篇幅有限
完整内容及源码关注公众号：ReverseCode，发送 冲
https://m.rjs.com/member/user.html#1
抓包
登录url:
POST https://m.rjs.com/japi/account/login.json
请求头：
:authority: m.rjs.com
:method: POST
:path: /japi/account/login.json
:scheme: https
accept: application/json, text/plain, */*
accept-encoding: gzip, deflate, br
accept-language: zh-CN,zh;q=0.9
content-length: 172
content-type: application/json
cookie: riskTipTimes1=1; Hm_lvt_7ff1e43d61e6b35b46f6bb33c3aba9bb=1618099071; Hm_lpvt_7ff1e43d61e6b35b46f6bb33c3aba9bb=1618099071
datatype: json
origin: https://m.rjs.com
referer: https://m.rjs.com/member/user.html
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not\"A\\Brand";v="99"
sec-ch-ua-mobile: ?1
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: same-origin
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36
参数：
{"platform":"wap","session_token":"","session_id":"","data":{"userName":"15806204085","password":"123"},"sign":"b6a20a0b1c82b87d65b78b2943bb3fbc","timestamp":1618099099626}
分析
搜索japi/account/login.json 无果
搜索account/login.json
loginAction: function() {
if (this.checkLoginKey() && this.checkLoginPwd()) {
var e = this;
c.Common.fajax({
url: "account/login.json",
easyOriginData: {
userName: e.loginKey,
password: e.loginPwd
},
success: function(t) {
1 == t.status ? (c.Common.cookie.set("session_token_dp", t.data.sessionToken, "/", "/", 168),
c.Common.cookie.set("platform", "wap", "/", "/", 168),
c.Common.localStore.set("session_token_dp", t.data.sessionToken),
c.Common.localStore.set("uid_dp", t.data.uid),
c.Common.cookie.set("secretKey", t.data.secretKey, "/", "/", 168),
c.Common.alert("simpleSuccess", "登录成功", 1, e.goHref, "/member-undp/index.html")) : e.alert(t.message)
}
})
}
},
打上断点调试，此时并没有出现sign,说明sign应该是在fajax中生成，进入fajax中，逐步调试，t["sign"] = i(f + "&" + i(o.genSignData(t.data)) + "&" + d),这一步出现了sign进行填值，f为/account/login.json
image-20210411184621104
d是""空字符串
image-20210411184650658
接下来分析i(o.genSignData(t.data))中的o.genSignData(t.data),其中t.data为账户密码的对象
image-20210411184839858
genSignData
i(o.genSignData(t.data))分析，先进入o.genSignData函数，拆分出来js如下
var genSignData = function(e) {
var t = ""
, n = [];
for (var r in e)
n.push(r);
n = n.sort();
for (var i = 0; i < n.length; i++) {
var o = n[i]
, s = e[o]
, l = !1;
if ("object" == ("undefined" == typeof s ? "undefined" : (0,
a.default)(s))) {
var c = "{";
for (var u in s)
c += u + "=" + s[u] + ", ",
l = !0;
l && (s = c.substring(0, c.length - 2) + "}")
}
"sign" != o && null !== s && void 0 !== s && "" !== s && ("object" != ("undefined" == typeof s ? "undefined" : (0,
a.default)(s)) || l) && (t += (0 == i ? "" : "&") + o + "=" + s)
}
return null != t && "" != t && "&" == t.substr(0, 1) && (t = t.substr(1, t.length)),
t
}
单独运行时报错Uncaught ReferenceError: a is not defined,打印a.default
image-20210411185111684
进入a.default,该三元运算所得结果即为控制台打印结果，必然前面的是完全匹配的
t.default = "function" == typeof s.default && "symbol" === l(a.default) ? function(e) {
return "undefined" == typeof e ? "undefined" : l(e)
}
该l函数在上面也有定义如下
image-20210411185437746
那么我们定义函数k即a.default如下,替换genSignData完成函数解密password=123&userName=15806204095
var k = function(e){
return"undefined"==typeof e?"undefined": typeof e
}
i
i(o.genSignData(t.data))分析，接下来就是i函数的分析，进入i函数
image-20210411124238222
第一次调用i函数时，先调用o函数进行加密，再调用wordsToBytes转成字节，返回bytesToHex生成16进制字符串，整体逻辑理清后进入o函数。
o
image-20210411185814560
该函数中引用了n(694),n(247).utf8,n(974),n(247).bin,通过debug可知以上都生成了加密函数
image-20210411185946412
这些加密函数搜索分别发现出现在了694:function，247:function等等，可以断定，这些函数其实就是作为变量在o函数中调用
image-20210411190204917
image-20210411190338395
扣出694,247,974的代码如下
var liu94 = function (e, t) {
var t = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
, n = {
rotl: function (e, t) {
return e << t | e >>> 32 - t
},
rotr: function (e, t) {
return e << 32 - t | e >>> t
},
endian: function (e) {
if (e.constructor == Number)
return 16711935 & n.rotl(e, 8) | 4278255360 & n.rotl(e, 24);
for (var t = 0; t < e.length; t++)
e[t] = n.endian(e[t]);
return e
},
randomBytes: function (e) {
for (var t = []; e > 0; e--)
t.push(Math.floor(256 * Math.random()));
return t
},
bytesToWords: function (e) {
for (var t = [], n = 0, r = 0; n < e.length; n++,
r += 8)
t[r >>> 5] |= e[n] << 24 - r % 32;
return t
},
wordsToBytes: function (e) {
for (var t = [], n = 0; n < 32 * e.length; n += 8)
t.push(e[n >>> 5] >>> 24 - n % 32 & 255);
return t
},
bytesToHex: function (e) {
for (var t = [], n = 0; n < e.length; n++)
t.push((e[n] >>> 4).toString(16)),
t.push((15 & e[n]).toString(16));
return t.join("")
},
hexToBytes: function (e) {
for (var t = [], n = 0; n < e.length; n += 2)
t.push(parseInt(e.substr(n, 2), 16));
return t
},
bytesToBase64: function (e) {
for (var n = [], r = 0; r < e.length; r += 3)
for (var i = e[r] << 16 | e[r + 1] << 8 | e[r + 2], a = 0; a < 4; a++)
8 * r + 6 * a <= 8 * e.length ? n.push(t.charAt(i >>> 6 * (3 - a) & 63)) : n.push("=");
return n.join("")
},
base64ToBytes: function (e) {
e = e.replace(/[^A-Z0-9+\/]/gi, "");
for (var n = [], r = 0, i = 0; r < e.length; i = ++r % 4)
0 != i && n.push((t.indexOf(e.charAt(r - 1)) & Math.pow(2, -2 * i + 8) - 1) << 2 * i | t.indexOf(e.charAt(r)) >>> 6 - 2 * i);
return n
}
};
return n;
}
var er47 = {
utf8: {
stringToBytes: function (e) {
return er47.bin.stringToBytes(unescape(encodeURIComponent(e)))
},
bytesToString: function (e) {
return decodeURIComponent(escape(er47.bin.bytesToString(e)))
}
},
bin: {
stringToBytes: function (e) {
for (var t = [], n = 0; n < e.length; n++)
t.push(255 & e.charCodeAt(n));
return t
},
bytesToString: function (e) {
for (var t = [], n = 0; n < e.length; n++)
t.push(String.fromCharCode(e[n]));
return t.join("")
}
}
};
var jiu74 = function (e, t) {
function n(e) {
return !!e.constructor && "function" == typeof e.constructor.isBuffer && e.constructor.isBuffer(e)
}
function r(e) {
return "function" == typeof e.readFloatLE && "function" == typeof e.slice && n(e.slice(0, 0))
}
return function (e) {
return null != e && (n(e) || r(e) || !!e._isBuffer)
}
}
在o函数中改写t,r,i,a
var t = liu94()
, r = er47.utf8
, i = jiu74()
, a = er47.bin
最终只要将o函数中exports的函数return出来即可
res = function (e, n) {
console.log(e)
if (void 0 === e || null === e)
throw new Error("Illegal argument " + e);
var r = t.wordsToBytes(o(e, n));
console.log(r)
return n && n.asBytes ? r : n && n.asString ? a.bytesToString(r) : t.bytesToHex(r)
}
//res("password=123&userName=158062204095", undefined);
//console.log('-------->',res(origin, undefined))
return res;
由于o(e,n)中的即为o.genSignData生成的账密参数password=123&userName=15806204095，n为undefined，那么我们就可以直接调用该方法返回真正的sign。
console.log(encrypt()("/account/login.json"+"&"+encrypt()(genSignData(UP))+"&"+""));
image-20210411191326027
查看抓包后的结果如下
image-20210411191409718
爬虫实现
import json
import requests
import execjs
username = "15806204095"
psssword = "123"
with open(r'rjs_sign.js', encoding='utf-8', mode='r') as f:
JsData = f.read()
sign = execjs.compile(JsData).call('request',username,psssword)
data = json.dumps({"platform":"wap","session_token":"","session_id":"","data":{"userName":username,"password":psssword},"sign":sign,"timestamp":1618153079455})
r =requests.post("https://m.rjs.com/japi/account/login.json",data)
print(r.text)
完整源码请关注微信公众号：ReverseCode，回复：JS逆向
本文由博客群发一文多发等运营工具平台 OpenWrite 发布
网友评论