📜 ⬆️ ⬇️

Substitution of the parent page on the example of ask.fm

Good day!


Just a year ago, I discovered an interesting feature in window.opener. I have already written other hacking methods via a tag, but I will show my method using a specific example. The method is to substitute the address of the parent tab. Do not open the address, which can be corrected by moving back in history, namely, the substitution.
Well, enough empty chatter, let's get down to business.
To complete the task I need:

Let's start ...

To start, we register hosting and account on ask.fm. I chose the domain askfn.esy.es and the account name ask.fm/forhabrahabr
Follow the links in the askfm goes only in the answer field, so ask any question and answer it with a link. The funny thing is that when I registered a test account and answered, I immediately received two likes. It seems that people do not care at all what “like”, just to attract attention to themselves ...
Let's continue ...
For the test itself, I wrote a simple fake ask page. fm and uploaded it to the askfm directory. and on the main one I put the actual script of the redirect and substitution of the parent tab.
His code
<html> <head> <title></title> </head> <body> <script language="JavaScript"> if(parent.window.opener) parent.window.opener.location.replace("http://askfn.esy.es/askfm"); // ,    (). document.location.href = "http://habrahabr.ru/"; //,       </script> </body> </html> 



IMPORTANT!!! The script uses replace () in order to prevent the user from pushing the button back in the browser in the event of a fright, to switch back to ask.fm. Thus, the history of visits is allegedly cleared.
IMPORTANT2 !!! Replacing the parent tab only works when the link is directly opened ... That is, opening in a new tab and “pushing on the wheel” will not change the parent tab

So, our link looks like this
image
And after clicking on the link
image
')
Actually, here is the "link to the link":
Ask.fm

Source: https://habr.com/ru/post/228341/


All Articles