JS Hook

什么是Hook？

Hook中文译为钩子，在程序中可理解为“劫持”。通过Hook技术能劫持对象，替换代码片段、修改参数或返回值，控制其与其他对象的交互。

Hook相关操作

Hook Cookie

方法一：

(function () {
    let cookieCache = "";
    Object.defineProperty(document, "cookie", {
        set: function (val) {
            console.log("Hook set cookie => ", val);
            if (val.indexOf("baidu.com")!== -1) {
                debugger;
            }
            cookieCache = val;
            return val;
        },
        get: function () {
            return cookieCache;
        }
    });
})();

方法二（不推荐）：

(function () {
    let cookieCache = document.cookie.__lookupSetter__("cookie");
    document.__defineSetter__("cookie", function (val) {
        console.log("Hook set cookie => ", val);
        if (val.indexOf("baidu.com")!== -1) {
            debugger;
        }
        cookieCache = val;
    });
    document.__defineGetter__("cookie", function () {
        return cookieCache;
    });
})();

Hook Request Header

(function () {
    let headerCache = window.XMLHttpRequest.prototype.setRequestHeader;
    window.XMLHttpRequest.prototype.setRequestHeader = function (key, value) {
        console.log("Hook set header %s => %s", key, value);
        if (key === "baidu.com") {
            debugger;
        }
        return headerCache.apply(this, arguments);
    };
})();

Hook 无限Debugger

Firefox、Firefox Developer Edition浏览器从121版本开始，取消“Pause on debugger statement”勾选可绕过无限debugger。

常见绕过方法：

构造函数：

(function () {
    let constructorCache = Function.prototype.constructor;
    Function.prototype.constructor = function (string) {
        if (string === "debugger") {
            console.log("Hook constructor debugger!");
            return function () {};
        }
        return constructorCache(string);
    };
})();

Hook XHR

(function () {
    let openCache = window.XMLHttpRequest.prototype.open;
    window.XMLHttpRequest.prototype.open = function (method, url) {
        console.log("Hook xhr method => %s, url => %s", method, url);
        if (url.indexOf("baidu.com")!== -1) {
            debugger;
        }
        return openCache.apply(this, arguments);
    };
})();

Hook fetch

(function () {
    let fetchCache = Object.getOwnPropertyDescriptor(window, "fetch");
    Object.defineProperty(window, "fetch", {
        value: function (url) {
            console.log("Hook fetch url => ", url);
            debugger;
            return fetchCache.value.apply(this, arguments);
        }
    });
})();

Hook JSON.stringify

(function () {
    let stringifyCache = JSON.stringify;
    JSON.stringify = function (params) {
        console.log("Hook JSON.stringify => ", params);
        debugger;
        return stringifyCache(params);
    };
})();

Hook JSON.parse

(function () {
    let parseCache = JSON.parse;
    JSON.parse = function (params) {
        console.log("Hook JSON.parse => ", params);
        debugger;
        return parseCache(params);
    };
})();

Hook Function

(function () {
    let FunctionCache = window.Function;
    let newFunction = function () {
        let src = arguments[arguments.length - 1];
        console.log("Hook Function => ", src);
        debugger;
        return FunctionCache.apply(this, arguments);
    };
    newFunction.toString = function () {
        return FunctionCache.toString();
    };
})();

Hook WebSocket

(function () {
    let sendCache = WebSocket.prototype.send;
    WebSocket.prototype.send = function (data) {
        console.info("Hook WebSocket send => ", data);
        return sendCache(data);
    };
})();

Hook String.prototype.split

(function () {
    String.prototype.splitCache = String.prototype.split;
    String.prototype.split = function (separator, limit) {
        console.log("Hook String.prototype.split separator => %s, limit => %s", separator, limit);
        let str = this.toString();
        if(str.includes("baidu.com")) {
            debugger;
        }
        return str.splitCache(separator, limit)
    };
})();

Hook console

(function () {
    let consoleCache = console.log;
    console.log = function (msg) {
        consoleCache("Hook console.log =>", msg);
        if(msg === "baidu.com") {
            debugger;
        }
        consoleCache(msg);
    };
})();

Hook eval

(function () {
    let evalCache = window.eval;
    window.eval = function (string) {
        console.log("Hook eval =>", string);
        debugger;
        return evalCache(string);
    };
    window.eval.toString = function () {
        return evalCache.toString();
    };
})();

Hook onbeforeunload

(function () {
    window.onbeforeunload = function () {
        console.log("Hook window.onbeforeunload.");
        debugger;
        return false;
    };
})();

Hook RegExp

(function () {
    let RegExpCache = RegExp;
    RegExp = function (pattern, flags) {
        console.log("Hook RegExp pattern => %s, flags => %s", pattern, flags);
        debugger;
        return RegExpCache(pattern, flags);
    };
})();

Hook Canvas

(function () {
    let createElementCache = document.createElement;
    document.createElement = function (tagName) {
        console.info("Hook createElement tagName => ", tagName);
        if(tagName === "canvas") {
            debugger;
        }
        return createElementCache(tagName);
    };
})();

Hook createElement

(function () {
    let createElementCache = document.createElement;
    document.createElement = function (tagName) {
        console.info("Hook createElement tagName => ", tagName);
        if(tagName === "div") {
            debugger;
        }
        return createElementCache(tagName);
    };
})();

Hook getElementById

(function () {
    let getElementByIdCache = document.getElementById;
    document.getElementById = function (id) {
        console.info("Hook getElementById id => ", id);
        if (id === "spiderapi") {
            debugger;
        }
        return getElementByIdCache(id);
    };
})();

Hook setAttribute

(function () {
    let setAttributeCache = window.Element.prototype.setAttribute;
    window.Element.prototype.setAttribute = function (name, value) {
        console.info("Hook setAttribute name => %s, value => %s", name, value);
        if (name === "spiderapi") {
            debugger;
        }
        return setAttributeCache(name, value);
    };
})();

Hook setInterval

(function () {
    let setIntervalCache = setInterval;
    setInterval = function (func, delay) {
        console.log("Hook setInterval func => %s, delay => %s", func, delay);
        debugger;
        return setIntervalCache(func, delay);
    };
})();

Hook setTimeout

(function () {
    let setTimeoutCache = setTimeout;
    setTimeout = function (func, delay) {
        console.log("Hook setTimeout func => %s, delay => %s", func, delay);
        debugger;
        return setTimeoutCache(func, delay);
    };
})();

清除定时器

for (let i = 1; i < 99999; i++) window.clearInterval(i);

Hook 固定随机变量

(function () {
    Date.now = function now() { return 1661986251253 };
    Date.parse = function () { return 1661986251253 };
    Date.prototype.valueOf = function () { return 1661986251253 };
    Date.prototype.getTime = function () { return 1661986251253 };
    Date.prototype.toString = function () { return 1661986251253 };
    Performance.prototype.now = function now(){ return Number('1661986251253'.slice(8))}

    Math.random = function random() { return 0.08636862211354912 };
    window.crypto.getRandomValues = function getRandomValues(array32, ...args){
        return array32;
    }
})();

Hook 固定浏览器高度和宽度值

let height = 660; // 固定的高度值
let width = 1366; // 固定的宽度值

let innerHeight_property_accessor = Object.getOwnPropertyDescriptor(window, "innerHeight"); // 获取innerHeight属性访问器描述符
let innerHeight_set_accessor = innerHeight_property_accessor.set; // 获取setter

Object.defineProperty(window, "innerHeight", {
    get: function () {
        return height;
    },
    set: function () {
        innerHeight_set_accessor.call(window, height);
    }
});

let innerWidth_property_accessor = Object.getOwnPropertyDescriptor(window, "innerWidth"); // 获取innerWidth属性访问器描述符
let innerWidth_set_accessor = innerWidth_property_accessor.set; // 获取setter

Object.defineProperty(window, "innerWidth", {
    get: function () {
        return width;
    },
    set: function () {
        innerWidth_set_accessor.call(window, width);
    }
});

Hook 通用模板

(function () {
    let oldFunc = func;
    func = function (arguments) {
        console.log(arguments);
        return oldFunc.apply(arguments);
    };
})();