|
|
发表于 2019-1-16 17:24:35
|
显示全部楼层
这个图片的地址是修改过的。那么查看网页源代码
- <div class="text"><span class="righttext"><a href="//jandan.net/ooxx/page-42#comment-4106156">4106156</a></span><p><img src="//img.jandan.net/img/blank.gif" onload="jandan_load_img(this)" /><span class="img-hash">Ly93dzMuc2luYWltZy5jbi9tdzYwMC8wMDczb2I2UGd5MWZ6OGk0aWxrdGlqMzB1MDExaDRxcC5qcGc=</span></p>
复制代码
可以看到图片标签的属性有一个函数onload=“jandan_load_img(this)”,网页加载完之后会触发这个函数。通过chrome开发者工具在Console获取这个函数的代码
- function jandan_load_img(b) {
- var d = $(b);
- var f = d.next("span.img-hash");
- var e = f.text();
- f.remove();
- var c = jd30wjxzIcvDAKIlrdElNXVJnX2H4ZE0HI(e, "tcfn8yBGKYF3L0m8UG9hvd8bCAMtPCvi");
- var a = $('<a href="' + c.replace(/(\/\/\w+\.sinaimg\.cn\/)(\w+)(\/.+\.(gif|jpg|jpeg))/, "$1large$3") + '" target="_blank" class="view_img_link">[查看原图]</a>');
- d.before(a);
- d.before("<br>");
- d.removeAttr("onload");
- d.attr("src", location.protocol + c.replace(/(\/\/\w+\.sinaimg\.cn\/)(\w+)(\/.+\.gif)/, "$1thumb180$3"));
- if (/\.gif$/.test(c)) {
- d.attr("org_src", location.protocol + c);
- b.onload = function() {
- add_img_loading_mask(this, load_sina_gif)
- }
- }
复制代码
注意到:
第4行 var e = "Ly93dzMuc2luYWltZy5jbi9tdzYwMC8wMDczb2I2UGd5MWZ6OGk0aWxrdGlqMzB1MDExaDRxcC5qcGc="
第6行jd30wjxzIcvDAKIlrdElNXVJnX2H4ZE0HI也是个函数,同样通过chrome开发者工具获取代码:
- var jd30wjxzIcvDAKIlrdElNXVJnX2H4ZE0HI = function(n, t, e) {
- var f = "DECODE";
- var t = t ? t: "";
- var e = e ? e: 0;
- var r = 4;
- t = md5(t);
- var d = n;
- var p = md5(t.substr(0, 16));
- var o = md5(t.substr(16, 16));
- if (r) {
- if (f == "DECODE") {
- var m = n.substr(0, r)
- }
- } else {
- var m = ""
- }
- var c = p + md5(p + m);
- var l;
- if (f == "DECODE") {
- n = n.substr(r);
- l = base64_decode(n)
- }
- var k = new Array(256);
- for (var h = 0; h < 256; h++) {
- k[h] = h
- }
- var b = new Array();
- for (var h = 0; h < 256; h++) {
- b[h] = c.charCodeAt(h % c.length)
- }
- for (var g = h = 0; h < 256; h++) {
- g = (g + k[h] + b[h]) % 256;
- tmp = k[h];
- k[h] = k[g];
- k[g] = tmp
- }
- var u = "";
- l = l.split("");
- for (var q = g = h = 0; h < l.length; h++) {
- q = (q + 1) % 256;
- g = (g + k[q]) % 256;
- tmp = k[q];
- k[q] = k[g];
- k[g] = tmp;
- u += chr(ord(l[h]) ^ (k[(k[q] + k[g]) % 256]))
- }
- if (f == "DECODE") {
- if ((u.substr(0, 10) == 0 || u.substr(0, 10) - time() > 0) && u.substr(10, 16) == md5(u.substr(26) + o).substr(0, 16)) {
- u = u.substr(26)
- } else {
- u = ""
- }
- u = base64_decode(d)
- }
- return u
- }
复制代码
传入的参数分别是:n="Ly93dzMuc2luYWltZy5jbi9tdzYwMC8wMDczb2I2UGd5MWZ6OGk0aWxrdGlqMzB1MDExaDRxcC5qcGc="
t="tcfn8yBGKYF3L0m8UG9hvd8bCAMtPCvi"
可以看到这个函数最后返回的是一个base64_decode(d),而d=n,所以返回的就是base64_decode(n)
base64_decode就是这帖子前面所说的那个函数,所以... |
|