Such as: detect the user access to WWW.BAIDU.COM, on the client side before the request is modified to www.qq.com.

From the protocol layer testing, users ready to open the BAIDU, in the browser output enter, protocol request was detected, and change!

Implementation need to use which kinds of API, roughly the way!

CodePudding user response:

Application layer to hijack (such as IE), http://hi.baidu.com/xingxing/item/611a90c63edd0060f7c95d99
Driver layer hijacked, can use WinPcap, http://www.winpcap.org/

CodePudding user response:

Things like this tool survival time not too long, just test report by security guards, and then blacklist, then submitted to the poison