ws.onmessage = function(datad) {orderby10这儿的10是参数用来猜有多少个字段数 timeout=5#指定菜单等候挑选的时长http://1de28830f09a4b1b.alictf.com/pet.php/?id=imageData&type=evi1m0%26%23x3c%3B%26%23x73%3B%26%23x63%3B%26%23x72%3B%26%23x69%3B%26%23x70%3B%26%23x74%3B%26%23x3e%3B%26%23x61%3B%26%23x6c%3B%26%23x65%3B%26%23x72%3B%26%23x74%3B%26%23x28%3B%26%23x31%3B%26%23x29%3B%26%23x3c%3B%26%23x2f%3B%26%23x73%3B%26%23x63%3B%26%23x72%3B%26%23x69%3B%26%23x70%3B%26%23x74%3B%26%23x3e%3B&a=%3Cscript%3Evar%20imageData%20=%20{name:%20%22%22};%3Cscript%3E[1][2]黑客接单渠道 windows/beacon_dns/reverse_http

use server/browser_autopwn 经过这个Flash 0day特性，结合 *** ONP接口，就能够把Flash文件内容（纯字母数字）附加到 *** ONP的回来成果中（经过给 *** ONP的callback参数赋值），为了依照Flash格局正常解析，文件头有必要是严厉的Flash文件内容。