Operators hijacked the system and even changed Json

Operators hijacked the system and even changed Json

Operator hijacking is a common tactic used by thieves. They target people of all ages, even children. They often arrogantly pop up some embarrassing ads in the lower right corner or at the beginning or end of the web page. This makes it difficult for mothers who are tutoring their children to explain.

[[280817]]

1. Introduction

A classic interview question: What actually happens when you enter a URL and press Enter?

That depends on what URL you enter. Taobao will hurt your hands, Baidu will hurt your body, and Tencent will hurt your kidneys...

2. Mysterious Return

It was a sunny day with no clouds in the sky. The latency was reduced to less than 50ms. It was a good day for free-range crawlers.

As usual, with a few quick operations, the data was successfully stored in the database like a hundred rivers flowing into the sea. Just when I wanted to make a cup of coffee and look at the long-lost sky, a long error message splashed onto the screen like diarrhea!

Grass (a kind of plant), has it been discovered? Check it out quickly

Grass! (a powerful plant). What is this? I thought it would return an abnormal status code, or an error json, or at least fake data, but I didn't expect that even the data format was changed, and a whole HTML was thrown at me?

But this interface is clearly all json.

I drank some water to calm myself down but ended up burning my mouth... After thinking it over, the product can't meet this demand if it only drinks alcohol without eating food. Besides, I'm a small mosquito, so I won't use a cannon to attack.

There must be! — Question! — Question!

I quickly checked the logs and found the frequency. There was an exception in about 10 requests, so I got all the HTML codes. Let's learn...

  1.  <html>
  2.  <head>
  3.     <meta http-equiv= "Content-Type" content= "text/html; charset=utf-8" />
  4.  <meta id= "viewport"   name = "viewport" content= "width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no" >
  5.  </head>
  6.  <script>
  7.     window[ "$$$wins_pm" ] = {
  8.  "a" : "https://atplay.cn/banner/indexsd.aspx" ,
  9.  "m" : "http://baidu.com/" ,
  10.  "_xus" : "YBsOw1mgMPSOdBFpMBFjYBQjMZSjMBsXM3gO" ,
  11.  "_xai" : "0"  
  12.  }; 
  13.  
  14.     var xp= null , key = "d=123" ,lo=location.href,ho= false ;
  15.  function cu(u){
  16.         var p=u.indexOf( "?" );
  17.  if(p>0)
  18.             u=u.slice(0,p+1)+ key + "&" +u.slice(p+1);
  19.  else  
  20.  u+= "?" + key ;
  21.  return u; 
  22.  
  23.  } 
  24.  
  25.  function Base64() {
  26.         _keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" ;
  27.         this.encode = function (input) {
  28.  var output = "" ;
  29.             var chr1, chr2, chr3, enc1, enc2, enc3, enc4;
  30.  var i = 0;
  31.             input = _utf8_encode(input);
  32.             while (i < input.length) {
  33.                 chr1 = input.charCodeAt(i++);
  34.                 chr2 = input.charCodeAt(i++);
  35.                 chr3 = input.charCodeAt(i++);
  36.                 enc1 = chr1 >> 2;
  37.                 enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
  38.                 enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
  39.                 enc4 = chr3 & 63;
  40.                 if (isNaN(chr2)) {
  41.                     enc3 = enc4 = 64
  42.                 } else if (isNaN(chr3)) {
  43.  enc4 = 64
  44.  }
  45.  output = output + _keyStr.charAt(enc1) + _keyStr.charAt(enc2) + _keyStr.charAt(enc3) + _keyStr.charAt(enc4)
  46.  }
  47.  return   output  
  48.  };
  49.         this.decode = function (input) {
  50.  var output = "" ;
  51.             var chr1, chr2, chr3;
  52.             var enc1, enc2, enc3, enc4;
  53.  var i = 0;
  54.             input = input. replace (/[^A-Za-z0-9\+\/\=]/g, "" );
  55.             while (i < input.length) {
  56.                 enc1 = _keyStr.indexOf(input.charAt(i++));
  57.                 enc2 = _keyStr.indexOf(input.charAt(i++));
  58.                 enc3 = _keyStr.indexOf(input.charAt(i++));
  59.                 enc4 = _keyStr.indexOf(input.charAt(i++));
  60.                 chr1 = (enc1 << 2) | (enc2 >> 4);
  61.                 chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
  62.                 chr3 = ((enc3 & 3) << 6) | enc4;
  63.  output = output + String.fromCharCode(chr1);
  64.                 if (enc3 != 64) {
  65.  output = output + String.fromCharCode(chr2)
  66.  }
  67.                 if (enc4 != 64) {
  68.  output = output + String.fromCharCode(chr3)
  69.  }
  70.  }
  71.  output = _utf8_decode( output );
  72.  return   output  
  73.  };
  74.         _utf8_encode = function (string) {
  75.             string = string.replace (/\r\n/g, "\n" );
  76.             var utftext = "" ;
  77.  for (var n = 0; n < string.length; n++) {
  78.                 var c = string.charCodeAt(n);
  79.                 if (c < 128) {
  80.                     utftext += String.fromCharCode(c)
  81.                 } else if ((c > 127) && (c < 2048)) {
  82.                     utftext += String.fromCharCode((c >> 6) | 192);
  83.                     utftext += String.fromCharCode((c & 63) | 128)
  84.  } else {
  85.                     utftext += String.fromCharCode((c >> 12) | 224);
  86.                     utftext += String.fromCharCode(((c >> 6) & 63) | 128);
  87.                     utftext += String.fromCharCode((c & 63) | 128)
  88.  }
  89.  }
  90.  return utftext
  91.  };
  92.         _utf8_decode = function (utftext) {
  93.  var string = "" ;
  94.  var i = 0;
  95.             var c = c1 = c2 = 0;
  96.             while (i < utftext.length) {
  97.                 c = utftext.charCodeAt(i);
  98.                 if (c < 128) {
  99.                     string += String.fromCharCode(c);
  100.  i++
  101.                 } else if ((c > 191) && (c < 224)) {
  102.                     c2 = utftext.charCodeAt(i + 1);
  103.                     string += String.fromCharCode(((c & 31) << 6) | (c2 & 63));
  104.  i += 2
  105.  } else {
  106.                     c2 = utftext.charCodeAt(i + 1);
  107.                     c3 = utftext.charCodeAt(i + 2);
  108.                     string += String.fromCharCode(((c & 15) << 12) | ((c2 & 63) << 6) | (c3 & 63));
  109.  i += 3
  110.  }
  111.  }
  112.  return string
  113.  }
  114.  }
  115.     window[ "__BASE64" ] = new Base64(); 
  116.  
  117.  function getURLwithParams() {
  118.  var url = "" ;
  119.         if ($$$wins_pm.a.indexOf( '?' ) > 0) {
  120.             url = $$$wins_pm.a + "&_us=" + $$$wins_pm._xus + "&_su=" + __BASE64.encode($$$wins_pm.m) + "&_id=" + $$$wins_pm._xai;
  121.  } else {
  122.             url = $$$wins_pm.a + "?_us=" + $$$wins_pm._xus + "&_su=" + __BASE64.encode($$$wins_pm.m) + "&_id=" + $$$wins_pm._xai;
  123.  }
  124.  return url;
  125.  }
  126.  function goURLm() {
  127.         var desturl = $$$wins_pm.m;
  128.         if (desturl.slice(desturl.length - 1) == "/" ) desturl = desturl.slice(0, desturl.length - 1);
  129.  return   "<html></head><script>document.location.replace(\"" + desturl + "\");<\/script><\/html>"  
  130.  };
  131.  </script>
  132.   <body style= "margin:0;padding:0;" >
  133.     <! --<div style="display: none;"><script src="https://s6.cnzz.com/z_stat.php?id=722749&web_id=722749" language="JavaScript"></script></div>-->  
  134.     <script type= "text/javascript" src= "https://atplay.cn/banner/indexsd.js" ></script>
  135.     <div style= "width:100%;height:100%;-webkit-overflow-scrolling:touch;overflow-y:scroll;" >
  136.     <iframe id= 'ifrmain' src= 'JavaScript:parent.goURLm()' scrolling=auto width= '100%' height= '100%' frameborder= 'no' onload= '' ></iframe>
  137.  </div>
  138.  </body>
  139.  </html>

3. The truth is revealed

Damn! The truth is out. This lousy code is definitely not suitable for crawlers. It is not even as good as gutter oil! It is probably the work of broadband operators. Before, every visit to Baidu was set up with an iframe. But I never expected that this time, they were so desperate that they even took care of the JSON interface and made such a big, rough and hard modification!

This is like when you just leave the airport and want to take a taxi to the tourist attraction, but you end up getting a black car, which pulls up a big sword for eating and sauna, and you empty your wallet and slap it on the ground!

Since it is confirmed to be a black car, I will just call this silly fish. Let's see the effect first——

Haha, haha, haha... As expected.

I endured the discomfort and flipped through the code, found the domain name, and ran a whois

Get the company name, and search Baidu, Tianyancha, and Qichacha... It's this, it's this

4. The result?

This method is usually impossible to accomplish without the collusion of broadband operators. At present, my home has one X letter and one X mobile line. After repeated testing, only the X mobile line will have this problem. . . Then the matter is very simple

Complain to the Ministry of Industry and Information Technology!

Coordinates: https://dxss.miit.gov.cn/

The storm is over and the sky is clear again, but this - I'm afraid it will never be the last time.

5. What should I do with my website?

It's understandable that you do some hijacking, after all, the soil is like this. But the hijacking bot you wrote is too stupid, it even messes up the JSON format, how can the company run it? You know, many services now don't have web terminals, and the hijacking program should be upgraded.

Once upon a time, our websites were all http, which is the favorite of hijackers. The way to deal with it is to upgrade to https in an all-round way, making it more difficult to hijack, protecting users and yourself.

About the author: Xiaojieweidao (xjjdog), a public account that does not allow programmers to take detours. Focusing on infrastructure and Linux. Ten years of architecture, hundreds of billions of daily traffic, discussing the high-concurrency world with you, giving you a different taste. My personal WeChat is xjjdog0, welcome to add friends for further communication.

<<:  What does the battle for AI spectrum mean for 5G?

>>:  Do you know the ins and outs of threads?

Recommend

The first commercial 5G mobile network in the United States is here! Verizon, a US telecom operator, enters the market

U.S. telecom operator Verizon announced on Wednes...

The growth of 5G data scale will help the semiconductor industry innovate and upgrade

Currently, 5G is entering a period of accelerated...

Say goodbye to manual inspections, automation makes network device management more efficient

In modern network architecture, the health of net...

Survey shows: SD-WAN deployment is growing rapidly, MPLS will not disappear

Recently, Cato Networks released a survey report ...

To cope with the global food crisis, AI, 5G and machine vision join forces to "raise fish"

Today, the global food challenge has become a rea...

Buildings are finding ways to incorporate 5G into IoT networks

The long-awaited 5G technology has finally arrive...

National Bureau of Statistics: The number of 5G terminal connections in my country has exceeded 200 million

At present, my country's 5G development is ac...

The epidemic has accelerated the release of policy dividends, and the Internet of Things has ushered in new opportunities for development

Under the severe constraints of the COVID-19 epid...

With the advent of 5G, the development prospects of communication test instruments are promising

In recent years, China's microwave test and m...

RAKsmart: 35% off VPS hosting/30% off cloud servers, US/Japan/Korea/Hong Kong VPS monthly payment starting from $1.95, CN2/AS9929, etc.

RAKsmart's year-end discount is coming. In ad...

Why is network proxy technology so popular? Forward proxy | Reverse proxy

1. The concept of agency I believe everyone has h...

ShockHosting Japanese data center VPS simple test

On the 11th of this month, ShockHosting sent an e...

Huawei releases Net5.5G full range of solutions to stimulate new growth for operators

[Barcelona, ​​Spain, February 26, 2024] During MW...

[6.18] Hengchuang Technology Flash Sale: Hong Kong cloud server starts from 262 yuan/year, Hong Kong/US independent server starts from 800 yuan/month

Hengchuang Technology is an IDC brand under Hong ...

Failure to modernize data center infrastructure increases costs and risk of downtime

Today's data centers are more dynamic than ev...