• XSS.stack #1 – первый литературный журнал от юзеров форума

из чего состоит google?

Отслеживать
ammok

ammok

(L1) cache
Пользователь
Регистрация
13.12.2005
Сообщения
793
Реакции
7
Открыл html страницу google и увидел следущее:
Код: 
<script type="text/javascript">(function(){try{var e=true;var i=window.gbar=window.gbar||{};function _tvn(a,b){var c=parseInt(a,10);return isNaN(c)?b:c}function _tvf(a,b){var c=parseFloat(a);return isNaN(c)?b:c}function _tvv(a){return!!a}function m(a,b,c){(c||i)[a]=b}i.bv={n:_tvn("2",0),r:"",f:".41.",m:_tvn("1",1)};var n=function(a){return function(){return i.bv.m==a}},aa=n(1),ba=n(2);m("sb",aa);m("kn",ba);var o=function(){},p=function(){},t=function(a){var b=new Image,c=q;b.onerror=b.onload=b.onabort=function(){try{delete s[c]}catch(d){}};s[c]=b;b.src=a;q=c+1},s=[],q=0;m("logger",{il:p,ml:o});var u=window.gbar.logger;var v={},ea={},w=[],ha=function(a,b){w.push([a,b])},ia=function(a,b){v[a]=b},ja=function(a){return a in v},x={},y=function(a,b){x[a]||(x[a]=[]);x[a].push(b)},z=function(a){y("m",a)},A=function(a){var b=document.createElement("script");b.src=a;(document.getElementById("xjsc")||document.body).appendChild(b)},C=function(a){for(var b=0,c;c=w[b];++b)if(c[0]==a)break;if(c&&!c[1].l&&!c[1].s){c[1].s=e;B(2,a);A(c[1].url)}},D=function(a){y("gc",a)},E=null,ka=function(a){E=a},B=function(a,b,c){if(E){a={t:a,
b:b};if(c)for(var d in c)a[d]=c[d];try{E(a)}catch(g){}}};m("mdc",v);m("mdi",ea);m("bnc",w);m("qGC",D);m("qm",z);m("qd",x);m("lb",C);m("mcf",ia);m("bcf",ha);m("aq",y);m("mdd","");m("has",ja);m("trh",ka);m("tev",B);var F=_tvf("0.01",1.0E-4),G=0;
function _mlToken(a,b){try{if(G<1){G++;var c,d=a,g=b||{},f=encodeURIComponent,h=["//www.google.com/gen_204?atyp=i&zx=",(new Date).getTime(),"&jexpid=",f("30315"),"&srcpg=",f("prop=5"),"&jsr=",Math.round(1/F),"&ogf=",i.bv.f,"&ogv=",f("1325726793.1325613523"),"&ogd=",f("ru"),"&ogl=",f("ru")];if(g._sn)g._sn="og."+g._sn;for(var l in g){h.push("&");h.push(f(l));h.push("=");h.push(f(g[l]))}h.push("&emsg=");h.push(f(d.name+
":"+d.message));var j=h.join("");if(H(j))j=j.substr(0,2E3);c=j;var k=window.gbar.logger._aem(a,c);t(k)}}catch(r){}}var H=function(a){return a.length>=2E3},la=function(a,b){return b};function I(a){o=a;m("_itl",H,u);m("_aem",la,u);m("ml",o,u);a={};v.er=a}if(_tvv(""))I(function(a){throw a;});else _tvv("1")&&Math.random()<F&&I(_mlToken);var _E="left",M=function(a,b){var c=a.className;L(a,b)||(a.className+=(c!=""?" ":"")+b)},N=function(a,b){var c=a.className,d=RegExp("\\s?\\b"+b+"\\b");if(c&&c.match(d))a.className=c.replace(d,"")},L=function(a,b){var c=RegExp("\\b"+b+"\\b"),d=a.className;return!!(d&&d.match(c))};m("ca",M);m("cr",N);m("cc",L);var ma=["gb_71","gb_155"],O;function na(a){O=a}function oa(a){var b=O&&!a.href.match(/.*\/accounts\/ClearSID[?]/)&&encodeURIComponent(O());if(b)a.href=a.href.replace(/([?&]continue=)[^&]*/,"$1"+b)}function pa(a){try{var b=(document.forms[0].q||"").value;if(b)a.href=a.href.replace(/([?&])q=[^&]*|$/,function(d,g){return(g||"&")+"q="+encodeURIComponent(b)})}catch(c){o(c)}}
var P=function(){for(var a=[],b=0,c;c=ma[b];++b)(c=document.getElementById(c))&&a.push(c);return a},qa=function(){var a=P();return a.length>0?a[0]:null},ra=function(){return document.getElementById("gb_70")},Q={},R={},S={},T=undefined,va=function(a,b){try{var c=document.getElementById("gb");M(c,"gbpdjs");U();V(document.body)&&M(c,"gbrtl");if(b&&b.getAttribute){var d=b.getAttribute("aria-owns");if(d.length){var g=document.getElementById(d);if(g){var f=b.parentNode;if(T==d){T=undefined;N(f,"gbto")}else{if(T){var h=
document.getElementById(T);if(h&&h.getAttribute){var l=h.getAttribute("aria-owner");if(l.length){var j=document.getElementById(l);j&&j.parentNode&&N(j.parentNode,"gbto")}}}sa(g)&&ta(g);T=d;M(f,"gbto")}}}}z(function(){i.tg(a,b,e)});ua(a)}catch(k){o(k)}},wa=function(a){z(function(){i.close(a)})},V=function(a){var b,c="direction",d=document.defaultView;if(d&&d.getComputedStyle){if(a=d.getComputedStyle(a,""))b=a[c]}else b=a.currentStyle?a.currentStyle[c]:a.style[c];return b=="rtl"},ya=function(a,b,c){if(a)try{var d=
document.getElementById("gbd5");if(d){var g=d.firstChild,f=g.firstChild,h=document.createElement("li");h.className=b+" gbmtc";h.id=c;a.className="gbmt";h.appendChild(a);if(f.hasChildNodes()){c=[["gbkc"],["gbf","gbe","gbn"],["gbkp"],["gbnd"]];d=0;var l=f.childNodes.length;g=false;for(var j=-1,k=0,r;r=c[k];k++){for(var ca=0,J;J=r[ca];ca++){for(;d<l&&L(f.childNodes[d],J);)d++;if(J==b){f.insertBefore(h,f.childNodes[d]||null);g=e;break}}if(g){if(d+1<f.childNodes.length){var da=f.childNodes[d+1];if(!L(da.firstChild,
"gbmh")&&!xa(da,r))j=d+1}else if(d-1>=0){var fa=f.childNodes[d-1];if(!L(fa.firstChild,"gbmh")&&!xa(fa,r))j=d}break}d>0&&d+1<l&&d++}if(j>=0){var K=document.createElement("li"),ga=document.createElement("div");K.className="gbmtc";ga.className="gbmt gbmh";K.appendChild(ga);f.insertBefore(K,f.childNodes[j])}i.addHover&&i.addHover(a)}else f.appendChild(h)}}catch(Ea){o(Ea)}},xa=function(a,b){for(var c=b.length,d=0;d<c;d++)if(L(a,b[d]))return e;return false},za=function(a,b,c){ya(a,b,c)},Aa=function(a,b){ya(a,
"gbe",b)},Ba=function(){z(function(){i.pcm&&i.pcm()})},Ca=function(a,b,c,d,g,f,h,l){z(function(){i.paa&&i.paa(a,b,c,d,g,f,h,l)})},Da=function(a,b){Q[a]||(Q[a]=[]);Q[a].push(b)},Fa=function(a,b){R[a]||(R[a]=[]);R[a].push(b)},Ga=function(a,b){S[a]||(S[a]=[]);S[a].push(b)},ua=function(a){a.preventDefault&&a.preventDefault();a.returnValue=false;a.cancelBubble=e},W=null,ta=function(a,b){U();if(a){X(a,"Открывается&hellip;");Y(a,e);var c=typeof b!="undefined"?b:1E4,d=function(){Ha(a)};W=window.setTimeout(d,
c)}},Ia=function(a){U();if(a){Y(a,false);X(a,"")}},Ha=function(a){try{U();var b=a||document.getElementById(T);if(b){X(b,"Служба временно недоступна.%1$sПовторите попытку позже.","%1$s");Y(b,e)}}catch(c){o(c)}},X=function(a,b,c){if(a&&b){var d=sa(a);if(d){if(c){d.innerHTML="";b=b.split(c);c=0;for(var g;g=b[c];c++){var f=document.createElement("div");f.innerHTML=g;d.appendChild(f)}}else d.innerHTML=b;Y(a,e)}}},Y=function(a,b){var c=b!==undefined?b:e;c?M(a,"gbmsgo"):N(a,"gbmsgo")},sa=function(a){for(var b=0,c;c=a.childNodes[b];b++)if(L(c,
"gbmsg"))return c},U=function(){W&&window.clearTimeout(W)};m("so",qa);m("sos",P);m("si",ra);m("tg",va);m("close",wa);m("addLink",za);m("addExtraLink",Aa);m("pcm",Ba);m("paa",Ca);m("ddld",ta);m("ddrd",Ia);m("dderr",Ha);m("rtl",V);m("bh",Q);m("abh",Da);m("dh",R);m("adh",Fa);m("ch",S);m("ach",Ga);m("qs",pa);m("setContinueCb",na);m("pc",oa);var Ja={};v.base=Ja;w.push(["m",{url:"//ssl.gstatic.com/gb/js/sem_feb9dd66302c9c88a09635e9b89f0275.js"}]);if(_tvv("1")){var Ka=_tvv("");w.push(["gc",{auto:Ka,url:"//ssl.gstatic.com/gb/js/abc/gcm_e9b1c8ddbdbba9ea5c035548a0320af1.js"}]);var La={version:"gcm_e9b1c8ddbdbba9ea5c035548a0320af1.js",index:"",lang:"ru"};v.gc=La;var Z=function(a){if(window.googleapis)a&&a();else{a&&D(a);C("gc")}};m("lGC",Z);_tvv("1")&&m("lPWF",Z)};window.__PVT="";if(_tvv("1")&&_tvv("1")){var $=function(a){Z(function(){y("pw",a);C("pw")})};m("lPW",$);w.push(["pw",{url:"//ssl.gstatic.com/gb/js/abc/pwm_4e7edac1f189ab82bc4091ff7bfe6f4b.js"}]);var Ma=[],Na=function(a){Ma[0]=a},Oa=function(a,b){var c=b||{};c._sn="pw";o(a,c)},Pa={signed:Ma,elog:Oa,base:"https://plusone.google.com/u/0",loadTime:(new Date).getTime()};v.pw=Pa;var Qa=function(a,b){for(var c=b.split("."),d=function(){var l=arguments;a(function(){for(var j=i,k=0,r=c.length-1;k<r;++k)j=j[c[k]];j[c[k]].apply(j,l)})},g=i,f=0,h=c.length-
1;f<h;++f)g=g[c[f]]=g[c[f]]||{};return g[c[f]]=d};Qa($,"pw.clk");Qa($,"pw.hvr");m("su",Na,i.pw)};var Ra=_tvf("0.01",1.0E-4);
function Sa(a,b){var c=encodeURIComponent,d=["//www.google.com/gen_204?atyp=i&zx=",(new Date).getTime(),"&oge=",a,"&ogex=",c("30315"),"&ogf=",i.bv.f,"&ogp=",c("5"),"&ogsr=",Math.round(1/Ra),"&ogv=",c("1325726793.1325613523"),"&ogd=",c("ru"),"&ogl=",c("ru")];if(b){if("ogw"in b){d.push("&ogw="+b.ogw);delete b.ogw}var g;g=b;var f=[],h;for(h in g){f.length!=0&&f.push(",");f.push(h);f.push(".");f.push(g[h])}g=f.join("");
if(g!=""){d.push("&ogad=");d.push(c(g))}}t(d.join(""))}if(_tvv("1")&&Math.random()<Ra){p=Sa;m("il",p,u);var Ta={};v.il=Ta};var Ua=function(){i.prm&&i.prm()},Va=function(a){y("m",function(){i.spn(a)})},Wa=function(a){y("m",function(){i.spp(a)})},Xa=function(){y("m",function(){i.spd()})};m("spn",Va);m("spp",Wa);m("spd",Xa);Da("gbd4",Ua);if(_tvv("")){var Ya={g:_tvv(""),d:_tvv(""),e:"",m:"",p:"//ssl.gstatic.com/gb/images/avatar_b96.png",xp:_tvv("1"),mg:"%1$s (делегированный)",md:"%1$s (по умолчанию)"};v.prf=Ya};function Za(){function a(){for(var k;k=f[h++];)if(k[0]=="m"||k[1].auto)break;if(k){B(2,k[0]);A(k[1].url)}h<f.length&&setTimeout(a,0)}function b(){g-- >0?setTimeout(b,0):a()}var c=_tvv("1"),d=_tvv(""),g=3,f=w,h=0,l=window.gbarOnReady;if(l)try{l()}catch(j){o(j)}if(d)m("ldb",a);else if(c)window.addEventListener?window.addEventListener("load",b,false):window.attachEvent("onload",b);else b()}m("rdl",Za);}catch(e){window.gbar&&gbar.logger&&gbar.logger.ml(e);}})();
(function(){try{window.gbar.rdl();}catch(e){window.gbar&&gbar.logger&&gbar.logger.ml(e);}})();

</script>

я не разбирался, но мне это напомнило закриптованные фреймы...

p.s. большой брат следит...
 
Beaten_Sect0r
это опнятно, но ряд вызова функций может в корне изменить работу скрипта...
например setTimeout , RegExp , ну и само собой манипуляции с document могут вызвать скрытый функционал который может быть зашифрован как в самом коде, так и в сторонних скриптах

удивлен что не увидил вызов eval :)

p.s. +1 к паранои при виде не комментированного и обсуфицированного кода
 
admin


Напишите ответ...
  • Вставить:
Прикрепить файлы
Верх