逆向01-福建公共资源

福建公共资源

import requests
import time
from hashlib import md5
import base64
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad


headers = {
    'Accept': 'application/json, text/plain, */*',
    'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8,zh-TW;q=0.7',
    'Connection': 'keep-alive',
    'Content-Type': 'application/json;charset=UTF-8',
    'Origin': 'https://ggzyfw.fujian.gov.cn',
    'Referer': 'https://ggzyfw.fujian.gov.cn/index/new/',
    'Sec-Fetch-Dest': 'empty',
    'Sec-Fetch-Mode': 'cors',
    'Sec-Fetch-Site': 'same-origin',
    'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36',
    # 'portal-sign': '907555002f1311c2c00737e021a3cf6f',
    'sec-ch-ua': '"Not/A)Brand";v="8", "Chromium";v="126", "Google Chrome";v="126"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"macOS"',
}

json_data = {
    'pageSize': 8,
    'type': '12',
    'ts': int(time.time()*1000),
}

l = sorted(json_data.items(),key=lambda x:x[0])

s = ""
for k, v in l:
    s += k+str(v)

md5_sign = "B3978D054A72A7002063637CCDF6B2E5" + s

m = md5()
m.update(md5_sign.encode())
sign = m.hexdigest()

headers['portal-sign'] = sign

response = requests.post('https://ggzyfw.fujian.gov.cn/FwPortalApi/Article/PageList', headers=headers, json=json_data)
print(response.text)


base64_encrypt_date = response.json().get('Data')


# # （1）base64解码
encrypt_date = base64.b64decode(base64_encrypt_date)
print(encrypt_date) # b'\x91\x8f\xcb\xcfM\xa8\xbf\xc2\x87\x8b\x1c\x01Y\xb5\x17X'


# （2）解密
# 2.1 确认好解密的参数
key = "EB444973714E4A40876CE66BE45D5930".encode() 
iv = "B5A8904209931867".encode() 
# 2.2 创建AES对象
aes = AES.new(key, AES.MODE_CBC, iv) # key 模式 iv

# 2.3 对数据进行解密
data = aes.decrypt(encrypt_date)
# 2.4 去掉填充
data = unpad(data, AES.block_size) # AES.block_size 默认就是16
print(data.decode(), type(data)) # b"{'a':1}"

关键点：

1. 找到对应url--- copy出来curl，转化成python代码
   

2. 确保python代码可以运行得到数据
   数据格式

{
    "State": "200",
    "Success": true,
    "Data": "MZphJmFlelDpw2aSCfdFb15sUXFJykMiyauyyHu7lk1kVQpvsmAwSDFnna/3mdvbw0ri5Z9mj6OOcnutOS19Q8B7EC9KKbF/55HqH4sJOZwI5a3XkJi2L52R7GWRBFJVPjV8ZopEB+jNisP5vRygJ37C4hEW/0cUccQvJfBUImMcbB2bBW7HKCM7wI2ws8XDwHO3RiYIphN+Udx0XL19xMpyhSl0+rWOBZqf5AaRlhXsxKsAHRfyrlwxsrG5bvkTH60NVf5m70zQbK9cVrE17LcbQRshXYiAjFsYZbje2xiQhssvBpmQXZMgRhvh3LwYZ9cJU/WxyUwvkPiUPdQ3FXe9ifkeGIfir/ECt6PRgSINp3ZkQ8WPYGb733gkrFkkjxNC6EqbGRaeHelJCCl4ofPUSow3vJRiKszH7n/WojbZte1K/acV3d5VqT0mEmaUlrcEl2UuZ7B3Zff3IEpecF/lZDaKz4ysN160/CkkVtIGp6SRls+S9MQ3m9Gqps2AOX1wO/9vBLsq39JnDA8sEMCzSjGrHThKzDEAa1bnJJj1moZ5Ocz14S6oAWUIjMyLQwlUgf/W0Z5iLSoBGF4d7ZHre7ZtldTeGkx8SEngEATBr7zCH6ShA21Fk2EkL9hyH63I03eR3Qt5dKdKtfubvQe7L6005Rd79LgQ9TmaXFArPEZuw2Byy23LFSYlXOSXAcOcyIG6GaB56Xwuhb13V123dU8nFpMnvkgI+D6hh2wDBgVz9NRlzwepHfcPEvmig1HjefB5NeQrtYHtMMKgxUctZM0dbzrxGJ3H/CL199sw2PkcGbv/xpEZkEGQwNJflu2RYIoYVEU/kRpxb3augdPoppPUZR8+atOQziNSyLFWE+wOY3OjWSrROQv2Ocv8j8UKXEBnsYq6XPLct/EIoJlOyrJB1tARM+wP04JPCPYDHTzMeYO/IowBWfvinhW0KSVzMqs3sA0ojDLYABLPLcaCfZPTRaI/Iq8Y+SLZNvbbN6rW6gNUgDXlz4xcQFpkvEGXEIkbj2JVNnoV7T2gRdNDCUAnoGUrDyvQ19XT20FHU0Wf6KYFYZCwKTdl+yiaZUKyUdbSiNZoi1lbvgI87av/jsxICOdpqbbOGLdUaMvYR4linzQjElRXjAysOiUh0SD5D1AsGFDCOaqanWs0u3BUm3vcGeKa3ATn8LTP/o2XHTweZONGvQYBxTr76PZhrpfJrbiQ3xhHQ1TYuRGymDWrE+kJj0ecCK6W+pfseEW33dEJ5j1cl7u3fmYLJpOfUzpgMiwS57pnPaKkrW/mNTiaTf4hgn3mfIse0WII2tjjaJGhhO6So8qEy4LBrwxkoLqwtc9c3AQnn/5x8UbITTPc7HJ3xZHHjQ2rzCxENJsu+pdrkhrL1oQ47BvN8VModYTN5mgRKpKFrT0PR5VooEQFpnAEw1IuiaFA1wYBLKvaPCLkS127I1ZOV2f4knc1AN/ZFXtupK5XzAflcr/htXaxYwgVjW1nUd4kbtK4A6Vu46fdBy7tERpl0AQYDtSGWof9Y+HuR1ptisL0hibAWn2840L0ZWHmp5m4hHrG4mOvSEYkGhpquTAbZRwUucuTnUmvyIowmHA3P30TWNLjWHKP2e7b/OAB4rsy4LsY/sbmDUTiS41DoXTIXC+NGHHB2GYBdYaz4IT8Ec8Hen/JAtEy5TnnJCNBIDnJCRFNuYSO/1MkwJHDA3upeWeX/suu8aRKXJo7XcrNG3pQgcyYaRgnci2J98QKJ6ezXiOdRwP+B082YO1+iMa7rw9r1WSQntm27DxyRcO0d2MToSaW6XYi2HBu2jHBUJ2n+ID+qEiHkEAGr6UxV7FtCgFO+MZA2AXuQ0aeOcZ00oIoh+qweZxlzC2OD14jTpvQ8SJ/CeQbvnoZ0qeMBBZGQQ2UYYzbQ799TPiLI+Il2pQuh9b21yTgVCDkri28MhwIOe4HW5cMMJraC0qe8CLnWYUDLItmY4Jxy/nT9PHJukpWGB/pod3N2jkxZqfcK8rBj9UufTXoO9WbmCNn9v+RQG345IGEs81PbW9neGPLPfSW60eZNE+i7+62G89BxglO4pbHHmgURCaMXhMiNPPl6beTI6p1",
    "Msg": "操作成功"
}

3. 根据数据格式解密
   按照关键词 decrypt( 来搜索
   

写python代码

#获取数据的代码省略，最开始有完整代码
#response.json().get('Data')就是request得来的

base64_encrypt_date = response.json().get('Data')

# # （1）base64解码
encrypt_date = base64.b64decode(base64_encrypt_date)
print(encrypt_date) # b'\x91\x8f\xcb\xcfM\xa8\xbf\xc2\x87\x8b\x1c\x01Y\xb5\x17X'


# （2）解密
# 2.1 确认好解密的参数------重要 看上图
key = "EB444973714E4A40876CE66BE45D5930".encode() 
iv = "B5A8904209931867".encode() 
# 2.2 创建AES对象
aes = AES.new(key, AES.MODE_CBC, iv) # key 模式 iv

# 2.3 对数据进行解密
data = aes.decrypt(encrypt_date)
print(data.decode()) 

到这里我们就可以解密数据了
4. 我们发现换一个页码数据和时间戳数据就不能正常获取数据了，应该是加密了，最主要是header头中的portal-sign的原因，我们去看一下

搜索关键字 portal-sign 只有一个地方

逆向的参数


对data数据进行了一个sort排序

使用python代码实现

json_data = {
    'pageSize': 8,
    'type': '12',
    'ts': int(time.time()*1000),
}

l = sorted(json_data.items(),key=lambda x:x[0])

s = ""
for k, v in l:
    s += k+str(v)

md5_sign = "B3978D054A72A7002063637CCDF6B2E5" + s

m = md5()
m.update(md5_sign.encode())
sign = m.hexdigest()

将sign赋值给header

headers['portal-sign'] = sign

总代码见最上面

js断点的技巧