ไม่รู้เหมือนกันว่ามันใช่ได้จริงเปล่า (อ้าว ^^")
ก็คงมีประโยชน์สำหรับคนที่เขาไว้ใช้ละนะ
(ถ้า web ซำ้ลบได้เลยนะ เหอะๆ)
แปลไม่เป็นครับ โปรดอ่านเอง
XSS (Cross Site Scripting) Cheat Sheet
Esp: for filter evasion
By RSnake
Note from the author: XSS is Cross Site Scripting. If you don't know how XSS (Cross Site Scripting) works, this page probably won't help you. This page is for people who already understand the basics of XSS attacks but want a deep understanding of the nuances regarding filter evasion. This page will also not show you how to mitigate XSS vectors or how to write the actual cookie/credential stealing/replay/session riding portion of the attack. It will simply show the underlying methodology and you can infer the rest. Also, please note my XSS page has been replicated by the OWASP 2.0 Guide in the Appendix section with my permission. However, because this is a living document I suggest you continue to use this site to stay up to date.
Also, please note that most of these cross site scripting vectors have been tested in the browsers listed at the bottom of the page, however, if you have specific concerns about outdated or obscure versions please download them from Evolt. Please see the XML format of the XSS Cheat Sheet if you intend to use CAL9000 or other automated tools. If you have an RSS reader feel free to subscribe to the Web Application Security RSS feed below, or join the forum:
**Hidden Content: To see this hidden content your post count must be 2 or greater.**
Reply With Quote
และแล้วก็นั่งงงต่อไป 
