鬼仔's Blog

作者：tombkeeper
来源：tombkeeper的和谐Blog

很多情况下，网站提供的下载链接并不是直接指向最终目标的，还有些下载点击是一个按钮。这时候就不方便直接获得最终的URL。

我以前主要用的方法是：查看页面源码；实际下载结合抓包；在Firefox中实际点击下载然后查看下载属性；等等。这都不是什么技术难题，就是操作比较费事。

刚才忽然想到，也许可以借助Firefox的FlashGot插件来解决这个问题。尝试了一下，果然可以。

在FalshGot的配置界面中新增一个下载管理器，命名为GetURL，可执行文件指向cmd.exe，参数设置为“/c echo [URL] | clip”。

这样，选择用FlashGot下载时，echo和clip就会把URL拷贝到剪贴板中，非常方便。不过事情还没完。

在测试成功这个方法后，我感到了一丝小小的得意，觉得自己想的这个办法真不错。没高兴几秒钟，忽然一股莫名的寒意涌上后背。我循着这股寒气创建了一个HTML文件：

<a href="http://xxxx&calc.exe">test</a>

然后再用FlashGot一试，果然计算器弹出来了。这玩意风险太大，不能用。 这也提醒了我，虽说人生得意须尽欢，但更重要的是得意不可忘形，小心使得万年船。

也不知道写clip命令的那个人怎么想的，居然只支持从管道接收数据。没办法，又只好自己动手，搞一个把命令行参数写入剪贴板的小代码。然后在FlashGot里把下载工具设置为这个程序。

在这个牛鬼蛇神出没的世界，想要点安全感真不容易。

arg2clip.c：

#include<Windows.h>

int WINAPI WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow)
{
if(OpenClipboard(NULL))
{
HGLOBAL clipbuffer;
char * buffer;
EmptyClipboard();
clipbuffer = GlobalAlloc(GMEM_DDESHARE, lstrlen(lpCmdLine)+1);
buffer = (char*)GlobalLock(clipbuffer);
strcpy(buffer, lpCmdLine);
GlobalUnlock(clipbuffer);
SetClipboardData(CF_TEXT,clipbuffer);
CloseClipboard();
return 0;
}
else
{
return -1;
}
}


arg2clip.exe：
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4g
RE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDADVagEcAAAAAAAAAAOAADwELAQIyACAAAAAQ
AAAAUAAAMG8AAABgAAAAgAAAAABAAAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAACQAAAAEAAA
AAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAACAAADgAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFVQ
WDAAAAAAAFAAAAAQAAAAAAAAAAIAAAAAAAAAAAAAAAAAAIAAAOBVUFgxAAAAAAAgAAAAYAAA
ABIAAAACAAAAAAAAAAAAAAAAAABAAADgVVBYMgAAAAAAEAAAAIAAAAACAAAAFAAAAAAAAAAA
AAAAAAAAQAAAwDMuMDEAVVBYIQ0JAgg68Fmo7q1nL5xDAAAYDwAAACQAACYAAOWb7f//VYnl
g+wEU2oA/xVAQUAAhcB0VwlEi0Vd95fLEFDIQEBQaAAgACDMDIn/tz/bw1MI0EX8i00CVRBR
KdGKAogEEdk20/1ChMB19lgd1FABRkj//zebBUwxwOsDg8j/W4nsXcIQAI2/AAAAvW27IH9q
/18wI2ioEd/Ozb0EZP81FAaJJZlQU1ZXrv3u7Yll6AoBDgIFC4xZo9RDJgra0rXbA5yrdQhm
FQTHjX423/cwDJwE/AkszL4U2Pb771zrBf8Wg8YEgf4McvMu0II39pnuRaTj2P/c1aA5cHf5
fwqM9kXQAXQGD7d11L4KKlZQajzYwt8SoFDoy/7//wS/VBeDx3b7d7L/UznMWesoJ+yLLP53
67pL5AlQA+RQuhyDxAjDi/CFb9bLD7SDP/9fXlthG862RvDvDR7DkABoGOF/VkMyMFhDMDCn
CA1V2Ha/XXNdDEMI90AEBjJ1e2b4l+3NYKuOzfiJQx1zewi3//+3g6V0cY0MdoN8jwQAdEVW
VY1rEP9UC11e7educD3kM3g8JbECfJcF58a6BB1WDMykNlau2/7wi0SPCGV1iwSPVQw7CDAV
3u93Gos0j+uhuK3rFVW9wnPdkzhduAEWXdLI37Lbbw+LTCQ5KYtBHFADGFAqhu/wbcKWkI18
J//UaoFu2K/jaJgSL3V2FwxFPnbtWOwE90HqXXQPmVBUJGDv5t7xArgDEGe8J2gGMn7DuUwg
umr+aKAST//hdjcZIItYPXAMHy47dCQkdGXh7u0ojTTTDLOJpolIDC+za5MF93USaAFrArP8
CBXcMX7rw2SPBZPEDJqm3yPsmG/ZZIu7gXkEcHUJsX/hEItRgFIMOVEIdQWxCILteLKfUbus
wOsKCA7/thX8dksCQwSJawxZWxWNUsPCABYAMZ/2n26WAeSjiEakD5XQg+ABWXubjvd/AKEQ
xOjHBQwAYe03+8OJ/2/yBFA9JtkISc3sw3+kDMFhBqwIJfCJn4WRDNk/9G871oB0IQz4JD3/
AAvM8L91BDH26wKJ3onwMI9sDRvY/EDObzQAQzZ3zA9ojCgPBOOsI0gH61AVi/723V+TEw0n
ix2QBSnIGdqJFXKbxsyJG1K6aBB92BDOeIWcm3+PT+2xBcdkNWYBIRHcWb7Lhx9YWokdnEZb
nEcg7W2FH/YRxq0PA+EJ2fr3/QUKg8MIoSEFQDnDcuFVqJrN/Qdmg33aAA+E+TUJ3O9rd18f
AUXcG/AHg8AECKXt7dum8AHCsPg9AAggfgfHEd4j+34IvgFuTZkKoYqATb7vQes9iRy1nIOZ
dQ9sKb21m99GbDkd4eGPLXyoMf/rXSEArHREX9tI34QPthL3wmY2BwheC7/wGXTKCBgjifil
H4n6wfp9O/b3BYsUlVaNHMJAiQMG/IoAiG1/7Lt9R//P+Nj4O33wfJ5lobFzf58q+IE7Zw+F
qleogYXHb+62IAnppPYUuYP/AQ+UBXcEbu4F9A88pIubDEHp62bb2fShbhP0jhPskcKzka1d
DBCcCGoCtG57hdtqalWg8ioDnL3nnIGTFAa9SRetLfv/8Owl/5T4AnUGgEsEQOsdEm5syS3v
EBLwChgEBboI7tuAR50DD4w0g3pUGPDImmWhfzHbZQe7s3OdcxJQnRWcWNb/ZhEAQ4P7QHzd
P+9bW8d/DFO0TThVGMcCE2Hjs2wIFAFdCDcMjP9/eWELUgyNUFUMiQiAOyJ1NusQhcl07b/d
/geJyEGKE4g3RRi5Q4nYgDgidAUePdd0C7PjHAbGQRsN28j+MjtD6zgzMkO0Rbf/9tv3igI8
IHQIhLAEPAl12YB990MDS/cW2t3rCC8ExkEnpPiWWnC3bnt0DesBMwMt+Sl09RFvS5nZ08Cl
ChQ3r213vPzFZwJDRytcNIm2L9vvRvfHFXUrNPgSgHsBnQNgdpBYEMLrBwjsHY5nWSAUSdHv
6w/UrjU9m1y8+E8L6oy2258rvQ4pF5bAAuscWvzC7UooI+lVCFgcJhn7QhMnvw/HXFljEarD
Xy+B+9l4La8B+HwcxoA+e3O5uHsaaAQTjYX0HW4a2+tsZSAOtaoD/KlpYnMVAVZwBxQvyWT9
guX4jQSCUHLbhjY3bDIlIoMDwu0+YDZIo7xDdR3ABTIH1kBozwjE/hpZGiT4y6GMRAtv6Dsm
Wlf46xmJ2pFAgDwCWPiFb735jXABmj10AwF1sfPtPqz7QuJpQJvHo8hsgz0B5Fv2BQClRSqz
F0btFIn5FRUB91aT6zL20cYHAIs7dAooSgahYUkoZlNVww03MD4qFtVAKIzIG5cMCUOIIHf6
sncxYXsgdvUmWwaUodBF90LvDXpQAYkVCJuFkES82IL7vwxQcuLrEqHUCUXUHCwG2xsMYeV8
3N1lwOLDT1y+2CHr5hcb+kQ5HnU9G0YEyBYM3HiFChz+AHmF/wZW2NUqx3QV6CKXjhr+C//X
WSfrgwgoRiRO1zW0bBT+LB9Fshgs6H/fNbTwzglEGAkMCxgx0vfxzX33Ch49B9rrQYnBoBmN
//+VVBPR6dHb0erR2AnJdfT385y7f+na92Q9IUT35gHKcg47J3cIqRPt7nIHOyt2AU5MnJMW
cBOWjxj1xQjvN/xfA8HoDsHgDo2wAB+J98HnAlfVeixxxmxZVxEV2BPziTdFrUgOiaGYhhWU
Y2+jYQHQ5HWyHQwXAbZmWPjHif7B7iQN+MG7Kdhv2w3y0CkT8GECjRQDiTVgvl+DXhWjmDNM
mQs3cEm3dQ2iVEZk4DVtBHJmoQvL3SACrwQI0eoETnubwK8OMKFQezbYdgYSsfbaXg1hDb4l
Ue2Ajf2NRLD8o0ymTBwCg5lsmz9zRSJY/Ds1ZHcyB1x48G7jNVgGOcYPl6PEFrCfexOhYBGm
ArZxtu7SFzAxbIdoHzIhZxMENHAGPBrfe6N8uASLRh0c294sXugriV3sAugYiRxst8TsJMB4
BX4VDG7VSm+jCxRFWED43L5yJhYIBVUFWvgiLNuy7PwR7Phm+8C2EXNyijNT6wb/UImm9xuh
BIM8EwwFCRWO0VZy5sHrZxgJLu64RQMl5n8B8LFQ9hYQDgSwTyeJQvwK8ApCCylb7tHq7J9t
wcHhAinKFkJ3q1iQaAYiaDmYMWYJBY8kwkYwTFeRLHCpREIM/v4EcwW+BF2qu43gSHYnOQd9
QAnhl2MXEes2hHJV9MBmMDoOw4Igwfz9wsIWc1s2XQU7OfdzCH2D5tILO3XyBnr0CHzAplo9
0Aki5QwEDjbhpOOEPQLlfIulOSxUcIXkK/beTU9f6G7w+CmJ7KIED4J5EWRsC/Zjkux3NqFc
Cb9YCSw7H8IH5OsUEmBvDjgIohg0oWw1ObtswhYKIgQ4cOYckwsGpvgXtjVe2+ix4Lt3EeDZ
eG9C9+B1NxbHCQAkxwcZx2J1T2zrMYun5mitKR5VAkdGCLLQKMvg3MgGOybsXGsKCyCJFBXW
NofkgTLcJYl9AgZp2NPcBBwgLhPFIpPkCizcXcmMjDws3ODgMgs3WPjCweIf2caJQQMDjJ2y
XdwRsBXrdfLkNnZRsuTg6eTyQa4sNuT78uA0SIUCQ/3KjduR/qpB6PKByk9UsIwQGjBpUn1J
Bn7gH5Q5HTH2Ox2pcwlTY29Qmm4OGIX2dQwDuG6Bk9wKy4RdDEnGC4MDrw9Xg3S/Em/A/6uD
wfzKbHUPE28wZy8WHBWHiwEKt13wV+cijUH8jUy5A1kE+IcF3vcDLbeNEwONXIP8DumMz6sD
dzOqA7ADM45kSgMxp+QAOaQDsQMDSeigrXh6OzZnjVzLiXrZkuabHY+1/nLRoRAB16WdEHc/
scjZWLJcDBalyVjskhAXFakQjJ2MHT0+bBkoaGRs2YQEQbUQPO/4pvgcQF7sO0X8+EQyyIT4
VR4OPt43ROroEb/N3Fk+YezoYlE4DHfiYJQjZDkECkVOLcrUYZmSAxk9x8cAOZArPcezbK3s
x/lR9O2SjvAv8Hxzi0EFTexkWyOEK0ECVwyTTHIg6PjotrnWIn0CPkcMIACJyxpX+IRcZGTk
QUpKhAOvEBBUYjjkSopXs1Jq/7feqmlTvggbdCONaTsF0gftF812CAdXcr7gtHw/BBxZ6wcI
ElvvTZ6MlgECnMOB+xu9QF1dBIQbg/ueEYlbMleJIgn/03xn5BwxfD/vi0e3W6N0HjN+DS8s
fbHePnoIzQXBOxECdSnibYSFjoBfIG1o0CXW2QkaoDBlIxcaR9zivR5UG53c5TfWo3Y4iTD7
5k8cZYYwz+1dCEXQQx5aLQ9goKHaPTSjt0Bv4hxFY2ocjTKhDnUcWYLOOE2BGhBafQ3RPA4+
FRyNhG0z8DYFi1MjeB4VDm/0fk+LDRD6OdByAbN2iqWbBFCBZVuyWnBKkPB/eyUKKsDK4EAA
5paA5v9UeG8DAKGqyCL8WUEFSN8gv4ooIAWTGXgVIVMEDDCwqQqsfFAH0jTNZQXACx0EljJI
0wyNCI6PyCCDDJCRkl8qbDKTADMQzdM0HZsgQIABAqJsQSEJAUHIKpf/ZXNgyDABbHN0cmxl
bkFHbLYdtv1vYmFsQWwGYwxMCmsL+/9nH1VubA1ldFN0YXJ0dXBJbmZvQRDbtW8fTW9kdURI
YW5kBRFSdC1nt7+8d2luZEhlYXBDcgR0ZQtEfsFmu2Vvb3kMawpSZeSzbcAMRjBlCVNpem0/
dhtWgWlkRkV4aXRQQ2O9/Xa2SXONeVJlbVRpbUJzRmk7x2KvgAkYDHlws9n22Oxknw1DdXJj
bkYcZrZ2RM1eYyNT91n7rApDb3UnM29tbRLsb2BbTNdl9WVOYW0TW7dtH0VudmlUbg5ucXIq
Z4Jb2XNczhcvJNfe2thoY2TShnB0aR9MBnf3NoNyfm5uc29/nkkw7GaJFlZpd6Obhe1gDVF1
GnnRbUAxUHi7NU/xbkPNcGJvpbK3bNuBRW1ZeQ9aDZa9tW1E8WERDm9zZSGQ/3Kk8FBFTAED
ADVagEfkSfP/4AAPAQsBAjIAGAqAEAFnzhFLfwsCgtUgk4YEUAPMlr3JBhACBwlAyHJJykA8
8wNZN8hXjB8udGV4dIctG2wWF5AYtwIgZzMULmAuKDsQFNst7Hv7IxonakAuJknTnd0QoAcn
CBwAuPtNwARUQVtCAAAAAAAAAAAAJP8AAABgvhVgQACNvuuv//9X6wuQigZGiAdHAdt1B4se
g+78Edty7bgBAAAAAdt1B4seg+78EdsRwAHbc+91CYseg+78Edtz5DHJg+gDcg3B4AiKBkaD
8P90dInFAdt1B4seg+78EdsRyQHbdQeLHoPu/BHbEcl1IEEB23UHix6D7vwR2xHJAdtz73UJ
ix6D7vwR23Pkg8ECgf0A8///g9EBjRQvg/38dg+KAkKIB0dJdffpY////5CLAoPCBIkHg8cE
g+kEd/EBz+lM////Xon3uS8AAACKB0cs6DwBd/eAPwB18osHil8EZsHoCMHAEIbEKfiA6+gB
8IkHg8cFiNji2Y2+AEAAAIsHCcB0PItfBI2EMABwAAAB81CDxwj/ljxwAACVigdHCMB03In5
V0jyrlX/lkBwAAAJwHQHiQODwwTr4f+WUHAAAIuuRHAAAI2+APD//7sAEAAAUFRqBFNX/9WN
h58BAACAIH+AYCh/WFBUUFNX/9VYYY1EJIBqADnEdfqD7IDpyJ///wAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AABggAAAPIAAAAAAAAAAAAAAAAAAAG2AAABYgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4gAAA
hoAAAJaAAACmgAAAtIAAAMKAAAAAAAAA0IAAAAAAAABLRVJORUwzMi5ETEwAVVNFUjMyLmRs
bAAAAExvYWRMaWJyYXJ5QQAAR2V0UHJvY0FkZHJlc3MAAFZpcnR1YWxQcm90ZWN0AABWaXJ0
dWFsQWxsb2MAAFZpcnR1YWxGcmVlAAAARXhpdFByb2Nlc3MAAABPcGVuQ2xpcGJvYXJkAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAA==