Some websites allow javascript code Cracking for Blank referer anti-leech images _ javascript skills

The main reason is that some websites call anti-leech images, but generally only judge whether the referer is a website. If the referer is empty, the image is displayed, so the following code is available. Javascript source code:

The Code is as follows:

Function showImg (url ){
Var imgid = Math. random (),
Frameid = 'frameimg '+ imgid;
Window ['img '+ imgid] =' script window. onload = function () {parent.doc ument. getElementById (\ ''+ frameid + '\'). height = document. getElementById (\ 'img \'). height + \ 'px \ ';} <' + '/script> ';
Document. write ('');
}

Call method:

The Code is as follows:

ShowImg ('image address ');

Complete DEMO code:

<Meta http-equiv = "Content-Type" content = "text/html; charset = gb2312"/> <script type = "text/javascript"> function showImg (url) {var frameid = 'frameimg '+ Math. random (); window. img = 'script window. onload = function () {parent.doc ument. getElementById (\ ''+ frameid + '\'). height = document. getElementById (\ 'img \'). height + \ 'px \ ';} <' + '/script>'; document. write ('');} script: <br> js cracking: <br> <p id = "hotlinking"> <script type = "text/javascript"> showImg ('HTTP: // resize (600x)/thumb.jpg '); script </p> <br>
[Ctrl + A select all Note: If you need to introduce external Js, You need to refresh it to execute]

Compatibility: IE6, IE7, IE8, chrome 7, FF3.6, and Opera10.63 have been tested.

Defense method:
1. referer is not allowed to be blank (it is not recommended because referer is blank in Some browsers that enable privacy mode or when referenced by https pages );
2. Address Change (lighttpd is based on the effective time, And nginx is based on md5 );
3. logon verification (for example, you must log on to the website account before accessing the account );