47 | 最后固定到工具栏中即可使用！
48 |
--------------------------------------------------------------------------------
/background.js:
--------------------------------------------------------------------------------
1 | 'use strict';
2 |
3 | // 域名敏感名单
4 | const DOMAIN_KEYWORDS = [
5 | '1616', '163', '51cto', '58pic', 'alicdn', 'amap', 'apple', 'baidu', 'bilibili',
6 | 'bit', 'c-ctrip', 'chinaunix', 'cnblogs', 'cndns', 'cnzz', 'com', 'comgithub',
7 | 'csdn', 'ctfile', 'ctrip', 'dangdang', 'faloo', 'fastadmin', 'github', 'gnu',
8 | 'growingio', 'hupu', 'huya', 'ifeng', 'ip', 'iqiyi', 'iqiyipic', 'iteye', 'itpub',
9 | 'jd', 'jiyoujia', 'mgtv', 'mop', 'mths', 'pptv', 'qq', 'qy', 'renren',
10 | 'scorecardresearch', 'sitestar', 'skylink', 'sogou', 'sohu', 'sougou', 'taihe',
11 | 'thatscaptaintoyou', 'tianya', 'uc', 'weibo', 'youku', 'zbj', 'zhibo8'
12 | ];
13 |
14 | // JSONP特征参数
15 | const JSONP_KEYWORDS = ['callback', 'jsonp', 'cb', 'function', 'token', 'auth'];
16 |
17 | // 域名白名单（支持通配符）
18 | const WHITE_LIST = [
19 | '*.qq.com',
20 | '*.163.com',
21 | '*.baidu.com',
22 | '*.bilibili.com',
23 | '*.cnblogs.com',
24 | '*.weibo.com',
25 | '*.jd.com',
26 | '*.taobao.com',
27 | '*.csdn.net',
28 | '*.google.com',
29 | '*.bing.com',
30 | '*.moonshot.com',
31 | '*.deepseek.com',
32 | '*.n.com',
33 | '*.github.com'
34 | ];
35 |
36 | // 预编译白名单正则表达式
37 | const WHITE_LIST_REGEX = new RegExp(
38 | WHITE_LIST.map(domain => {
39 | if (domain.startsWith('*.')) {
40 | return `(^|\\.)${domain.slice(2).replace(/\./g, '\\.')}$`;
41 | }
42 | return `^${domain.replace(/\./g, '\\.')}$`;
43 | }).join('|'),
44 | 'i'
45 | );
46 |
47 | let isEnabled = true;
48 | const tabStates = new Map();
49 |
50 | // 白名单检测
51 | function isWhitelisted(hostname) {
52 | return WHITE_LIST_REGEX.test(hostname);
53 | }
54 |
55 | // 初始化标签页状态
56 | function initTabState(tabId) {
57 | if (!tabStates.has(tabId)) {
58 | tabStates.set(tabId, {
59 | counter: 0,
60 | isLocked: false,
61 | hasAlerted: false, // 新增弹窗状态标记
62 | lockedHosts: new Set(),
63 | timer: null
64 | });
65 | }
66 | return tabStates.get(tabId);
67 | }
68 |
69 | // 蜜罐警报（优化单次触发逻辑）
70 | function triggerHoneypotAlert(finding) {
71 | const state = tabStates.get(finding.tabId);
72 | if (!state || state.hasAlerted) return; // 防止重复触发
73 |
74 | state.hasAlerted = true; // 标记已触发
75 |
76 | chrome.storage.sync.get(["alerts"], result => {
77 | // 页面弹窗（仅触发一次）
78 | if (result.alerts !== false) {
79 | chrome.tabs.executeScript(finding.tabId, {
80 | code: `alert('疑似蜜罐: 检测到 ${finding.key} (特征:${finding.match}) 来自 ${finding.src}');`
81 | });
82 | }
83 |
84 | // 系统通知（同样仅一次）
85 | chrome.notifications.create({
86 | type: 'basic',
87 | iconUrl: chrome.runtime.getURL('icons/icon-128.png'),
88 | title: `嗅嗅闻到了蜜罐的味道 | ${finding.key}`,
89 | message: `${finding.match.substring(0,24)}... @ ${finding.src.replace(/^www\./, '')}`,
90 | priority: 2
91 | });
92 | });
93 | }
94 |
95 | // 主拦截逻辑（修改触发条件）
96 | chrome.webRequest.onBeforeRequest.addListener(
97 | function(details) {
98 | if (!isEnabled || details.tabId === -1) return;
99 |
100 | try {
101 | const originUrl = new URL(details.originUrl || details.url);
102 | if (isWhitelisted(originUrl.hostname)) return { cancel: false };
103 | } catch (e) {
104 | console.warn('URL解析失败:', e);
105 | return { cancel: false };
106 | }
107 |
108 | const tabId = details.tabId;
109 | const state = initTabState(tabId);
110 | const currentUrl = new URL(details.url);
111 |
112 | // 已锁定直接拦截（不重复弹窗）
113 | if (state.isLocked && state.lockedHosts.has(currentUrl.hostname)) {
114 | return { cancel: true };
115 | }
116 |
117 | // 特征检测（保持不变）
118 | const isCrossDomain = !details.url.startsWith(details.originUrl);
119 | const queryParams = Array.from(currentUrl.searchParams.keys());
120 | const isJsonp = queryParams.some(p =>
121 | JSONP_KEYWORDS.some(k => p.toLowerCase().includes(k))
122 | );
123 | const isSuspDomain = DOMAIN_KEYWORDS.some(k =>
124 | currentUrl.hostname.includes(k)
125 | );
126 |
127 | if (isCrossDomain && (isJsonp || isSuspDomain)) {
128 | state.counter++;
129 |
130 | // 初始化计时器（保持不变）
131 | if (!state.timer) {
132 | state.timer = setTimeout(() => {
133 | state.counter = 0;
134 | state.timer = null;
135 | }, 8000);
136 | }
137 |
138 | // 关键修改：仅首次达到阈值时触发
139 | if (state.counter === 4) { // 使用严格等于判断
140 | const detectedType = isJsonp ? 'JSONP参数' : '域名特征';
141 | const detectedValue = isJsonp
142 | ? queryParams.find(p => JSONP_KEYWORDS.some(k => p.includes(k)))
143 | : DOMAIN_KEYWORDS.find(k => currentUrl.hostname.includes(k));
144 |
145 | triggerHoneypotAlert({
146 | key: `${detectedType}命中`,
147 | match: detectedValue,
148 | src: currentUrl.hostname,
149 | tabId: tabId
150 | });
151 |
152 | state.isLocked = true;
153 | state.lockedHosts.add(currentUrl.hostname);
154 | chrome.tabs.sendMessage(tabId, {
155 | action: "lockdown",
156 | blockedHost: currentUrl.hostname
157 | });
158 | }
159 |
160 | return { cancel: state.isLocked };
161 | }
162 | return { cancel: false };
163 | },
164 | { urls: ["