XSS平台的搭建

web_security xss Comments

lnmp环境搭建

下载

1
2
3
4
5
6
https://lnmp.org/download.html

tar -zxvf lnmp1.5-full.tar.gz
./install.sh lnmp
或者
./install.sh lamp

XSS平台

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
1. 下载xss平台
https://git.oschina.net/nMask/Resource/raw/master/xss.me.new.zip

2. 数据库配置
打开phpmyadmin，
新建数据库 poppy
将解压出来的xss.sql移动到 phpmyadmin/upload 目录下面
在phpmyadmin选择导入，执行。成功导入数据库

3.config.php

$config['register'] = 'normal' //invite需要邀请码

$config['dBPwd']='xxx'
$config['urlroot'] = 192.168.31.xx

xss_url 为404

nginx 的解决方式

  1. 通过转换.htaccess: http://www.anilcetin.com/convert-apache-htaccess-to-nginx/
  2. 将转换后的内容写入/usr/local/nginx/config/my.conf
1
2
3
4
5
6
location / {
    rewrite "^/([0-9a-zA-Z]{6})$" /index.php?do=code&urlKey=$1 last;
	rewrite ^/do/auth/(w+?)(/domain/([w.]+?))?$ /;
	rewrite ^/register/(.*?)$ /index.php?do=register&key=$1 last;
	rewrite ^/register-validate/(.*?)$ /index.php?do=register&act=validate&key=$1 last;
}

apache的解决方式,新增 .htaccess

1
2
3
4
5
6
7
8
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^([0-9a-zA-Z]{6})$ /index.php?do=code&urlKey=$1 [L] 
RewriteRule ^do/auth/(w+?)(/domain/([w.]+?))?$  /index.php?do=do&auth=$1&domain=$3 [L] 
RewriteRule ^register/(.*?)$ /index.php?do=register&key=$1 [L] 
RewriteRule ^register-validate/(.*?)$ /index.php?do=register&act=validate&key=$1 [L]
</IfModule>

然后修改apache的配置

1
AllowOverride None ==> AllowOverride All

Reference

https://thief.one/2017/03/15/Xss平台搭建小记/

https://zhuanlan.zhihu.com/p/27020543