CRLF漏洞

swq
笔记
2023-11-11
1907热度
0评论

CRLF 注入漏洞，是因为 Web 应用没有对用户输入做严格验证，导致攻击者可以输入一些恶意字符。攻击者一旦向请求行或首部中的字段注入恶意的 CRLF，就能注入一些首部字段或报文主体，并在响应中输出，所以又称为 HTTP 响应拆分漏洞。

先抓一个数据包看看

GET / HTTP/1.1
Host: www.baidu.com
Cookie:1
COOKIE_SESSION=35_0_8_5_6_27_1_0_8_8_1_18_293077_0_1_0_1699355218_0_1699355217%7C9%232331798_44_1698460305%7C9; BD_UPN=13314752; Hm_lvt_aec699bb6442ba076c8981c6dc490771=1698371232,1699060906,1699355211; baikeVisitId=2bf56843-a8ff-46cf-ace8-c7e0e84cd0aa; channel=www.hao123.com; B64_BOT=1; H_PS_PSSID=39633_39668_39664_39686_39692_39694_39676_39679; BA_HECTOR=85a0a5242h0laga0al258l0k1ikuged1q; BDORZ=B490B5EBF6F3CD402E515D22BCDA1598; BDRCVFR[Fc9oatPmwxn]=aeXf-1x8UdYcs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close

如果我们访问www.baidu.com/search换行符号Host： www.123.com

是不是数据包就会变成，改变host

GET /search HTTP/1.1
Host: www.123.com
Host: www.baidu.com
Cookie: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close

这种漏洞的危险性很低

但是配上其他漏洞就会有有一定危害性

比如，xss

%0aSet-cookie:JSPSESSID%3Ddrops url=%0d%0a%0d%0a<img src=1 onerror=alert(/xss/)>/ CRLFuzz：https://github.com/dwisiswant0/crlfuzz/releases

CRLF自动化扫描工具

crlfuzz.exe

使用方法
下载工具
在工具目录下，打开cmd
crlfuzz.exe -u "http://www.baidu.com"

当前面有符号，就说明有crlf漏洞

URL重定向漏洞

一般重定向的特征是传参?url=http://......

如果将url参数换成钓鱼网站，就会造成危害http://xxx/zb_system/login.php?url=http://www.xiaodi8.com/zb_system/login.php

大概意思是讲重定向漏洞的危害：网站接受用户输入的链接，跳转到一个攻击者控制的网站，可能导致跳转过去的用户被精心设置的钓鱼页面骗走自己的个人信息和登录口令