XSS

script 코드가 포함되어 있는 URL을 공격대상에게 전달, 공격대상 쪽에서 요청!
> 공격부분(<script>alert("xss");</script>)을 인코딩으로 바꿔서 공격
> 인코딩으로 바꾸는 방법 -> 공격자pc burpsuite -> decoder -> <script>alert("xss");</script> 문구를 박스에 써주고 왼쪽에 첫번째 칸에 두번째 부분에 있는 encode as 눌러서 url 클릭하면 바뀐다.
http://www.a.com/board_search.php?keyword=<script>alert("xss");</script>
====
http://www.a.com/board_search.php?keyword=%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%22%78%73%73%22%29%3b%3c%2f%73%63%72%69%70%74%3e


연습1
200.200.200.7 사이트 접속
> XSS 취약점을 이용한 공격이 가능한 위치를 찾으시오.
> Reflected, Stored 둘다 존재
> Stored는 실습한 것처럼 간단하게 가능하지는 않음

고객센터 게시판에 글쓰기로 들어가서
html 버튼 누르고 그안에 
<script>alert("xss");</script> 내용입력하고 등록

HTML 언어는 대/소문자를 구분하지 않음

> i -> 대소문자 구분 안함
$subject = preg_replace("/<script/i", "", $subject);
$content = preg_replace("/<script/i", "", $content);