Hijacking native objects for chrome

location.js

 function location(){}
 
 var _location = window.document.location;
 
     location.__proto__ = _location;

    location.__defineSetter__('href', function(url) {
      _location.href = "FreeBuf.COM | 关注黑客与极客";
    });

    location.__defineGetter__('href', function(url) {
      return _location.href;
    });
// 或者使用ES6的Proxy代理，也同样可以实现相同功能：
   window.location = new Proxy(_location, {
       set: function(target, prop, value, receiver){
           if (prop !== 'href'){
               Reflect.set(target, prop, value, receiver);
           }else{
              target.href = "FreeBuf.COM | 关注黑客与极客";
           }
       }
    })
    
    
    
    Object.defineProperty(window,"location",{"writable": false});

navigator.js

var _navigator;
    
    function navigator(){}

    var frame = document.createElement('iframe');
    frame.width = frame.height = 0;
    frame.style.display = "none";
    document.lastChild.appendChild(frame);

    _navigator = window.frames[0].window.navigator;

    window.navigator = new Proxy(_navigator, {
       set: function(target, prop, value, receiver){
           return Reflect.set(target, prop, value, receiver);
       },
       get: function(target, prop, receiver){
           if (prop === 'userAgent'){
              return "this is a faked userAgent";
           }
           return target[prop];
       }
    })

参考

https://zhuanlan.zhihu.com/p/24342684