https://souljian.cn/tags/%E8%B4%A6%E5%8F%B7%E6%8E%A5%E7%AE%A1/Recent content in 账号接管 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088191/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088191/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>XSS/CSRF 测试只在授权测试环境进行。</p> <h2 id="一xss-打-csrf-攻击链">一、XSS 打 CSRF 攻击链 </h2><img src="https://souljian.cn/img/xss-csrf-chain.svg" alt="XSS 打 CSRF 攻击链" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① XSS → ② 窃取 Session/Cookie → ③ CSRF Token → ④ 账号接管 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二利用方式">二、利用方式 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">XSS → 窃取 Cookie → 伪造登录会话 </span></span><span class="line"><span class="cl">XSS → 窃取 CSRF Token → 发起恶意请求 </span></span><span class="line"><span class="cl">XSS → 篡改页面 → 诱导用户操作 </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">输出编码 · CSP · HttpOnly Cookie </span></span><span class="line"><span class="cl">SameSite Cookie · CSRF Token · 二次确认 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>XSS + CSRF 是 Web 应用最常见的联动攻击。<strong>HttpOnly Cookie + SameSite + CSP</strong> 是防御核心。</p>