开发笔记:基于Chormeheadless的xss检测实践

本文内容比较多，建议点击“阅读原文”进行浏览。

起因

从内容可以看出来是页面渲染时浏览器通知客户端浏览器发生的事件。

漏洞判别标准及实现

1、 监听页面的弹窗事件：
通过循环监听Page.JavascriptDialogOpening的结果，判断页面是否存在弹窗事件。
其socket回包是：

1{"method":"Page.JavascriptDialogOpening","params":
2{"url":"http://xss.php","message":"1","type":"alert","hasBrowserHandler":false,"defaultPrompt":""}
3}

2、 查看dom中的localName是否有存在我们自定义的标签
通过循环监听DOM.getDocument的return来判断我们自定义的标签是否被解析。其数据包如下：

1{"id":2324,"result":{"root":{"nodeId":30453,"backendNodeId":6,"nodeType":9,"nodeName":"#document","localName":"","nodeValue":"","childNodeCount":1,"children":[{"nodeId":30454,"parentId":30453,"backendNodeId":7,"nodeType":1,"nodeName":"HTML","localName":"html","nodeValue":"","childNodeCount":2,"children":[{"nodeId":30455,"parentId":30454,"backendNodeId":8,"nodeType":1,"nodeName":"HEAD","localName":"head","nodeValue":"","childNodeCount":0,"children":[],"attributes":[]},{"nodeId":30456,"parentId":30454,"backendNodeId":9,"nodeType":1,"nodeName":"BODY","localName":"body","nodeValue":"","childNodeCount":4,"children":[{"nodeId":30457,"parentId":30456,"backendNodeId":10,"nodeType":1,"nodeName":"TABLE","localName":"table","nodeValue":"","childNodeCount":1,"children":[{"nodeId":30458,"parentId":30457,"backendNodeId":11,"nodeType":1,"nodeName":"TBODY","localName":"tbody","nodeValue":"","childNodeCount":2,"children":[{"nodeId":30459,"parentId":30458,"backendNodeId":12,"nodeType":1,"nodeName":"TR","localName":"tr","nodeValue":"","childNodeCount":2,"children":[{"nodeId":30460,"parentId":30459,"backendNodeId":13,"nodeType":1,"nodeName":"TD","localName":"td","nodeValue":"","childNodeCount":1,"children":[{"nodeId":30461,"parentId":30460,"backendNodeId":14,"nodeType":3,"nodeName":"#text","localName":"","nodeValue":"id"}],"attributes":[]},{"nodeId":30462,"parentId":30459,"backendNodeId":15,"nodeType":1,"nodeName":"TD","localName":"td","nodeValue":"","childNodeCount":1,"children":[{"nodeId":30463,"parentId":30462,"backendNodeId":16,"nodeType":3,"nodeName":"#text","localName":"","nodeValue":"username"}],"attributes":[]}],"attributes":[]},{"nodeId":30464,"parentId":30458,"backendNodeId":17,"nodeType":1,"nodeName":"TR","localName":"tr","nodeValue":"","childNodeCount":2,"children":[{"nodeId":30465,"parentId":30464,"backendNodeId":18,"nodeType":1,"nodeName":"TD","localName":"td","nodeValue":"","childNodeCount":0,"children":[],"attributes":[]},{"nodeId":30466,"parentId":30464,"backendNodeId":19,"nodeType":1,"nodeName":"TD","localName":"td","nodeValue":"","childNodeCount":1,"children":[{"nodeId":30467,"parentId":30466,"backendNodeId":20,"nodeType":3,"nodeName":"#text","lo

3、 通过解析DOM.getDocument的return里的 nodeValue来判断payload是否存在于最后渲染的页面里。

一些细节:

1、 如何触发事件的弹窗，通过遍历dom树触发事件来触发Onerror=alert之类的弹窗

2、 如何支持post请求：

chrome远程调试的配置：

1chrome-canary --remote-debugging-port=9222 --headless -remote-debugging-address=0.0.0.0 --disable-xss-auditor --no-sandbox --disable-web-security

这里关闭了xss-auditor 和安全相关的一些参数。所以事实上如果不对参数进行处理部署在内网可能会导致ssrf的情况。

三种不同的判断逻辑的结果：
scan_result结果：

1# level 3 代表触发了Page.JavascriptDialogOpening事件
2{'url': u'http://xss.php', 'vul': 'xss', 'post': '', 'method': u'GET', 'level': '3'}
3# level 2 代表dom树的节点包含了我们自定义的标签
4{'url': u'http://xss.php', 'vul': 'xss', 'post': '', 'method': u'GET', 'level': '2'}
5# level 1 代表渲染后的nodeValue包含我们的payload
6{'url': u'http://xss.php', 'vul': 'xss', 'post': u'id1=1&id2=2test_test', 'method': u'POST', 'level': '1'}

源码及使用方法

Mac os 安装 chrome-canary：

1brew install Caskroom/versions/google-chrome-canary

启动chrome远程调试：

1chrome-canary --remote-debugging-port=9222 --headless -remote-debugging-address=0.0.0.0 --disable-xss-auditor --no-sandbox --disable-web-security

centos7：
安装chrome

1$ vi /etc/yum.repos.d/google-chrome.repo

写入如下内容：

1[google-chrome]
2name=google-chrome
3baseurl=http://dl.google.com/linux/chrome/rpm/stable/$basearch
4enabled=1
5gpgcheck=1
6gpgkey=https://dl.google.com/linux/linux_signing_key.pub

然后

1$ sudo yum install google-chrome-stable

后台启动chrome-stable

1nohup google-chrome-stable --disable-gpu --remote-debugging-port=9222 --headless -remote-debugging-address=0.0.0.0 --disable-xss-auditor --no-sandbox --disable-web-security > chromeheadless.out 2>&1 & 

chrome_headless_xss

1# tmp_url为添加payload的url，如果是post请求则为原始url
2chrome_headless_drive = ChromeHeadLess(url=tmp_url,
3ip="127.0.0.1",
4port="9222",
5COOKIE="",
6post="",
7auth="",
8payloads= payload)
9scan_result = chrome_headless_drive.run()

scan_result结果：

1# level 3 代表触发了Page.JavascriptDialogOpening事件
2{'url': u'http://xss.php', 'vul': 'xss', 'post': '', 'method': u'GET', 'level': '3'}
3# level 2 代表dom树的节点包含了我们自定义的标签
4{'url': u'http://xss.php', 'vul': 'xss', 'post': '', 'method': u'GET', 'level': '2'}
5# level 1 代表渲染后的nodeValue包含我们的payload
6{'url': u'http://xss.php', 'vul': 'xss', 'post': u'id1=1&id2=2test_test', 'method': u'POST', 'level': '1'}

源码链接：

https://github.com/neverlovelynn/chrome_headless_xss/

总结及思考

1、 其实使用websocket和chrome进行通信整个过程是异步的，使用异步的方法可以解决粗暴的通过超时来控制循环监听的问题，同时也能提高扫描效率。

2、 在关闭了同源策略的情况下，可能会导致内网ssrf，所以要对传入参数进行处理。可以尝试用其他方法实现post请求，如在Network.requestWillBeSent时修改请求参数。

3、 由于企业内部对qps有限制，我们扫描的payload数量会被限制的很少。不能进行fuzz，如果需要fuzz模块可以参考 https://github.com/bsmali4/xssfork 的fuzz模块进行payload的fuzz。另外我有一个想法就是既然能得到最后的dom，是否能通过对指纹上下文进行分析自动生成精准的payload。但是想了很久也没想到优雅的实现方式。

往期
精彩回顾