ‹œν¬λ¦Ώ κ°’(νŒ¨μŠ€μ›Œλ“œ νžŒλ“œ)λ₯Ό λ³€κ²½ν•˜λŠ” 둜직이 κ΅¬ν˜„λ˜μ–΄ μžˆλŠ” λ“― ν•˜λ‹€. μž…λ ₯값을 μ£Όκ³  변경을 ν•˜λ”λΌλ„ μž…λ ₯값이 νŽ˜μ΄μ§€ λ‚΄ ν˜Ήμ€ 응닡값 내에 좜λ ₯λ˜μ§€λŠ” μ•ŠλŠ”λ‹€. μœ„μ™€ 같이 둜그인 μ‹€νŒ¨μ‹œ νŒ¨μŠ€μ›Œλ“œ νžŒνŠΈμ— λŒ€ν•œ secret 값에 testλ₯Ό μ£Όμ—ˆλ‹€. ...

(bWAPP)Stored (Blog)

κΈ€μ“°κΈ° κΈ°λŠ₯이 μ‘΄μž¬ν•œλ‹€. λŒ€ν‘œμ μΈ Stored XSS 취약점이 λ°œκ²¬λ˜λŠ” μœ ν˜•μΈ κ²Œμ‹œκΈ€ μœ ν˜•μ΄λ‹€. 글을 μ“°λ©΄ μ‚¬μš©μžμ˜ μž…λ ₯값은 μ„œλ²„ λ°μ΄ν„°λ² μ΄μŠ€μ— μ €μž₯되고 κ²Œμ‹œκΈ€μ„ λ³Ό λ–„ λ°μ΄ν„°λ² μ΄μŠ€μ— μ €μž₯λ˜μ–΄ μžˆλŠ” 데이터λ₯Ό 가져와 νŽ˜μ΄μ§€ 상에 좜λ ₯ν•˜κ²Œ λœλ‹€. 이 λ•Œ 사...

(bWAPP)Reflected (User-Agent)

μ΄μ „μ˜ Referer λ¬Έμ œμ™€ λ™μΌν•˜κ²Œ User-Agent ν—€λ”μ˜ 값이 νŽ˜μ΄μ§€ 내에 κ³ μŠ€λž€νžˆ 좜λ ₯되고 μžˆλ‹€. 이 λ˜ν•œ Request 값을 κ°€λ‘œμ±„ μš”μ²­ ν—€λ”μ˜ 값을 λ³€μ‘°ν•˜λ©΄ μŠ€ν¬λ¦½νŠΈκ°€ μ‹€ν–‰λœλ‹€. User-Agent: <script>alert(1)</s...