XSS (Cross Site Scripting) Cheat Sheet
2012-05-20 21:51
711 查看
XSS (Cross Site Scripting) Cheat Sheet
Esp: for filter evasion
By RSnakeNote from the author: XSS is Cross Site Scripting. If you don't know how XSS (Cross Site Scripting) works, this page probably won't help you. This page is for people who already understand the basics of XSS attacks but want a deep understanding of the nuances regarding filter evasion. This page will also not show you how to mitigate XSS vectors or how to write the actual cookie/credential stealing/replay/session riding portion of the attack. It will simply show the underlying methodology and you can infer the rest. Also, please note my XSS page has been replicated by the OWASP 2.0 Guide in the Appendix section with my permission. However, because this is a living document I suggest you continue to use this site to stay up to date.
Also, please note that most of these cross site scripting vectors have been tested in the browsers listed at the bottom of the page, however, if you have specific concerns about outdated or obscure versions please download them from Evolt. Please see the XML format of the XSS Cheat Sheet if you intend to use CAL9000 or other automated tools. If you have an RSS reader feel free to subscribe to the Web Application Security RSS feed below, or join the forum:
![](http://ha.ckers.org/images/xml.gif)
Browser support reference table:
[align=CENTER]
IE7.0 | Vector works in Internet Explorer 7.0. Most recently tested with Internet Explorer 7.0.5700.6 RC1, Windows XP Professional SP2. | ||
IE6.0 | Vector works in Internet Explorer. Most recently tested with Internet Explorer 6.0.28.1.1106CO, SP2 on Windows 2000. | ||
NS8.1-IE | Vector works in Netscape 8.1+ in IE rendering engine mode. Most recently tested with Netscape 8.1 on Windows XP Professional. This used to be called trusted mode, but Netscape has changed it's security model away from the trusted/untrusted model and has opted towards Gecko as a default and IE as an option. | ||
NS8.1-G | Vector works in Netscape 8.1+ in the Gecko rendering engine mode. Most recently tested with Netscape 8.1 on Windows XP Professional | ||
FF2.0 | Vector works in Mozilla's Gecko rendering engine, used by Firefox. Most recently tested with Firefox 2.0.0.2 on Windows XP Professional. | ||
O9.02 | Vector works in Opera. Most recently tested with Opera 9.02, Build 8586 on Windows XP Professional | ||
NS4 | Vector works in older versions of Netscape 4.0 - untested. |
相关文章推荐
- XSS(Cross-site-scripting)跨站脚本攻击
- XSS (Cross Site Scripting) Prevention Cheat Sheet
- 怀疑博客被XSS(Cross Site Scripting)
- Web安全之XSS(Cross Site Scripting)深入理解
- XSS (Cross-Site-Scripting)笔记
- 防止恶意代码注入XSS(cross site scripting)
- Cross-Site Scripting Attacks (XSS)
- XSS(Cross Site Scripting)测试注意
- Reflected Cross Site Scripting (XSS)
- DOM Based Cross Site Scripting or XSS of the Third Kind
- XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
- Stored Cross Site Scripting (XSS)
- WebGoat学习——跨站脚本攻击(Cross‐Site Scripting (XSS))
- 跨站脚本攻击(Cross‐Site Scripting (XSS))
- XSS (Cross Site Scripting) Prevention Cheat Sheet(XSS防护检查单)
- PDF Cross Site Scripting (XSS) vulnerability
- Harvesting Cross Site Scripting (XSS) Victims - Clicks, Keystrokes and Cookies
- 跨站脚本攻击(Cross‐Site Scripting (XSS))实践
- 转:XSS (Cross Site Scripting) Prevention Cheat Sheet
- XSS Attack Examples (Cross-Site Scripting Attacks)