企业资讯
- 企业新闻
- 行业文章

xss遇到的utf-7编码转utf-8编码示例

在一个xss题目中遇到的这个编码问题，utf-7和mutf-7这个编码是邮件使用的，javamail应该支持，使用utf-7这个还是比较少见的编码可以进行一些xss应用。使用原生jdk会报不支持utf-7编码的错误，这是sun jdk的bug。开源的jcharset.jar是个解决方案。将此jar包buildpath之后，就可以使用了。写了一个小程序，将编码转过来！

 public static void main(String[] args) {   //将要转义的utf-7编码格式的写在bf里，将在d盘以utf-8格式写出一个txt   //构造stringbuffer   StringBuffer bf = new StringBuffer(“+ADwAcwBjAHIAaQBwAHQAPgB3AGkAbgBkAG8AdwAuAGwAbwBjAGEAdABpAG8AbgAuAGgAcgBlAGYAPQAiAHUAdABmAC0ANwAuAHAAaABwACIAPAAvAHMAYwByAGkAcAB0AD4-”);   try {    OutputStream outputStream = new FileOutputStream(“d://utf-8.txt”);    OutputStreamWriter outputStreamWriter = new OutputStreamWriter(outputStream,”utf-8″);    //显示文件被用什么格式编码    //System.out.println(outputStreamWriter.getEncoding());    //io流的写出    BufferedWriter bufferedWriter = new BufferedWriter(outputStreamWriter);    bufferedWriter.write(new String(bf.toString().getBytes(“utf-8″),”utf-7″));    bufferedWriter.flush();    bufferedWriter.close();    bufferedWriter = null;   } catch (FileNotFoundException e) {    e.printStackTrace();   } catch (UnsupportedEncodingException e) {    // TODO Auto-generated catch block    e.printStackTrace();   } catch (IOException e) {    // TODO Auto-generated catch block    e.printStackTrace();   }

public static void main(String[] args) {

//将要转义的utf-7编码格式的写在bf里，将在d盘以utf-8格式写出一个txt

//构造stringbuffer

StringBuffer bf = new StringBuffer(“+ADwAcwBjAHIAaQBwAHQAPgB3AGkAbgBkAG8AdwAuAGwAbwBjAGEAdABpAG8AbgAuAGgAcgBlAGYAPQAiAHUAdABmAC0ANwAuAHAAaABwACIAPAAvAHMAYwByAGkAcAB0AD4-”);

try {

OutputStream outputStream = new FileOutputStream(“d://utf-8.txt”);

OutputStreamWriter outputStreamWriter = new OutputStreamWriter(outputStream,“utf-8″);

//显示文件被用什么格式编码

//System.out.println(outputStreamWriter.getEncoding());

//io流的写出

BufferedWriter bufferedWriter = new BufferedWriter(outputStreamWriter);

bufferedWriter.write(new String(bf.toString().getBytes(“utf-8″),“utf-7″));

bufferedWriter.flush();

bufferedWriter.close();

bufferedWriter = null;

} catch (FileNotFoundException e) {

e.printStackTrace();

} catch (UnsupportedEncodingException e) {

// TODO Auto-generated catch block

e.printStackTrace();

} catch (IOException e) {

// TODO Auto-generated catch block

e.printStackTrace();

}

需要的jcharset-1_5下载.

link：http://blog.apt-get.cn/?p=139

本文由网络安全攻防研究室(www.91ri.org)信息安全小组收集整理，转载请注明出处。

鸿大千秋网站建设团队敬上