您现在的位置是：首页 >其他 >油猴Tampermonkey脚本hook案例网站首页其他

油猴脚本编写介绍

• 注释内容解释
• @match这个注释的内容最为重要，它决定了你的脚本应用到哪个具体的网页，还是应用到所有的网页
• @run-at确定了脚本的注入时机，在js逆向中也很重要
• 油猴脚本所有注释介绍

hook的脚本合集

1. hook之window属性案例

// ==UserScript==
// @name         定位pre加密参数
// @namespace    http://tampermonkey.net/
// @version      0.1
// @description  try to take over the world!
// @author       十三
// @run-at       document-start
// @match        https://flight.qunar.com/*
// @grant        none
// ==/UserScript==

(function() {
    'use strict';
    var pre = "";
    Object.defineProperty(window, '_pt_', {
        get: function() {
            console.log('Getting window.属性');
            return pre
        },
        set: function(val) {
            console.log('Setting window.属性', val);
            debugger ;
            pre = val;
        }
    })
})();

2. hook所有cookie，注意修改@match 所匹配的网址，否则可能hook不到

// ==UserScript==
// @name         定位cookie
// @namespace    http://tampermonkey.net/
// @version      0.1
// @description  try to take over the world!
// @author       十三
// @match        http://entp.yjj.gxzf.gov.cn/appnet/appEntpList.action?entpType=004
// @run-at       document-start
// @grant        none
// ==/UserScript==

(function() {
   'use strict';
    var _cookie = ""; // hook cookie
    Object.defineProperty(document, 'cookie', {
        set: function(val) {
            console.log('cookie set->', new Date().getTime(), val);
            debugger;
            _cookie = val;
            return val;
        },
        get: function() {
            return _cookie;
        }
   });
})()

3. hook之split

String.prototype.split_bk = String.prototype.split;
String.prototype.split = function(val){
    str =  this.toString();
    debugger;
    return str.split_bk(val)
}
a = 'dsdfasdf sdsasd'
a.split(' ')

4. hook之Header

(function () {
    var org = window.XMLHttpRequest.prototype.setRequestHeader;
    window.XMLHttpRequest.prototype.setRequestHeader = function (key, value) {
        if (key == 'Authorization') {
            debugger;
        }
        return org.apply(this, arguments);
    };
})();

5. hook之URL

(function () {
    var open = window.XMLHttpRequest.prototype.open;
    window.XMLHttpRequest.prototype.open = function (method, url, async) {
        if (url.indexOf("login") != -1) {
            debugger;
        }
        return open.apply(this, arguments);
    };
})();

6. hook之JSON.stringify

(function() {
    var stringify = JSON.stringify;
    JSON.stringify = function(params) {
        console.log("Hook JSON.stringify ——> ", params);
        debugger;
        return stringify(params);
    }
})();

7. JSON.parse

(function() {
    var parse = JSON.parse;
    JSON.parse = function(params) {
        console.log("Hook JSON.parse ——> ", params);
        debugger;
        return parse(params);
    }
})();

8. hook canvas (定位图片生成的地方)

(function() {
    'use strict';
    let create_element = document.createElement.bind(doument);

    document.createElement = function (_element) {
        console.log("create_element:",_element);
        if (_element === "canvas") {
            debugger;
        }
        return create_element(_element);
    }
})();

9. setInterval 定时器

(function() {
    setInterval_ = setInterval;
    console.log("原函数已被重命名为setInterval_")
    setInterval = function() {}
    ;
    setInterval.toString = function() {
        console.log("有函数正在检测setInterval是否被hook");
        return setInterval_.toString();
    }
    ;
}
)();

10. hook 正则

(function () {
    var _RegExp = RegExp;
    RegExp = function (pattern, modifiers) {
        console.log("Some codes are setting regexp");
        debugger;
        if (modifiers) {
            return _RegExp(pattern, modifiers);
        } else {
            return _RegExp(pattern);
        }
    };
    RegExp.toString = function () {
        return "function setInterval() { [native code] }"
    };
})();

11. 过debugger—1 constructor 构造器构造出来的

var _constructor = constructor;
Function.prototype.constructor = function(s) {
    if (s == "debugger") {
        console.log(s);
        return null;
    }
    return _constructor(s);
}

12. 过debugger—2 eval的

(function() {
    'use strict';
    var eval_ = window.eval;
    window.eval = function(x) {
        eval_(x.replace("debugger;", "  ; "));
    }
    ;
    window.eval.toString = eval_.toString;
}
)();