逆向16-精灵数据

目录

• 1 分析接口
• 2 定位入口
• 3 代码

精灵数据

1 分析接口

URL：https://vapi.jinglingshuju.com/Data/getNewsList

经过分析，只有data数据是加密的

2 定位入口

关键字decrypt搜索

打断点-看谁能停下来

3 代码

const CryptoJS = require('crypto-js');
function decrypt(data) {
    // if (Object(k.e)(data))
    //     return data;
    let z = {
        "words": [
            1146640983,
            1685607770,
            896165747,
            1430671430
        ],
        "sigBytes": 16
    }
    var e = CryptoJS.AES.decrypt(data, z, {
        iv: CryptoJS.enc.Utf8.parse("DXZWdxUZ5jgsUFPF".substr(0, 16)),
        mode: CryptoJS.mode.ECB,
        padding: CryptoJS.pad.Pkcs7
    });
    return JSON.parse(e.toString(CryptoJS.enc.Utf8))
}

python

import requests
import execjs
url = "https://vapi.jinglingshuju.com/Data/getNewsList"

payload = 'page=2&num=20'
headers = {
  'accept': 'application/json, text/plain, */*',
  'accept-language': 'zh-CN,zh;q=0.9',
  'cache-control': 'no-cache',
  'content-type': 'application/x-www-form-urlencoded',
  'origin': 'https://www.jinglingshuju.com',
  'pragma': 'no-cache',
  'priority': 'u=1, i',
  'sec-ch-ua': '"Not/A)Brand";v="8", "Chromium";v="126", "Google Chrome";v="126"',
  'sec-ch-ua-mobile': '?0',
  'sec-ch-ua-platform': '"macOS"',
  'sec-fetch-dest': 'empty',
  'sec-fetch-mode': 'cors',
  'sec-fetch-site': 'same-site',
  'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36',
  'Cookie': 'PHPSESSID=7hmpngnk67inhj4m9succh6p50'
}

response = requests.request("POST", url, headers=headers, data=payload)
js_compile = execjs.compile(open('./jlsj.js').read())

data = response.json().get('data')

# 解数据

data_obj = js_compile.call('decrypt', data)
print(data_obj)