Skip to content

Instantly share code, notes, and snippets.

@stuartgunter
Created December 9, 2016 15:11
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save stuartgunter/592d33edfc743edd92be2ff604055a68 to your computer and use it in GitHub Desktop.
Save stuartgunter/592d33edfc743edd92be2ff604055a68 to your computer and use it in GitHub Desktop.
Google Bug Bounty
<!DOCTYPE html>
<script id="safenup-script">
(function() { var r=function(a){if(!g.test(a))return a;-1!=a.indexOf("&")&&(a=a.replace(k,"&amp;"));-1!=a.indexOf("<")&&(a=a.replace(l,"&lt;"));-1!=a.indexOf(">")&&(a=a.replace(m,"&gt;"));-1!=a.indexOf('"')&&(a=a.replace(n,"&quot;"));-1!=a.indexOf("'")&&(a=a.replace(p,"&#39;"));-1!=a.indexOf("\x00")&&(a=a.replace(q,"&#0;"));return a},k=/&/g,l=/</g,m=/>/g,n=/"/g,p=/'/g,q=/\x00/g,g=/[\x00&<>"']/;var t=function(){},u=function(){},v=function(){},w=function(){},y=function(){},aa=function(a){var c=new z("xhrRequest");c.data+=a.a+":";A(c,a.method);A(c,a.url);return c},ba=function(){},ca=function(){},da=function(){},ea=function(){},z=function(a){this.data="s97Y1g5a";A(this,a)},A=function(a,c){a.data+=c.length+":"+c},B=function(a,c){a.data=null==c?a.data+"N":a.data+(c.length+":"+c)},E=function(a){C.postMessage(a.data,D)},F=function(a){this.data=a;this.b=0};
F.prototype.a=function(){var a=G(this);if(!(0<=a))throw"invalid";var c=this.b,b=this.b+a;this.b+=a;return this.data.substring(c,b)};var G=function(a){var c=a.data.indexOf(":",a.b);if(-1==c)throw"invalid";var b=a.b;a.b=c+1;return Number(a.data.substring(b,c))},H=function(a){return"N"==a.data.charAt(a.b)?(a.b++,null):a.a()},I=function(a,c){return function(){for(var b=[];"]"!=a.data.charAt(a.b);)b.push(c.call(a));a.b++;return b}};var J=function(a){return'"'+a.replace(/["\\<>\r\n\u2028\u2029\x00]/g,function(a){return"\\u"+("0000"+a.charCodeAt(0).toString(16)).slice(-4)})+'"'},K=function(a){var c=document.createElement("A");c.href=a;return c.cloneNode(!1)},L=function(a){a=K(a);var c="about:blank";try{var b=a.pathname;encodeURI(decodeURI(b))==b&&(c=a.href)}catch(e){}return c},M=function(a,c,b){a.addEventListener?a.addEventListener(c,b,!1):a.attachEvent("on"+c,b)},N=function(a,c){var b=document;b.removeEventListener?b.removeEventListener(a,
c,!1):b.detachEvent("on"+a,c)},ga=function(){var a=fa,c=function(){"loading"!=document.readyState&&(N("readystatechange",c),N("DOMContentLoaded",c),a())};M(document,"readystatechange",c);M(document,"DOMContentLoaded",c)},O=function(a){window.console&&console.log("SafenUp: "+a)};var D,P,Q,R=[],S=-1,C=window.parent,ia=function(a){var c=location.pathname+location.search;if(c!=a.a+a.f&&"/"!=c)C.location=D+location.pathname+location.search+location.hash;else{var b=!1;window.safenup_getContent=function(){if(!b)return b=!0,"\ufeff"+T(a)};window.location.replace("javascript:safenup_getContent()");b||(b=!0,ha(a));(0<a.b||0<a.c)&&window.scrollTo(a.b,a.c)}},ha=function(a){a=T(a);document.open("text/html","replace");document.write(a);document.close()},T=function(a){var c="";"BackCompat"!=
a.m&&(c="<!DOCTYPE html>\n");0<a.i.length&&(c+=U("html",a.i)+"\n");0<a.h.length&&(c+=U("head",a.h)+"\n");var b=D+(a.a+a.f+a.l),c=c+('<link rel="canonical" href="'+r(b)+'">');null!=a.g&&(b=a.g);for(var c=c+('<base href="'+r(b)+'" target="_parent">\n'),b="{domain:"+J(a.o)+",pathname: "+J(a.a)+",search:"+J(a.f)+",hash:"+J(a.l)+",referrer:"+J(a.referrer)+",scrollX:"+a.b+",scrollY:"+a.c+",cookies:[",e=0;e<a.j.length;e++)0!=e&&(b+=","),b+=J(a.j[e]);c+='<script>\nwindow.safenup_status = "ok";\nwindow.safenup_data = '+
(b+"]}")+";\n"+document.getElementById("safenup-script").innerHTML+"\x3c/script>\n";return c+=a.content},ka=function(){var a=new XMLHttpRequest,c=window.XMLHttpRequest;window.XMLHttpRequest=function(){"withCredentials"in a&&(this.withCredentials=!1);this.readyState=0};window.XMLHttpRequest.prototype.open=function(a,c){this.method_=a;this.url_=c};window.XMLHttpRequest.prototype.send=function(a){var b=this;if(0==L(b.url_).lastIndexOf(D+"/",0))a=new y,a.a=ja(b),a.method=b.method_,a.url=b.url_,E(aa(a));
else{var d=new c;d.open(b.method_,b.url_,!0);d.onreadystatechange=function(a){try{b.readyState=d.readyState,b.response=d.response,b.responseText=d.responseText,b.responseType=d.responseType,b.status=d.status,b.statusText=d.statusText}catch(h){}if(b.onreadystatechange)b.onreadystatechange(a)};d.onload=function(a){if(b.onload)b.onload(a)};d.onerror=function(a){if(b.onerror)b.onerror(a)};d.onabort=function(a){if(b.onabort)b.onabort(a)};d.ontimeout=function(a){if(b.ontimeout)b.ontimeout(a)};d.send(a)}};
window.XMLHttpRequest.prototype.abort=function(){O("XMLHttpRequest.abort() not implemented")};window.XMLHttpRequest.prototype.setRequestHeader=function(){};window.XMLHttpRequest.prototype.getResponseHeader=function(){return null};window.XMLHttpRequest.prototype.getAllResponseHeaders=function(){return""};window.XMLHttpRequest.prototype.overrideMimeType=function(){O("XMLHttpRequest.overrideMimeType() not implemented")}},ja=function(a){var c;-1!=S?(c=S,S=R[S]):c=R.length;R[c]=a;return c},qa=function(){var a=
window.safenup_data,c=location.protocol+"//"+location.host+(a.pathname+a.search+a.hash);window.location.hash!=a.hash&&"#"==a.hash.charAt(0)&&window.location.replace(c);M(window,"submit",function(a){V(a.target?a.target:a.srcElement)});ga();W(document,"referrer",a.referrer);W(document,"domain",a.domain);la(a.cookies);ka();ma();na();M(document,"readystatechange",function(){(0<a.scrollX&&window.pageXOffset!=a.scrollX||0<a.scrollY&&window.pageYOffset!=a.scrollY)&&window.scrollTo(a.scrollX,a.scrollY)});
W(window,"parent",window.parent==window.top?window.self:window.parent.parent);oa();pa()},fa=function(){for(var a=document.getElementsByTagName("FORM"),c=0;c<a.length;c++)V(a[c]);a=new v;a.b=document.title;for(var b=document.getElementsByTagName("LINK"),c=0;c<b.length;c++){var e=b[c];if(/(^|\s)icon($|\s)/i.test(e.rel)){a.a=L(e.href);break}}b=document.getElementsByTagName("META");for(c=0;c<b.length;c++)if(e=b[c],"viewport"==e.name){a.c=e.content;ra();break}sa();c=new z("props");B(c,a.b);B(c,a.a);B(c,
a.c);E(c)},V=function(a){var c=a.getAttribute("action");c&&c!=location.href||a.setAttribute("action",D+location.pathname+location.search+location.hash)},sa=function(){window.angular&&angular.module("ng").config(["$sceDelegateProvider","$windowProvider",function(a,c){a.SCE_CONTEXTS&&a.SCE_CONTEXTS.TEMPLATE_URL||a.resourceUrlWhitelist(["self",D+"/**"]);var b=ta();c.$get=function(){return b}}])},ta=function(){function a(a){"location"==a||"window"==a||0==a.lastIndexOf("webkit",0)||Object.defineProperty(b,
a,{get:function(){var b=window[a];return"function"==typeof b?function(){return window[a].apply(window,arguments)}:b},set:function(b){window[a]=b},configurable:!0,enumerable:!0})}var c=function(){};c.prototype=window;var b=new c,e;for(e in window)a(e);Object.defineProperty(b,"location",{value:ua(),configurable:!0,enumerable:!0});Object.defineProperty(b,"window",{value:b,configurable:!0,enumerable:!0});return b},ua=function(){var a={},c=P,b=c,e="";-1!=c.indexOf(":")&&(b=c[0],e=c[1]);a.protocol=location.protocol;
a.host=c;a.hostname=b;a.port=e;Object.defineProperties(a,{href:{get:function(){return D+location.pathname+location.search+location.hash},set:function(a){C.location.href=a}},pathname:{get:function(){return location.pathname}},search:{get:function(){return location.search}},hash:{get:function(){return location.hash},set:function(a){location.hash=a;C.location.href=D+location.pathname+location.search+location.hash}}});a.replace=function(a){C.location.href=a};return a},ra=function(){if(/\blike Mac OS X\b.*\bAppleWebKit\b.*\bMobile\b/.test(navigator.userAgent)){var a=
document.createElement("X-BODY"),c=a.style;c.width="100vw";c.height="100vh";c.position="fixed";c.left="0";c.top="0";c.display="block";c.overflow="scroll";c.webkitOverflowScrolling="touch";var b=window.getComputedStyle(document.documentElement).padding;c.padding=b;c.boxSizing="border-box";var e=document.body;a.appendChild(e);document.documentElement.appendChild(a);Object.defineProperty(document,"body",{get:function(){return e},configurable:!0})}},ma=function(){function a(a){a=a.target;"LINK"==a.tagName&&
a.sheet&&(e++,h&&e>=d&&c())}function c(){x&&f.parentNode.removeChild(f);x=!1}var b=/\bFirefox\/(\d+)/.exec(navigator.userAgent);if(b&&!(9>Number(b[1]))){var e=0,d=0,x=!1,h=!1,f;x||(f=document.createElement("STYLE"),f.textContent="body { display: none; }",document.head.appendChild(f));x=!0;window.addEventListener("load",function(){c()});document.head.addEventListener("load",a,!0);document.head.addEventListener("error",a,!0);document.addEventListener("DOMContentLoaded",function(){if(document.body){h=
!0;for(var a=document.head.getElementsByTagName("LINK"),b=0;b<a.length;b++)a[b].sheet&&d++;e>=d&&c()}})}},na=function(){M(window,"beforeunload",function(){var a=new w;a.a=window.pageXOffset;a.b=window.pageYOffset;var c=new z("scroll");c.data+=a.a+":";c.data+=a.b+":";E(c)})},la=function(a){try{Object.defineProperty(document,"cookie",{configurable:!0,get:function(){return a.join("; ")},set:function(c){var b=c.match(/^\s*([^;=]+?)\s*=\s*([^;]*?)\s*(;.*)?$/);if(b){for(var e=b[1],b=b[2],d=0;;d++)if(d==
a.length||0==a[d].lastIndexOf(e+"=",0)){a[d]=e+"="+b;break}e=new z("cookie");A(e,c);E(e)}}})}catch(c){}},oa=function(){var a=window.open;window.open=function(c,b,e,d){"_self"==b&&(c=L(c),b="_parent");return a(c,b,e,d)}},pa=function(){function a(a,e,d){if(d){var b=d,h=K(d);d=h.pathname;var f=h.search,h=h.hash;0==d.lastIndexOf("/",0)||(d="/"+d);d=location.protocol+"//"+location.host+d+f+h}f=new da;f.url=null==b?null:String(b);b=new z("changeUrl");B(b,f.url);b.data+=f.a?"T":"F";E(b);return c.call(history,
a,e,d)}var c;history.pushState&&(history.pushState=function(b,c,d){return a(b,c,d)});history.replaceState&&(Q=c=history.replaceState,history.replaceState=function(b,c,d){return a(b,c,d)})},U=function(a,c){a="<"+a;for(var b=0;b<c.length;b++){var e=c[b];a+=" "+e[0]+'="'+r(e[1])+'"'}return a+">"},W=function(a,c,b){try{Object.defineProperty(a,c,{configurable:!0,value:b})}catch(e){}};var X=location.host,Y=X.length-30;if(!(0<=Y&&X.indexOf(".safenup.googleusercontent.com",Y)==Y))throw"bad domain";var Z=location.host.substring(0,location.host.length-30).replace(/-(.)/g,function(a,c){switch(c){case "-":return".";case "c":return":";case "d":return"-"}});P=Z;D=location.protocol+"//"+Z;
M(window,"message",function(a){var c=C;if(a=a.origin===D&&a.source===c&&"string"==typeof a.data&&0==a.data.lastIndexOf("s97Y1g5a",0)?new F(a.data.substring(8)):null)switch(a.a()){case "content":var b=new t;b.content=a.a();b.m=a.a();b.referrer=a.a();b.j=I(a,a.a)();b.o=a.a();b.a=a.a();b.f=a.a();b.l=a.a();b.i=I(a,I(a,a.a))();b.h=I(a,I(a,a.a))();b.b=G(a);b.c=G(a);b.g=H(a);ia(b);break;case "show":document.activeElement==document.body&&(document.querySelector&&(b=document.querySelector("[autofocus]")),
(b?b:window).focus());break;case "hash":b=new u;b.a=a.a();a=b.a;location.hash==a?(a=location.hash)&&"#"!=a&&(a=document.getElementById(a.substring(1)))&&a.scrollIntoView():(a||(a="#"),window.location.replace(location.protocol+"//"+location.host+location.pathname+location.search+a));break;case "xhrResponse":b=new ba;b.c=G(a);b.g=G(a);b.a=H(a);b.status=G(a);b.statusText=H(a);b.b=a.a();if(a.b>=a.data.length)throw"invalid";a="T"==a.data.charAt(a.b++);b.f=a;a=R[b.c];b.f&&(c=b.c,R[c]=S,S=c);a.readyState=
b.g;null!=b.a&&(a.responseText=b.a,a.response=b.a,a.responseType="");a.status=b.status;null!=b.statusText&&(a.statusText=b.statusText);if(a["on"+b.b])a["on"+b.b]();break;case "xhrReject":b=new ca;b.a=G(a);b.b=a.a();a=R[b.a];c=b.a;R[c]=S;S=c;O("Rejected "+a.method_+" "+a.url_+": "+b.b);a.readyState=4;a.responseText="Rejected by SafenUp: "+b.b;a.status=999;if(a.onreadystatechange)a.onreadystatechange();break;case "popState":b=new ea;b.url=a.a();Q.call(window.history,null,"",location.protocol+"//"+location.host+
b.url);a=document.createEvent("PopStateEvent");a.initEvent("popstate",!0,!1);window.dispatchEvent(a);break;default:throw"unknown message type";}});"ok"==window.safenup_status?qa():E(new z("ready")); })();
</script>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment