21. XHR + eval
var xhrObj = new XMLHttpRequest();
xhrObj.onreadystatechange =
function() {
if ( xhrObj.readyState == 4 ) {
eval(xhrObj.responseText);
}
};
xhrObj.open('GET', 'A.js', true);
xhrObj.send('');
22. XHR + injection
var xhrObj = new XMLHttpRequest();
xhrObj.onreadystatechange =
function() {
if ( xhrObj.readyState == 4 ) {
var scriptElem = document.createElement('script');
var headElem = document.getElementsByTagName('head')[0];
headElem.appendChild(scriptElem);
scriptElem.text = xhrObj.responseText;
}
};
xhrObj.open('GET', 'A.js', true);
xhrObj.send('');
23. dom element
var scriptElem = document.createElement('script');
scriptElem.type= 'text/javascript';
scriptElem.src = /slideshow/javascript-dynamic-loading/7693028/&
var headElem = document.getElementsByTagName('head')[0];
headElem.appendChild(scriptElem);
24. dom element (not execute)
var scriptElem = document.createElement('script');
scriptElem.type= 'text/html';
scriptElem.src = /slideshow/javascript-dynamic-loading/7693028/&
var headElem = document.getElementsByTagName('head')[0];
headElem.appendChild(scriptElem);
27. XHR
var xhrObj = new XMLHttpRequest();
xhrObj.onreadystatechange =
function() {
if ( xhrObj.readyState == 4 ) {
/* eval or injection */
/* JavaScript onload */
}
};
xhrObj.open('GET', 'A.js', true);
xhrObj.send('');
28. dom element
var scriptElem = document.createElement('script');
scriptElem.src = /slideshow/javascript-dynamic-loading/7693028/&
scriptElem.onload = function() { /* JavaScript onload */ };
document.getElementsByTagName('head').appendChild(scriptElem);