Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 278
홍차넷
Warning: Use of undefined constant level - assumed 'level' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/outlogin_toby.php on line 34
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/outlogin_toby.php on line 45
Warning: Use of undefined constant r - assumed 'r' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/outlogin_toby.php on line 47
Warning: Use of undefined constant r - assumed 'r' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/outlogin_toby.php on line 51
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 237
Warning: Use of undefined constant level - assumed 'level' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/outlogin_toby.php on line 34
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/outlogin_toby.php on line 45
Warning: Use of undefined constant r - assumed 'r' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/outlogin_toby.php on line 47
Warning: Use of undefined constant r - assumed 'r' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/outlogin_toby.php on line 51
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 237
Warning: Use of undefined constant is_admin - assumed 'is_admin' (this will throw an Error in a future version of PHP) in /home/redtea/html/zero_header.php on line 269
Warning: Use of undefined constant level - assumed 'level' (this will throw an Error in a future version of PHP) in /home/redtea/html/zero_header.php on line 300
Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/bbs_title.php on line 16
추천
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/bbs_title.php on line 21
Warning: Use of undefined constant header - assumed 'header' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/bbs_title.php on line 31
- 회원들이 추천해주신 좋은 글들을 따로 모아놓는 공간입니다.
- 추천글은 매주 자문단의 투표로 선정됩니다.
Warning: Use of undefined constant use_formmail - assumed 'use_formmail' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 519
Warning: Use of undefined constant use_category - assumed 'use_category' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/include/print_category.php on line 9
전체기타일상/생각꿀팁/강좌게임문학영화의료/건강문화/예술경제체육/스포츠과학철학/종교정치/사회요리/음식역사여행IT/컴퓨터음악창작사진
Warning: Use of undefined constant level - assumed 'level' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/setup.php on line 29
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/setup.php on line 41
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 389
Warning: Use of undefined constant x - assumed 'x' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 398
Warning: Use of undefined constant subject - assumed 'subject' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 402
Warning: Use of undefined constant x - assumed 'x' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 403
Warning: Use of undefined constant reg_date - assumed 'reg_date' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 405
Warning: Use of undefined constant total_comment - assumed 'total_comment' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 406
Warning: Use of undefined constant subject - assumed 'subject' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 402
Warning: Use of undefined constant x - assumed 'x' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 403
Warning: Use of undefined constant reg_date - assumed 'reg_date' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 405
Warning: Use of undefined constant total_comment - assumed 'total_comment' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 406
Warning: Use of undefined constant subject - assumed 'subject' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 402
Warning: Use of undefined constant x - assumed 'x' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 403
Warning: Use of undefined constant reg_date - assumed 'reg_date' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 405
Warning: Use of undefined constant total_comment - assumed 'total_comment' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 406
Warning: Use of undefined constant subject - assumed 'subject' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 402
Warning: Use of undefined constant x - assumed 'x' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 403
Warning: Use of undefined constant reg_date - assumed 'reg_date' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 405
Warning: Use of undefined constant total_comment - assumed 'total_comment' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 406
Warning: Use of undefined constant name - assumed 'name' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view.php on line 2
Warning: Use of undefined constant HTTP_HOST - assumed 'HTTP_HOST' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/memo_replace.php on line 3
Warning: Use of undefined constant x - assumed 'x' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view.php on line 10
Warning: Use of undefined constant use_category - assumed 'use_category' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view.php on line 40
| Date |
Warning: Use of undefined constant reg_date - assumed 'reg_date' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view.php on line 53 21/04/20 22:42:17 Warning: Use of undefined constant mod_date - assumed 'mod_date' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view.php on line 56 |
| Name | ikuk |
| Subject | 우리도 홍차넷에 xss공격을 해보자 |
|
제목은 어그로입니다. 재송합니다... 작년 한창 면접보러 다닐때 나왔던 코딩테스트 중에 xss공격을 당하기 쉽게 만들어놓은 웹 페이지를 보수하는 문제가 있었습니다. 그 당시엔 xss... 와 진짜 오랜만이다... 라는 생각이었는데, 올해도 어김없이 이 단어를 만나게 되서 감회가 새롭네요. XSS가 무엇인지 궁금하실까 해서 빠르게 적고 사라지겠습니다. 풀네임은 크로스 사이트 스크립팅(Cross site scripting)입니다. 몬헌X를 크로스라고 부르듯, XSS라고 표기합니다. '크로스 사이트'는 문자 그대로 '사이트를 통해서' 라는 뜻이고, 그 위에서 스크립트를 실행하는 행위를 말합니다. JS와 같은 언어는 script태그를 적어서 그 태그 안에 자기가 원하는 프로그램을 작성하고 실행할 수 있는데, 크롬이나 모던 브라우저를 쓰시는 분들은, F12 개발자 창을 열고, Console탭에서 alert('XSS!'); 를 복붙해 실행시켜보세요. 그러면 홍차넷 위에 스크립트 알럿창을 띄울 수가 있습니다. 하지만 다른 사람에게 똑같이 알럿창을 띄우고 싶다면 어떻게 해야 할까요? 이 게시글에 제가 script태그로 alert('XSS!');을 적고, 포스팅하면, 제 글을 읽는 모든 사람이 그 태그를 실행하게 되는거죠. 만약에 제가 이 게시글에 여러분의 컴퓨터의 불을 지르는 스크립트를 작성했다면 여러분이 이 게시글을 여는 순간 바로 컴퓨터에 불이 났을 겁니다. 그래서 크로스 사이트라고 하는거죠. 이런 스크립트를 사용해 사이트 유저들의 정보를 유출시키는 해킹을 XSS라고 부릅니다. 한때는 너무나 많은 사이트들이 이 해킹에 취약했고, 이 터무니없이 강력한 JS가 웹을 망가트린다고 욕을 먹었습니다. 그래서 대부분의 모던 CMS들은 유저가 글을 쓰는 기능에 script를 넣을 수 없도록 막아둔 곳이 많습니다. 아마 홍차넷이 쓰는 제로보드도 이미 많이 보안되어있을 정도로 오래된 이야기 입니다. 물론 js말고도 수많은 XSS공격방법이 있습니다만, 귀찮아서 그만 적겠습니다. (나무위키가 이런거 빠삭합니다. 원래 불난 집 구경이 재밌잖아요) 이렇게 우리도 우리도 크로스 사이트 스크립팅 준비가 끝났습니다. (당연히 아닙니다) 그럼 본론으로 돌아와 홍차넷 공격을 진행해봅시다. 이제 홍차넷 곳곳에 숨겨진 PHP파일을 찾아보세요. 원피스처럼 세상의 모든 것을 그곳에 숨겨두셨을 겁니다(아닙니다) 아마 숨겨진 PHP파일들은 대부분 토비님이 수작업을 자동화하기 위해 만드셨을 겁니다. 혹시 만약에 이것을 찾으셨다면, 그다음에는 GET파라미터 (write.php?id=free의 id=free 부분)을 유추해봅니다. 분명 먹히는 게 있을겁니다. 예를들어서 자동강등용 leveldown.php를 찾았다면, leveldown.php?member_no=7245 (제 아이디 번호입니다) 등을 실행해보는거죠. 여기까지 성공하셨다면 당신은 원피스를 찾은겁니다. 마지막으로 for 구문으로 0부터 100000까지 반복시켜서 모든 회원들을 평등하게 강등시킵시다. 아, 자기자신의 아이디는 강등처리가 안되게끔 꼭 예외처리를 해두세요. 건의 게시판에다가 이런걸 찾았다고 토비님께 꼭 자랑해야 하니까요. * Cascade님에 의해서 티타임 게시판으로부터 게시물 복사되었습니다 (2021-05-04 07:40) * 관리사유 : 추천게시판으로 복사합니다. Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view.php on line 133 Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view.php on line 146 Warning: Use of undefined constant vote - assumed 'vote' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view.php on line 161 14
|
|
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 185
Warning: Use of undefined constant use_comment - assumed 'use_comment' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 540
Warning: Use of undefined constant name - assumed 'name' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 542
Warning: Use of undefined constant ismember - assumed 'ismember' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 543
Warning: Use of undefined constant memo - assumed 'memo' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 545
Warning: Use of undefined constant ismember - assumed 'ismember' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 576
Warning: Use of undefined constant ismember - assumed 'ismember' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 577
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 577
Warning: Use of undefined constant level - assumed 'level' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 577
Warning: Use of undefined constant grant_delete - assumed 'grant_delete' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 577
Warning: Use of undefined constant ismember - assumed 'ismember' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 429
Warning: Use of undefined constant use_formmail - assumed 'use_formmail' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 605
Warning: Use of undefined constant name - assumed 'name' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 599
Warning: Use of undefined constant name - assumed 'name' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 599
Warning: Use of undefined constant name - assumed 'name' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 600
Warning: Use of undefined constant name - assumed 'name' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 600
Warning: Use of undefined constant is_admin - assumed 'is_admin' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 605
Warning: Use of undefined constant is_admin - assumed 'is_admin' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 605
Warning: Use of undefined constant is_admin - assumed 'is_admin' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 609
Warning: Use of undefined constant is_admin - assumed 'is_admin' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 609
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 614
Warning: Use of undefined constant ismember - assumed 'ismember' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 616
Warning: Use of undefined constant x - assumed 'x' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 618
Warning: Use of undefined constant name - assumed 'name' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/lib.php on line 618
Warning: Use of undefined constant x - assumed 'x' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 612
Warning: Use of undefined constant name - assumed 'name' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 612
Warning: Use of undefined constant reg_date - assumed 'reg_date' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 620
Warning: Use of undefined constant ismember - assumed 'ismember' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 628
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 628
Warning: Use of undefined constant HTTP_HOST - assumed 'HTTP_HOST' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 640
Warning: Use of undefined constant name - assumed 'name' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 644
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 646
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/view.php on line 646
Warning: Use of undefined constant HTTP_HOST - assumed 'HTTP_HOST' (this will throw an Error in a future version of PHP) in /home/redtea/html/pb/cmt_replace.php on line 3
Warning: Use of undefined constant ismember - assumed 'ismember' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 6
Warning: Use of undefined constant file_name - assumed 'file_name' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 28
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 65
22440 class="iamcmt" style="display:none;"> Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 66
22440 class='vcm '>
Warning: Use of undefined constant x - assumed 'x' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 70
Warning: Use of undefined constant x - assumed 'x' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 71
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 76
Warning: Use of undefined constant ismember - assumed 'ismember' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 117
Warning: Use of undefined constant ismember - assumed 'ismember' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 118
Warning: Use of undefined constant ismember - assumed 'ismember' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 119
Warning: Use of undefined constant ismember - assumed 'ismember' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 120
Warning: Use of undefined constant ismember - assumed 'ismember' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 121
22440'> 자크
Warning: Use of undefined constant mod_date - assumed 'mod_date' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 133
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 140
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 140
Warning: Use of undefined constant reg_date - assumed 'reg_date' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 142
21/04/20 22:50
22440>삭제 주소복사
Warning: Use of undefined constant level - assumed 'level' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 150
미리 강등 축하드립니다 (농담)
Warning: Use of undefined constant level - assumed 'level' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 158
Warning: Use of undefined constant password - assumed 'password' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 166
Warning: Use of undefined constant vote - assumed 'vote' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 171
Warning: Use of undefined constant vote - assumed 'vote' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 172
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 173
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 173
Warning: Use of undefined constant vote - assumed 'vote' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 173
1
Warning: Use of undefined constant level - assumed 'level' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 158
Warning: Use of undefined constant password - assumed 'password' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 166
Warning: Use of undefined constant vote - assumed 'vote' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 171
Warning: Use of undefined constant vote - assumed 'vote' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 172
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 173
Warning: Use of undefined constant no - assumed 'no' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 173
Warning: Use of undefined constant vote - assumed 'vote' (this will throw an Error in a future version of PHP) in /home/redtea/html/a_skin/bbsd/view_comment.php on line 173
1
22440>
22440>
