逆向21-长春产权
1. 页面分析
页面显示
2.分析
根据载荷和响应都是加密的，我们也不知道该怎么找，按照经验来吧 先使用encrypt
断点处
可以扣代码吧
// 第一行代码做个修改～
function jiemi(e) {
var t = "";
try {
t = JSON.stringify(e)
} catch (n) {
return console.error(n + "这不是一个正确的json对象"),
""
}
return this.encryptCode(t)
}
o = {
"id": "rtny4t9g2lcudssd",
"projectKey": "honsan_cloud_ccprec",
"clientKey": "rtny4kekaz4t5woh",
"token": null,
"clientDailyData": {},
"acts": [
{
"id": "rtny4t9flm8hc1m1",
"fullPath": "/cloud.sys.tomcatV11/api/v1/template/getPages",
"args": [
{
"zhengShiPiLou": {
"templateId": "ee9787141b6d4297817574e38208a726",
"pageNo": 2,
"pageSize": 20,
"where": {
"projecttype": "G3",
"state": "62"
}
}
}
]
}
]
}
a = JSON.stringify(o)
s = jiemi(a)
console.log(s)
报错一
encryptCode = function(e) {
for (var t = encodeURI(e), n = [], i = 0, r = "", o = this.random(16, 32), a = this.randomStr(o), s = this.stringChangeASCIINumberArrs(a), l = 0, c = 0, u = 0, h = 0; h < t.length; h++)
i = t.charCodeAt(h),
l == this.pubPassNum.length && (l = 0),
i += this.pubPassNum[l],
l++,
c == s.length && (c = 0),
i += s[c],
c++,
u += i,
u > 65535 && (u -= 65535),
r = i.toString(36),
r = ("00" + r).substr(-2, 2),
1 == r.length && (r = "0" + r),
n.push(r);
var d = "";
return d = u.toString(36),
d = ("0000" + r).substr(-4, 4),
n.unshift(a),
n.unshift(o.toString(36)),
n.unshift(d),
n.join("")
}
报错二：
random = function(e, t) {
return void 0 === e && (e = 0),
void 0 === t && (t = 1e4),
Math.floor(Math.random() * (t - e) + e)
}
报错三：
randomStr = function(e) {
for (var t = [], n = 0; n < e; n++)
t.push(this.random(0, 35).toString(36));
return t.join("")
}
报错四：
stringChangeASCIINumberArrs = function(e) {
for (var t = [], n = 0; n < e.length; n++)
t.push(e.charCodeAt(n));
return t
}
报错五：
codeStr = "",
pubPass = "BX1o65CoobwcDP33iQW6ld1OyIPsNzF1",
pubPassNum = [],
publicKey = "",
3. 加密
Js 加密总代码
codeStr = "",
pubPass = "BX1o65CoobwcDP33iQW6ld1OyIPsNzF1",
pubPassNum = [],
publicKey = "",
stringChangeASCIINumberArrs = function(e) {
for (var t = [], n = 0; n < e.length; n++)
t.push(e.charCodeAt(n));
return t
}
setPass = function(e) {
this.pubPassNum = this.stringChangeASCIINumberArrs(e)
}
setPass(pubPass)
randomStr = function(e) {
for (var t = [], n = 0; n < e; n++)
t.push(this.random(0, 35).toString(36));
return t.join("")
}
random = function(e, t) {
return void 0 === e && (e = 0),
void 0 === t && (t = 1e4),
Math.floor(Math.random() * (t - e) + e)
}
encryptCode = function(e) {
for (var t = encodeURI(e), n = [], i = 0, r = "", o = this.random(16, 32), a = this.randomStr(o), s = this.stringChangeASCIINumberArrs(a), l = 0, c = 0, u = 0, h = 0; h < t.length; h++)
i = t.charCodeAt(h),
l == this.pubPassNum.length && (l = 0),
i += this.pubPassNum[l],
l++,
c == s.length && (c = 0),
i += s[c],
c++,
u += i,
u > 65535 && (u -= 65535),
r = i.toString(36),
r = ("00" + r).substr(-2, 2),
1 == r.length && (r = "0" + r),
n.push(r);
var d = "";
return d = u.toString(36),
d = ("0000" + r).substr(-4, 4),
n.unshift(a),
n.unshift(o.toString(36)),
n.unshift(d),
n.join("")
}
encrypt = function(e) {
var t = "";
try {
t = JSON.stringify(e)//第二次JSON.stringify
} catch (n) {
return console.error(n + "这不是一个正确的json对象"),
""
}
return this.encryptCode(t)
}
function get_encrypt(page) {
o = {
"id": uuid(),
"projectKey": "honsan_cloud_ccprec",
"clientKey": "rtny4kekaz4t5woh",
// "token": null,
"clientDailyData": {},
"acts": [
{
"id": "rtny4t9flm8hc1m1",
"fullPath": "/cloud.sys.tomcatV11/api/v1/template/getPages",
"args": [
{
"zhengShiPiLou": {
"templateId": "ee9787141b6d4297817574e38208a726",
"pageNo": page,
"pageSize": 20,
"where": {
"projecttype": "G3",
"state": "62"
}
}
}
]
}
]
}
var a = JSON.stringify(o)// 第一次JSON.stringify
return encrypt(a)
}
4. 解密
decryptCode = function(e) {
var t = ""
, n = 0
, i = ""
, r = []
, o = []
, a = 0
, s = 0;
t = e.substr(4, 1),
n = parseInt(t, 36),
i = e.substr(5, n),
r = this.stringChangeASCIINumberArrs(i),
t = e.substr(5 + n, e.length - 5 - n);
for (var l = "", c = 0, u = 0, h = 0; h < t.length / 2; h++)
l = t.substr(u, 2),
u += 2,
c = parseInt(l, 36),
s == r.length && (s = 0),
c -= r[s],
s++,
a == this.pubPass.length && (a = 0),
c -= this.pubPassNum[a],
a++,
l = String.fromCharCode(c),
o.push(l);
return t = o.join(""),
t = decodeURI(t),
t
}
python
import requests
import execjs
headers = {
'Accept': 'application/json, text/plain, */*',
'Accept-Language': 'zh-CN,zh;q=0.9',
'Cache-Control': 'no-cache',
'Connection': 'keep-alive',
'Content-Type': 'text/xml;charset=UTF-8',
'Origin': 'https://www.ccprec.com',
'Pragma': 'no-cache',
'Referer': 'https://www.ccprec.com/navCqzr/',
'Sec-Fetch-Dest': 'empty',
'Sec-Fetch-Mode': 'cors',
'Sec-Fetch-Site': 'same-origin',
'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36',
'sec-ch-ua': '"Not/A)Brand";v="8", "Chromium";v="126", "Google Chrome";v="126"',
'sec-ch-ua-mobile': '?0',
'sec-ch-ua-platform': '"macOS"',
}
js_code = open("21.js").read()
js_compile = execjs.compile(js_code)
data = js_compile.call("get_encrypt", 1)
print("加密参数",data)
response = requests.post('https://www.ccprec.com/honsanCloudAct', headers=headers, data=data)
data = js_compile.call("decryptCode", response.text)
print("解密数据", data)
浙公网安备 33010602011771号