篇幅有限
完整內(nèi)容及源碼關(guān)注公眾號(hào)：ReverseCode，發(fā)送 沖
https://m.rjs.com/member/user.html#1
抓包
登錄url:
POST https://m.rjs.com/japi/account/login.json
請(qǐng)求頭：
:authority: m.rjs.com
:method: POST
:path: /japi/account/login.json
:scheme: https
accept: application/json, text/plain, */*
accept-encoding: gzip, deflate, br
accept-language: zh-CN,zh;q=0.9
content-length: 172
content-type: application/json
cookie: riskTipTimes1=1; Hm_lvt_7ff1e43d61e6b35b46f6bb33c3aba9bb=1618099071; Hm_lpvt_7ff1e43d61e6b35b46f6bb33c3aba9bb=1618099071
datatype: json
origin: https://m.rjs.com
referer: https://m.rjs.com/member/user.html
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not\"A\\Brand";v="99"
sec-ch-ua-mobile: ?1
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: same-origin
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36
參數(shù)：
{"platform":"wap","session_token":"","session_id":"","data":{"userName":"15806204085","password":"123"},"sign":"b6a20a0b1c82b87d65b78b2943bb3fbc","timestamp":1618099099626}
分析
搜索japi/account/login.json 無果
搜索account/login.json
loginAction: function() {
if (this.checkLoginKey() && this.checkLoginPwd()) {
var e = this;
c.Common.fajax({
url: "account/login.json",
easyOriginData: {
userName: e.loginKey,
password: e.loginPwd
},
success: function(t) {
1 == t.status ? (c.Common.cookie.set("session_token_dp", t.data.sessionToken, "/", "/", 168),
c.Common.cookie.set("platform", "wap", "/", "/", 168),
c.Common.localStore.set("session_token_dp", t.data.sessionToken),
c.Common.localStore.set("uid_dp", t.data.uid),
c.Common.cookie.set("secretKey", t.data.secretKey, "/", "/", 168),
c.Common.alert("simpleSuccess", "登錄成功", 1, e.goHref, "/member-undp/index.html")) : e.alert(t.message)
}
})
}
},
打上斷點(diǎn)調(diào)試，此時(shí)并沒有出現(xiàn)sign,說明sign應(yīng)該是在fajax中生成，進(jìn)入fajax中，逐步調(diào)試，t["sign"] = i(f + "&" + i(o.genSignData(t.data)) + "&" + d),這一步出現(xiàn)了sign進(jìn)行填值，f為/account/login.json
d是""空字符串
接下來分析i(o.genSignData(t.data))中的o.genSignData(t.data),其中t.data為賬戶密碼的對(duì)象
genSignData
i(o.genSignData(t.data))分析，先進(jìn)入o.genSignData函數(shù)，拆分出來js如下
var genSignData = function(e) {
var t = ""
, n = [];
for (var r in e)
n.push(r);
n = n.sort();
for (var i = 0; i < n.length; i++) {
var o = n[i]
, s = e[o]
, l = !1;
if ("object" == ("undefined" == typeof s ? "undefined" : (0,
a.default)(s))) {
var c = "{";
for (var u in s)
c += u + "=" + s[u] + ", ",
l = !0;
l && (s = c.substring(0, c.length - 2) + "}")
}
"sign" != o && null !== s && void 0 !== s && "" !== s && ("object" != ("undefined" == typeof s ? "undefined" : (0,
a.default)(s)) || l) && (t += (0 == i ? "" : "&") + o + "=" + s)
}
return null != t && "" != t && "&" == t.substr(0, 1) && (t = t.substr(1, t.length)),
t
}
單獨(dú)運(yùn)行時(shí)報(bào)錯(cuò)Uncaught ReferenceError: a is not defined,打印a.default
進(jìn)入a.default,該三元運(yùn)算所得結(jié)果即為控制臺(tái)打印結(jié)果，必然前面的是完全匹配的
t.default = "function" == typeof s.default && "symbol" === l(a.default) ? function(e) {
return "undefined" == typeof e ? "undefined" : l(e)
}
該l函數(shù)在上面也有定義如下
那么我們定義函數(shù)k即a.default如下,替換genSignData完成函數(shù)解密password=123&userName=15806204095
var k = function(e){
return"undefined"==typeof e?"undefined": typeof e
}
i
i(o.genSignData(t.data))分析，接下來就是i函數(shù)的分析，進(jìn)入i函數(shù)
第一次調(diào)用i函數(shù)時(shí)，先調(diào)用o函數(shù)進(jìn)行加密，再調(diào)用wordsToBytes轉(zhuǎn)成字節(jié)，返回bytesToHex生成16進(jìn)制字符串，整體邏輯理清后進(jìn)入o函數(shù)。
o
該函數(shù)中引用了n(694),n(247).utf8,n(974),n(247).bin,通過debug可知以上都生成了加密函數(shù)
這些加密函數(shù)搜索分別發(fā)現(xiàn)出現(xiàn)在了694:function，247:function等等，可以斷定，這些函數(shù)其實(shí)就是作為變量在o函數(shù)中調(diào)用
扣出694,247,974的代碼如下
var liu94 = function (e, t) {
var t = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
, n = {
rotl: function (e, t) {
return e << t | e >>> 32 - t
},
rotr: function (e, t) {
return e << 32 - t | e >>> t
},
endian: function (e) {
if (e.constructor == Number)
return 16711935 & n.rotl(e, 8) | 4278255360 & n.rotl(e, 24);
for (var t = 0; t < e.length; t++)
e[t] = n.endian(e[t]);
return e
},
randomBytes: function (e) {
for (var t = []; e > 0; e--)
t.push(Math.floor(256 * Math.random()));
return t
},
bytesToWords: function (e) {
for (var t = [], n = 0, r = 0; n < e.length; n++,
r += 8)
t[r >>> 5] |= e[n] << 24 - r % 32;
return t
},
wordsToBytes: function (e) {
for (var t = [], n = 0; n < 32 * e.length; n += 8)
t.push(e[n >>> 5] >>> 24 - n % 32 & 255);
return t
},
bytesToHex: function (e) {
for (var t = [], n = 0; n < e.length; n++)
t.push((e[n] >>> 4).toString(16)),
t.push((15 & e[n]).toString(16));
return t.join("")
},
hexToBytes: function (e) {
for (var t = [], n = 0; n < e.length; n += 2)
t.push(parseInt(e.substr(n, 2), 16));
return t
},
bytesToBase64: function (e) {
for (var n = [], r = 0; r < e.length; r += 3)
for (var i = e[r] << 16 | e[r + 1] << 8 | e[r + 2], a = 0; a < 4; a++)
8 * r + 6 * a <= 8 * e.length ? n.push(t.charAt(i >>> 6 * (3 - a) & 63)) : n.push("=");
return n.join("")
},
base64ToBytes: function (e) {
e = e.replace(/[^A-Z0-9+\/]/gi, "");
for (var n = [], r = 0, i = 0; r < e.length; i = ++r % 4)
0 != i && n.push((t.indexOf(e.charAt(r - 1)) & Math.pow(2, -2 * i + 8) - 1) << 2 * i | t.indexOf(e.charAt(r)) >>> 6 - 2 * i);
return n
}
};
return n;
}
var er47 = {
utf8: {
stringToBytes: function (e) {
return er47.bin.stringToBytes(unescape(encodeURIComponent(e)))
},
bytesToString: function (e) {
return decodeURIComponent(escape(er47.bin.bytesToString(e)))
}
},
bin: {
stringToBytes: function (e) {
for (var t = [], n = 0; n < e.length; n++)
t.push(255 & e.charCodeAt(n));
return t
},
bytesToString: function (e) {
for (var t = [], n = 0; n < e.length; n++)
t.push(String.fromCharCode(e[n]));
return t.join("")
}
}
};
var jiu74 = function (e, t) {
function n(e) {
return !!e.constructor && "function" == typeof e.constructor.isBuffer && e.constructor.isBuffer(e)
}
function r(e) {
return "function" == typeof e.readFloatLE && "function" == typeof e.slice && n(e.slice(0, 0))
}
return function (e) {
return null != e && (n(e) || r(e) || !!e._isBuffer)
}
}
在o函數(shù)中改寫t,r,i,a
var t = liu94()
, r = er47.utf8
, i = jiu74()
, a = er47.bin
最終只要將o函數(shù)中exports的函數(shù)return出來即可
res = function (e, n) {
console.log(e)
if (void 0 === e || null === e)
throw new Error("Illegal argument " + e);
var r = t.wordsToBytes(o(e, n));
console.log(r)
return n && n.asBytes ? r : n && n.asString ? a.bytesToString(r) : t.bytesToHex(r)
}
//res("password=123&userName=158062204095", undefined);
//console.log('-------->',res(origin, undefined))
return res;
由于o(e,n)中的即為o.genSignData生成的賬密參數(shù)password=123&userName=15806204095，n為undefined，那么我們就可以直接調(diào)用該方法返回真正的sign。
console.log(encrypt()("/account/login.json"+"&"+encrypt()(genSignData(UP))+"&"+""));
查看抓包后的結(jié)果如下
爬蟲實(shí)現(xiàn)
import json
import requests
import execjs
username = "15806204095"
psssword = "123"
with open(r'rjs_sign.js', encoding='utf-8', mode='r') as f:
JsData = f.read()
sign = execjs.compile(JsData).call('request',username,psssword)
data = json.dumps({"platform":"wap","session_token":"","session_id":"","data":{"userName":username,"password":psssword},"sign":sign,"timestamp":1618153079455})
r =requests.post("https://m.rjs.com/japi/account/login.json",data)
print(r.text)
完整源碼請(qǐng)關(guān)注微信公眾號(hào)：ReverseCode，回復(fù)：JS逆向
本文由博客群發(fā)一文多發(fā)等運(yùn)營工具平臺(tái) OpenWrite 發(fā)布
