Analysis of javascript function hijacking and javascript Analysis

Analysis of javascript function hijacking and javascript Analysis

What is javascript function hijacking?

Function hijacking, as its name implies, is to hijack a function and add the desired function before it runs. When this function is actually running, it is not the original function, but with the added function. This is also one of our common hook functions.

At first glance, it seems like a function rewrite. Function rewriting can also be understood as a function hijacking method, but this method is too disgusting. As a hijacking person, we should also abide by our professional ethics after the benefits of the ticket binding and keep people intact. Therefore, we have to re-call the original functions of the function in a proper place.

To put it bluntly, we often encounter the concept of "hijacking". For example, if a website is hijacked by a carrier, the operator's advertisement will pop up when browsing the website.

Example Analysis

Now let's take a simple example to hijack the alert () function and add a little functionality to it:

let warn = alertwindow.alert = (t) => { if (confirm('How are you?')) warn(t)}alert('Help me...!!!')

Open the developer tool and try this example. You will find that you areconfirmClick OK.Help me...!!!.

Next we encapsulate this part of content to become a common function:

const hijack = (obj, method, fun) => { let orig = obj[method] obj[method] = fun(orig)}

First, we definehijackFunction, which saves the original function and then executes the UDF. The original function is called within the UDF.

Then we hijack it.confirm()Function:

hijack(window, 'confirm', (orig) => { return (text) => { alert('HELP ME PLZ!!!') if (orig.call(this, text)) {  alert('YOU SEEMS FINE AND I AM LEAVING, GOOD BYE!') } else {  alert('HOLD ON! I AM COMING!!') } }})

The functions of this function are not described in detail.confirm()You will know.

Anti-Hijacking

Create a page, open your Developer Tools console, and enteralert, You will see the following output:

function alert() { [native code] }

Use the code at the beginning of this articlealert()Hijack it, and then enter it again on the consolealert, You will see the following output:

function (t) => { if (confirm('How are you?')) warn(t)}

The preceding example shows whether a function is hijacked. You only need to print it out. For system native functions, [native code]It indicates that it is pure and pollution-free.

Function hijacking

In addition to adding functions to functions, function hijacking can also be used to track information of malicious users. Generally, XSS attacks are exploited first.alert()To test the method that can output information. At this time, we can first test the nativealert()Hijack, enter the tracing code to it, and then release the original function. When malicious users are testingalert()We will immediately track it, but he is not aware of it.

JavaScript Hijacking and JavaScript Hijacking hacking technology

Note: The serial number in the figure indicates the implementation sequence of the JavaScript black technology.

In this example, you can log on to a website with a vulnerability and then switch to a malicious website (the trusted Website Cannot log out at this time ), at this time, the malicious website will return JavaScript scripts and trust the website's return.cookieRe-send it to a trusted website to obtain sensitive information of a trusted website.

Note:

1. The content returned by the trusted website (step 2) must be a JSON array.JSONIf the object is returned, JavaScript errors will occur, but we can check the returned type. if the object is returned, we can add brackets before and after the object.

2. The relationship between Hijacking and the JavaScript Hijacking technology is embodied in step 5. in step 5, the method in the object must be rewritten through JavaScript Hijacking, so as to record the sensitive information of trusted websites, the implementation of JavaScript Hijacking is inseparable from Hijacking.

3. A trusted website must respond to oneGETRequest

Summary

Function hijacking in Javascript is nothing new, but it just seems a stranger to this knowledge point in my recent work. So I spent some time researching it, and record the results. The above is all the content of this article. If you find any mistakes or omissions, please correct them!