网页点击大挑战！-油猴中文网 - Powered by Discuz! Archiver

李恒道 发表于 2021-11-26 12:51:39

网页点击大挑战！

地址：http://110.42.220.200/test.html
该网页使用了isTrusted验证

要求：使用脚本点击按钮，显示两个ok
data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAJAAAADECAYAAABwWahZAAAEeUlEQVR4nO3dPW7iXACGUW8QKYo0W6GIqKJswRVpM4sgos2sIAX1FJQs4X5FgPBj80Fem785R7I0EMig8Oj62k64VYFAdekXwG0TEBEBEREQEQERERARARHpPaD578dSVVV5/D3v+7/iAgREREBEBEREQER+GNBHeamqUm1tL+Wj4ZFtAa3ur6rH8vb3Z6+Cyzs5oO83vnlrC2Xr/j8vB6PjdpwW0PqNP35E2QtIPHflpIA+npvjOfT1rYD+vpVHu627ckJAq3nPgZFjNbo8fz/iO6C35fPFc0+6DWg1wjQEtN6e7bjuyRlHoI/y9uvwLpDbc9450Mbhv4juQw9HYdsj1N5R2HoiXZWXP+Gr5+I6Pg+0P0FuPA8korvxszPRGwGst19vpWmn1Hop48Boxu3wC2VEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARARExCfVExEQEQERERARARGxWg8Rq/UQsVoPEav1ELFaDxGr9RCxWg8Rq/UQsVoPEav1ELFaDxG/UEZEQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBETk6IDm83mp67oMh8Ob3+q6LvO5v4btwtEB1XVdptNpWSwWN79Np9NS13WfP9d/xtEBDYfDi7/xXW7D4bDPn+s/Q0BEBEREQEQERERARM4b0PuoVNWoTH70vOUnoT2My2wxK+OHqlRPk7JY/nvwOhPQBVxnQJvBrKPZfMx2QLP3cRk0Pk5AfbtAQO0LtVRVw0jyPmoMY/K0Cmh136SMmp4voF5d5wj0o4BO2wTUjSsM6Gsk+b+R6uB2RFgC6kZvAc1eBye+8S1htYxAs9fBSXMeAfWj34CO3cUcGplaAmp6zuSpKqN3AZ3TjQc0KOPP7dujd5Poc7r6gJp2hYPXWVl8jstgFdDy6O7Y0UdA3bnCOdDyHM/B80CLsj5sfxg0H/4L6CyufgRq3YUtlofyJ448AurW9V8Lawxo81B/Yx60OP78kIC60VNAszJ++H5jJ0/bu6Hd24dGmd2vrUadzetg38Ecf11MQN3oJaCv+c/+EVLr7UOXIdYBLUed3dHl8+s62NdzJ2W0MyIJqF/dB7R8Q7fnJbsjQ0Mwm1Etv0fr9bG9bWOXduS8S0Dd6DygtjnI7pnjvd3Y4rQTgekmoG5c/yRaQFdNQEQERERARARExN/GE/HpHER8PhARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEREQEQERERARAREREBEBEfkP3ew6bmNMi0YAAAAASUVORK5CYII=

奖励：100油猫币，以及一杯蜜雪冰城(蜜雪冰城请不起了)

警告：该网页不同于往期的油猴脚本开发教程，难度较大，如果基础不太好不推荐挑战

wjlj 发表于 2021-11-26 13:32:39

不明觉厉。

Hangover 发表于 2021-11-26 14:04:09

本帖最后由 Hangover 于 2021-11-26 14:09 编辑

// ==UserScript==
// @name       测试
// @namespace http://tampermonkey.net/
// @version    0.1
// @descriptiontry to take over the world!
// @author    You
// @match    http://110.42.220.200/test.html
// @require    https://cdn.bootcdn.net/ajax/libs/jquery/3.6.0/jquery.min.js
// ==/UserScript==

$(function(){
'use strict';
$('#btn').bind("myClick", function(){
   $('#result').html('ok');
   $('#result2').html('ok');
});
$('#btn').trigger("myClick");
});好像偷渡成功了?

李恒道 发表于 2021-11-26 15:10:39

Hangover 发表于 2021-11-26 14:04
好像偷渡成功了?

算偷渡！没有正式户籍没法颁发奖项！

maxzhang 发表于 2021-11-26 17:43:46

雕虫小技竟然敢班门弄斧

大威天龙~

// ==UserScript==
// @name       艹翻李恒道(王一之)
// @namespace https://bbs.tampermonkey.net.cn/
// @version    0.1.0
// @descriptiontry to take over the world!
// @include    http://110.42.220.200/test.html
// @author    You
// @grant    unsafeWindow
// @run-at    document-start
// ==/UserScript==

var myEvent= function(){
var isTrusted=true;
var target = false;
function myEvent(){
this.isTrusted=true;
this.target=false
}

function PrivateConstructor() {
   this.publicFunc = function() {}
   this.isTrusted=true;
   this.target=false;
}
PrivateConstructor.prototype = PointerEvent.prototype;
myEvent.prototype.target={id:'btn'};
return new PrivateConstructor()

}
var _1addEventListener = EventTarget.prototype.addEventListener;
EventTarget.prototype.addEventListener = function (tip,callback) {
let old = arguments
let args = [...arguments]
let temp = args;
arguments = function (ev) {
   let args2 = [...arguments];
   args2 = Object.assign({}, args2)
   args2.target = ev.target;
   args2.isTrusted = ev.isTrusted;
   if(ev.target.id!='div'){
         args2=new myEvent()
         args2.isTrusted=true
         Object.defineProperties(args2,{target:{value:{id:ev.target.id}}})
         console.log(args2)
         //debugger
   }
   return temp(...args2);
}
_1addEventListener.apply(this, arguments);
}

cxxjackie 发表于 2021-11-26 18:20:49

看了一下是对addEventListener做了手脚，我直接还原addEventListener绕开检测{:4_100:}// ==UserScript==
// @name       网页点击大挑战！
// @description网页点击大挑战！
// @namespace Sency
// @author    Sency
// @version    1.0
// @match    http://110.42.220.200/test.html
// @grant    none
// @run-at    document-start
// ==/UserScript==

(function() {
'use strict';
const oldAddEv = window.EventTarget.prototype.addEventListener;
const oldOnload = window.onload;
window.onload = () => {
   oldOnload();
   window.EventTarget.prototype.addEventListener = oldAddEv; //还原addEventListener
   const btn = document.querySelector('#btn');
   btn.addEventListener('click', e => {
         e.stopImmediatePropagation(); //阻止原有事件监听
         document.querySelector('#result').innerHTML = 'ok';
         document.querySelector('#result2').innerHTML = 'ok';
   }, true);
   btn.click();
};
})();感觉你应该把addEventListener的劫持写到onload外面去，这样还原难度会大一点。

LinHQ 发表于 2021-11-26 23:16:30

>本帖最后由 LinHQ 于 2021-11-27 23:05 编辑

```js
// ==UserScript==
// @name    New script
// @namespace Violentmonkey Scripts
// @match    http://110.42.220.200/*
// @grant    none
// @version 0.0.1
// @author    LinHQ
// @description 2021/11/26 下午7:01:33
// ==/UserScript==

// 直接去掉 alert
window.alert = () => false;
let old = EventTarget.prototype.addEventListener;
EventTarget.prototype.addEventListener = function (...args) {
let hdl = args;
args = function (...iargs) {
   let tp = {};
   for (let p in iargs){
   tp = iargs;
   }
   tp.isTrusted = true;
   //tp.__proto__ = Event.prototype;
   Object.setPrototypeOf(tp, Event.prototype)
   iargs = tp;
   //console.log(iargs instanceof Event)
   //return hdl(...iargs);
   return hdl.apply(this, iargs);
}
//return old(...args);
return old.apply(this, args);
}

setTimeout(()=>document.querySelector("#btn").click(), 3500)
```

本来忘记 `this` 了的，但没想到这样反而不会反复弹窗 😄 。

---

嗯，略微改了下代码。

cxxjackie 发表于 2021-11-27 10:09:02

cxxjackie 发表于 2021-11-26 18:20
看了一下是对addEventListener做了手脚，我直接还原addEventListener绕开检测感觉你应该把addEven ...

想了一下这种做法有点取巧，是以破坏原有事件监听为前提的，实战中对简单事件还好，复杂的事件就不太适用了，改成下面的做法伪造一个事件进去：
// ==UserScript==
// @name       网页点击大挑战！
// @description网页点击大挑战！
// @namespace Sency
// @author    Sency
// @version    2.0
// @match    http://110.42.220.200/test.html
// @grant    none
// @run-at    document-start
// ==/UserScript==

(function() {
'use strict';
const oldAddEv = window.EventTarget.prototype.addEventListener;
const oldOnload = window.onload;
window.onload = () => {
   const btn = document.querySelector('#btn');
   window.EventTarget.prototype.addEventListener = function(...args) {
         const callback = args;
         args = function(e) {
            if (e.target === btn && e.type === 'click') {
               //用Proxy代理的对象可以通过instanceof Event检测
               const eProxy = new Proxy(e, {
                     get: function(target, property) {
                        if (property === 'isTrusted') {
                           return true;
                        } else {
                           return Reflect.get(target, property);
                        }
                     }
               });
               return callback.call(this, eProxy);
            } else {
               return callback.call(this, e);
            }
         }
         return oldAddEv.apply(this, args);
   };
   oldOnload();
   btn.click();
};
})();

Hollow 发表于 2021-11-27 12:23:31

ok，搞定了，嘻嘻，好了嗷

李恒道 发表于 2021-11-27 19:02:02

结贴

页: [1] 2

油猴中文网's Archiver

网页点击大挑战！