查看: 4741|回复: 0

[题目讨论] 五一我教粉丝完成了她的第一次JS逆向实战

字体大小: 正常放大

杨利霞

5273 主题	82 听众	17万积分

TA的每日心情

	开心 2021-8-11 17:59

签到天数: 17 天

[LV.4]偶尔看看III

网络挑战赛参赛者

自我介绍: 本人女，毕业于内蒙古科技大学，担任文职专业，毕业专业英语。

群组: 2018美赛大象算法课程

群组: 2018美赛护航培训课程

群组: 2019年数学中国站长建

群组: 2019年数据分析师课程

群组: 2018年大象老师国赛优

电梯直达

1^#

发表于 2020-5-8 16:54 |只看该作者 |正序浏览

|招呼Ta 关注Ta

五一我教粉丝完成了她的第一次JS逆向实战讲实话五一我还沉浸在其中，希望这是一场梦永远这样下去，因为一些小小的举动让她可能感受到了我的真诚吧！请我五一吃了一顿饭～～嗯？不信？

（拍个Vlog都说我P图----膨胀了？）图片为证！！！！！！右边👉那哥们没错就是本屌丝！！

五一假期的时候，有一个粉丝找到了我，大致找我干什么呢？其实刚开始我也是很迷。我除了会写个爬虫跟段子实在想不到自身还有何优点呀！难道是我那该死的温柔？？果不其然，专业的事情还是找到了我这个不专业的人。事情的经过它是这样子的：

粉丝：大佬！想问问你企业名片的数据那个加密怎么破解啊，我发现接口返回的数据是经过加密处理过的，虽然我写了一个Selenium版本的，能采集数据吧，就是慢！而且看着也很low一样。感觉自己就不是一个合格的爬虫工程师，作为一入坑爬虫没多久的我来说JS逆向压根没有思路…

都叫我大佬了，你就算不是妹子。今天这事我也得给你办喽！再不专业我现学现卖也要厚着脸皮上！

起初我还是帮在Github跟一些博客找了相关的参考资料给她想着能打开她的一些思路，但是我发现事情并不是这样的。一个对逆向基本思路没有相关经验跟思路的她可能并不知道如何找到切入点，先干嘛？再干嘛？甚至是在Chrome内基本的调试操作都不太清楚—

最重要的一点是：参考的资料只包含了对数据加密破解的思路跟讲解，而这个网站在登陆的情况下对IP不仅有反爬措施更会冻结你的账号。所以呢！我就做了一把雷锋，把整个网站的爬虫代码都撸了出来，请看大屏幕：

来！不说那些没用的。整点实际的给大家。对了！完整代码仅供学习参考使用，有需要可以联系作者获取

首先打开她给我发的链接企名片，在未登陆的情况下看到网站确实是有一些让爬虫上瘾的数据。嘿！你左手右手一个慢动作，跟着我的操作一起走呀！光看着也不抵用噻

刷新页面，开发者工具打开，可以发现网页是js动态生成的，并没有发现你咱们想要的HTML。象征性的点击一下查看响应数据

我不知道productListVip这个接口内的响应数据是不是就有网站我们需要的数据！但是可以看到有一个数encrypt_data是经过处理的，初步看这只是一个Base64的编码，真的这么简单吗？我想它在编码之前是经过加密算法处理过的。因为很多网站对数据加密或多或少都是这样的套路，所以为了验证这个被处理的东东到底是个啥，我们需要先去破解它

这个过程是快乐的，当然！它建立在你成功或有收获的基础之上。不然用Selenium来做它难道不香吗？还要什么自行车？
参数encrypt_data既然是经过处理的，但是终归是要给用户看的，所以在它呈现到网页过程中肯定是有在中间的某个地方对这个数据做了对应的解密操作，不然搞一顿Base64的编码数据给用户看？毕竟大家不是程序员呀！

之前说到过对于一些请求、响应…参数加密的这种场景，去反推的思路有很多种，可以通过搜索关键字、也可以通过hook、也可以断点。思路是这样的，具体因站而异哈

既然是JS生成我们在开发者工具中点击Sources，因为现在加密参数的那个请求它就是XHR，所以在右侧XHR断点调试栏添加它，这个功能支持XHR请求断点调试！

OK！做好上面的一切我们刷新网站页面。然后断点跟预期中的一样，停了下来。我们单步跟进可以很直观的看到每一个参数传递的细节，直到发现了跟接口响应数据极度相似的参数e.data

继续跟进发现e.data参数的数据通过一个函数实现。可以在Console中将这个函数调用执行一下。没错！函数Obiect(u.a)(e.encrypt_data)返回的内容正是网站页面呈现的数据。到了这一步我们能确定接口就是数据加载的接口，Base64编码也正是经过加密之后的数据

既然现在我们已经找到了真实的数据，那就证明它在呈现的时候就已经解密了，我们进到这个函数体内去继续寻找，发现了解密函数

function o(t)是一个解密函数，可以看到它先调用s函数，s函数是什么？等下我们进去看看就知道了！一共有四个参数，a.a.decode(t)这个参数是数据。等下下面看了s函数就明白了。另外三个参数固定的，最后JSON.parse格式化json数据

这个就是s函数，你觉得它主要功能是干嘛的呢？我猜它是做数据解密的，你看看这一大串不是解密算法就让我写代码不掉头发！这东西你要想了解它解密算法的原理用Python实现解密的话可以好好分析一下
function s(t, e, i, n, a, s) {
var o, r, c, l, u, d, h, p, f, v, m, g, b, y, _ = new Array(16843776,0,65536,16843780,16842756,66564,4,65536,1024,16843776,16843780,1024,16778244,16842756,16777216,4,1028,16778240,16778240,66560,66560,16842752,16842752,16778244,65540,16777220,16777220,65540,0,1028,66564,16777216,65536,16843780,4,16842752,16843776,16777216,16777216,1024,16842756,65536,66560,16777220,1024,4,16778244,66564,16843780,65540,16842752,16778244,16777220,1028,66564,16843776,1028,16778240,16778240,0,65540,66560,0,16842756), C = new Array(-2146402272,-2147450880,32768,1081376,1048576,32,-2146435040,-2147450848,-2147483616,-2146402272,-2146402304,-2147483648,-2147450880,1048576,32,-2146435040,1081344,1048608,-2147450848,0,-2147483648,32768,1081376,-2146435072,1048608,-2147483616,0,1081344,32800,-2146402304,-2146435072,32800,0,1081376,-2146435040,1048576,-2147450848,-2146435072,-2146402304,32768,-2146435072,-2147450880,32,-2146402272,1081376,32,32768,-2147483648,32800,-2146402304,1048576,-2147483616,1048608,-2147450848,-2147483616,1048608,1081344,0,-2147450880,32800,-2147483648,-2146435040,-2146402272,1081344), w = new Array(520,134349312,0,134348808,134218240,0,131592,134218240,131080,134217736,134217736,131072,134349320,131080,134348800,520,134217728,8,134349312,512,131584,134348800,134348808,131592,134218248,131584,131072,134218248,8,134349320,512,134217728,134349312,134217728,131080,520,131072,134349312,134218240,0,512,131080,134349320,134218240,134217736,512,0,134348808,134218248,131072,134217728,134349320,8,131592,131584,134217736,134348800,134218248,520,134348800,131592,8,134348808,131584), x = new Array(8396801,8321,8321,128,8396928,8388737,8388609,8193,0,8396800,8396800,8396929,129,0,8388736,8388609,1,8192,8388608,8396801,128,8388608,8193,8320,8388737,1,8320,8388736,8192,8396928,8396929,129,8388736,8388609,8396800,8396929,129,0,0,8396800,8320,8388736,8388737,1,8396801,8321,8321,128,8396929,129,1,8192,8388609,8193,8396928,8388737,8193,8320,8388608,8396801,128,8388608,8192,8396928), k = new Array(256,34078976,34078720,1107296512,524288,256,1073741824,34078720,1074266368,524288,33554688,1074266368,1107296512,1107820544,524544,1073741824,33554432,1074266112,1074266112,0,1073742080,1107820800,1107820800,33554688,1107820544,1073742080,0,1107296256,34078976,33554432,1107296256,524544,524288,1107296512,256,33554432,1073741824,34078720,1107296512,1074266368,33554688,1073741824,1107820544,34078976,1074266368,256,33554432,1107820544,1107820800,524544,1107296256,1107820800,34078720,0,1074266112,1107296256,524544,33554688,1073742080,524288,0,1074266112,34078976,1073742080), T = new Array(536870928,541065216,16384,541081616,541065216,16,541081616,4194304,536887296,4210704,4194304,536870928,4194320,536887296,536870912,16400,0,4194320,536887312,16384,4210688,536887312,16,541065232,541065232,0,4210704,541081600,16400,4210688,541081600,536870912,536887296,16,541065232,4210688,541081616,4194304,16400,536870928,4194304,536887296,536870912,16400,536870928,541081616,4210688,541065216,4210704,541081600,0,541065232,16,16384,541065216,4210704,16384,4194320,536887312,0,541081600,536870912,4194320,536887312), A = new Array(2097152,69206018,67110914,0,2048,67110914,2099202,69208064,69208066,2097152,0,67108866,2,67108864,69206018,2050,67110912,2099202,2097154,67110912,67108866,69206016,69208064,2097154,69206016,2048,2050,69208066,2099200,2,67108864,2099200,67108864,2099200,2097152,67110914,67110914,69206018,69206018,2,2097154,67108864,67110912,2097152,69208064,2050,2099202,69208064,2050,67108866,69208066,69206016,2099200,0,2,69208066,0,2099202,69206016,2048,67108866,67110912,2048,2097154), L = new Array(268439616,4096,262144,268701760,268435456,268439616,64,268435456,262208,268697600,268701760,266240,268701696,266304,4096,64,268697600,268435520,268439552,4160,266240,262208,268697664,268701696,4160,0,0,268697664,268435520,268439552,266304,262144,266304,262144,268701696,4096,64,268697664,4096,266304,268439552,64,268435520,268697600,268697664,268435456,262144,268439616,0,268701760,262208,268435520,268697600,268439552,268439616,0,268701760,266240,266240,4160,4160,262208,268435456,268701696), S = function(t) {
      for (var e, i, n, a = new Array(0,4,536870912,536870916,65536,65540,536936448,536936452,512,516,536871424,536871428,66048,66052,536936960,536936964), s = new Array(0,1,1048576,1048577,67108864,67108865,68157440,68157441,256,257,1048832,1048833,67109120,67109121,68157696,68157697), o = new Array(0,8,2048,2056,16777216,16777224,16779264,16779272,0,8,2048,2056,16777216,16777224,16779264,16779272), r = new Array(0,2097152,134217728,136314880,8192,2105344,134225920,136323072,131072,2228224,134348800,136445952,139264,2236416,134356992,136454144), c = new Array(0,262144,16,262160,0,262144,16,262160,4096,266240,4112,266256,4096,266240,4112,266256), l = new Array(0,1024,32,1056,0,1024,32,1056,33554432,33555456,33554464,33555488,33554432,33555456,33554464,33555488), u = new Array(0,268435456,524288,268959744,2,268435458,524290,268959746,0,268435456,524288,268959744,2,268435458,524290,268959746), d = new Array(0,65536,2048,67584,536870912,536936448,536872960,536938496,131072,196608,133120,198656,537001984,537067520,537004032,537069568), h = new Array(0,262144,0,262144,2,262146,2,262146,33554432,33816576,33554432,33816576,33554434,33816578,33554434,33816578), p = new Array(0,268435456,8,268435464,0,268435456,8,268435464,1024,268436480,1032,268436488,1024,268436480,1032,268436488), f = new Array(0,32,0,32,1048576,1048608,1048576,1048608,8192,8224,8192,8224,1056768,1056800,1056768,1056800), v = new Array(0,16777216,512,16777728,2097152,18874368,2097664,18874880,67108864,83886080,67109376,83886592,69206016,85983232,69206528,85983744), m = new Array(0,4096,134217728,134221824,524288,528384,134742016,134746112,16,4112,134217744,134221840,524304,528400,134742032,134746128), g = new Array(0,4,256,260,0,4,256,260,1,5,257,261,1,5,257,261), b = t.length > 8 ? 3 : 1, y = new Array(32 * b), _ = new Array(0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0), C = 0, w = 0, x = 0; x < b; x++) {
         var k = t.charCodeAt(C++) << 24 | t.charCodeAt(C++) << 16 | t.charCodeAt(C++) << 8 | t.charCodeAt(C++)
            , T = t.charCodeAt(C++) << 24 | t.charCodeAt(C++) << 16 | t.charCodeAt(C++) << 8 | t.charCodeAt(C++);
         k ^= (n = 252645135 & (k >>> 4 ^ T)) << 4,
            k ^= n = 65535 & ((T ^= n) >>> -16 ^ k),
            k ^= (n = 858993459 & (k >>> 2 ^ (T ^= n << -16))) << 2,
            k ^= n = 65535 & ((T ^= n) >>> -16 ^ k),
            k ^= (n = 1431655765 & (k >>> 1 ^ (T ^= n << -16))) << 1,
            k ^= n = 16711935 & ((T ^= n) >>> 8 ^ k),
            n = (k ^= (n = 1431655765 & (k >>> 1 ^ (T ^= n << 8))) << 1) << 8 | (T ^= n) >>> 20 & 240,
            k = T << 24 | T << 8 & 16711680 | T >>> 8 & 65280 | T >>> 24 & 240,
            T = n;
         for (var A = 0; A < _.length; A++)
            _[A] ? (k = k << 2 | k >>> 26,
                  T = T << 2 | T >>> 26) : (k = k << 1 | k >>> 27,
                  T = T << 1 | T >>> 27),
                  T &= -15,
                  e = a[(k &= -15) >>> 28] | s[k >>> 24 & 15] | o[k >>> 20 & 15] | r[k >>> 16 & 15] | c[k >>> 12 & 15] | l[k >>> 8 & 15] | u[k >>> 4 & 15],
                  i = d[T >>> 28] | h[T >>> 24 & 15] | p[T >>> 20 & 15] | f[T >>> 16 & 15] | v[T >>> 12 & 15] | m[T >>> 8 & 15] | g[T >>> 4 & 15],
                  n = 65535 & (i >>> 16 ^ e),
                  y[w++] = e ^ n,
                  y[w++] = i ^ n << 16
      }
      return y
}(t), z = 0, B = e.length, I = 0, j = 32 == S.length ? 3 : 9;
p = 3 == j ? i ? new Array(0,32,2) : new Array(30,-2,-2) : i ? new Array(0,32,2,62,30,-2,64,96,2) : new Array(94,62,-2,32,64,2,30,-2,-2),
      2 == s ? e += "       " : 1 == s ? i && (c = 8 - B % 8,
         e += String.fromCharCode(c, c, c, c, c, c, c, c),
      8 === c && (B += 8)) : s || (e += "\0\0\0\0\0\0\0\0");
var F = ""
      , $ = "";
for (1 == n && (f = a.charCodeAt(z++) << 24 | a.charCodeAt(z++) << 16 | a.charCodeAt(z++) << 8 | a.charCodeAt(z++),
      m = a.charCodeAt(z++) << 24 | a.charCodeAt(z++) << 16 | a.charCodeAt(z++) << 8 | a.charCodeAt(z++),
      z = 0); z < B; ) {
      for (d = e.charCodeAt(z++) << 24 | e.charCodeAt(z++) << 16 | e.charCodeAt(z++) << 8 | e.charCodeAt(z++),
               h = e.charCodeAt(z++) << 24 | e.charCodeAt(z++) << 16 | e.charCodeAt(z++) << 8 | e.charCodeAt(z++),
         1 == n && (i ? (d ^= f,
               h ^= m) : (v = f,
               g = m,
               f = d,
               m = h)),
               d ^= (c = 252645135 & (d >>> 4 ^ h)) << 4,
               d ^= (c = 65535 & (d >>> 16 ^ (h ^= c))) << 16,
               d ^= c = 858993459 & ((h ^= c) >>> 2 ^ d),
               d ^= c = 16711935 & ((h ^= c << 2) >>> 8 ^ d),
               d = (d ^= (c = 1431655765 & (d >>> 1 ^ (h ^= c << 8))) << 1) << 1 | d >>> 31,
               h = (h ^= c) << 1 | h >>> 31,
               r = 0; r < j; r += 3) {
         for (b = p[r + 1],
                  y = p[r + 2],
                  o = p[r]; o != b; o += y)
            l = h ^ S[o],
                  u = (h >>> 4 | h << 28) ^ S[o + 1],
                  c = d,
                  d = h,
                  h = c ^ (C[l >>> 24 & 63] | x[l >>> 16 & 63] | T[l >>> 8 & 63] | L[63 & l] | _[u >>> 24 & 63] | w[u >>> 16 & 63] | k[u >>> 8 & 63] | A[63 & u]);
         c = d,
            d = h,
            h = c
      }
      h = h >>> 1 | h << 31,
         h ^= c = 1431655765 & ((d = d >>> 1 | d << 31) >>> 1 ^ h),
         h ^= (c = 16711935 & (h >>> 8 ^ (d ^= c << 1))) << 8,
         h ^= (c = 858993459 & (h >>> 2 ^ (d ^= c))) << 2,
         h ^= c = 65535 & ((d ^= c) >>> 16 ^ h),
         h ^= c = 252645135 & ((d ^= c << 16) >>> 4 ^ h),
         d ^= c << 4,
      1 == n && (i ? (f = d,
         m = h) : (d ^= v,
         h ^= g)),
         $ += String.fromCharCode(d >>> 24, d >>> 16 & 255, d >>> 8 & 255, 255 & d, h >>> 24, h >>> 16 & 255, h >>> 8 & 255, 255 & h),
      512 == (I += 8) && (F += $,
         $ = "",
         I = 0)
}
if (F = (F += $).replace(/\0*$/g, ""),
      !i) {
      if (1 === s) {
         var N = 0;
         (B = F.length) && (N = F.charCodeAt(B - 1)),
         N <= 8 && (F = F.substring(0, B - N))
      }
      F = decodeURIComponent(escape(F))
}
return F
}

现在，我们也找到了解密的js函数，也有了加密之后的数据。把这几段关键的JS代码抠出来做一个测试，这里我使用在线的工具，有ide当然更专业。先简单的做一个测试

function decrypt_func(t) {
return JSON.parse(s("5e5062e82f15fe4ca9d24bc5", window.atob(t), 0, 0, "012345677890123", 1))
}

encrypt_data = ""
//这个加密的数据我这里就不提供了，测试的话打开网站请自提一下
data = decrypt_func(encrypt_data)
console.log(JSON.stringify(data))

加密的那个s函数我也贴在上面了，别落下，然后我们看看测试效果，这…这…这不就是那个自行车吗？

后来吃完饭，我也把完整的代码亲手交给了她！

好了，到这里又到了跟大家说再见的时候了。我只是一个会写爬虫的段子手而已，一个希望有朝一日能够实现财富自由，能够早日荣归故里的游子罢了。希望我的文章能带给您知识，带给您帮助，带给您欢笑！同时也谢谢您能抽出宝贵的时间阅读，创作不易，如果您喜欢的话，点个赞再走吧。您的支持是我创作的动力，希望今后能带给大家更多优质的文章
————————————————
版权声明：本文为CSDN博主「似繁星跌入梦」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.csdn.net/qiulin_wu/article/details/105954687

zan