当前位置:网站首页>Restore of data encryption returned by a website
Restore of data encryption returned by a website
2022-07-18 01:16:00 【I'm Li Yufeng】
Reverse website :aHR0cHM6Ly93d3cucWltaW5ncGlhbi5jbi9maW5vc2RhL3Byb2plY3QvcGludmVzdG1lbnQ=
The data to be captured is as follows :

1. Observation request
Open console , Enter the URL and press enter . stay DOC Returned under module html Source code , We didn't find the data we needed , The probability of the returned data is through ajax Back to .
stay XHR The following two interfaces are found under the module :

And the data returned by these two interfaces are encrypted data , as follows :

From this analysis ,`encrypt_data` It contains the data we need , It's just encrypted , We can't see normal plaintext data . The next thing we need to do is put these ciphertext data , By analyzing its encryption logic , Restore its plaintext data .
2. location `encrypt_data`
By searching for keywords `encrypt_data`, only one js file :
Click in to change js file , And click... In the lower left corner of the page `{}` Symbol , format js Code :

And after formatting js In file , Search for `encrypt_data` keyword , There are six places containing this keyword :

And by observing these six codes , I found only one suspicious place , And make a breakpoint here
Refresh the page , Breakpoints found effective , It shows that our analysis is correct , This breakpoint is where we need to analyze :
3. Locate the encryption entry
stay `Object(d.a)` At the next breakpoint , And click the single step debugging button :
It will eventually arrive at `s(e)` This function , And the parameters of this function e, Is the encrypted data `encrypt_data`.
We output... On the console `s(e)`, The output result is clear text , No longer ciphertext , explain `s(e)` This function is the entry of decryption .
4. analysis s(e) The logic of a function , And construction js Code
This function calls the function o , Dyadic function o Pass six parameters in , among except `a.a.decode(e)` It needs further Beyond the analysis , The other five are fixed values . Finally through JSON.parse Put function o The return value of is converted to json object . After the analysis here , We can construct a general js It's logical , as follows :
function s(e) {
return JSON.parse(o("5e5062e82f15fe4ca9d24bc5", decode(e), 0, 0, "012345677890123", 1))
}
// encrypt_data That is, the interface returns the ciphertext data
var encrypt_data = " The string is too long , Copy by yourself encrypt_data Paste here "
decrypt_data = s(encrypt_data)In this code , function o It's not defined yet , function o Definition and function of s(e) In the peer Directory , Turn up and you will see , Put function o Copy it all , Put it into our own structure js Go to the code :

function o When it's done , It's just `a.a.decode(e)` Parameters , Make breakpoints in the following places :
And click the single step debugging button , You will see the following function :

Copy all the functions , Put our structure into js In the code .
5. completion js Running environment
Pass step 4 , We have constructed js file , adopt node The environment runs this js file , You will find the following errors :
ReferenceError: f is not defined
at Module._compile (internal/modules/cjs/loader.js:1085:14)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1114:10)
at Module.load (internal/modules/cjs/loader.js:950:32)
at Function.Module._load (internal/modules/cjs/loader.js:790:14)
at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:76:12)
at internal/main/run_main_module.js:17:47Tips f Undefined , Through error reporting , We are positioned to f stay decode Called in function :

And we can find the definition f The place of , as follows :

f Is a constant value , completion f after , Run again js Code , The following errors are found :
ReferenceError: c is not defined
at Module._compile (internal/modules/cjs/loader.js:1085:14)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1114:10)
at Module.load (internal/modules/cjs/loader.js:950:32)
at Function.Module._load (internal/modules/cjs/loader.js:790:14)
at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:76:12)
at internal/main/run_main_module.js:17:47Tips c Undefined , And defining f On top of , You can find c Statement of . completion c after , Run again js Code , Normal results :

6. summary
The website is still relatively simple , It is more suitable for novices to practice their hands , For preliminary understanding of the reverse process .
ps: Last , The source code of this project has been submitted to GitHub in , Self access if required .
边栏推荐
- Excel fast l count the number of red data in all lines [commonly used in teaching]
- 微信内H5页面唤起小程序&App
- JMeter 21天打卡 day02
- QT实现哈希表动态演示
- JMeter 21 day clock in day04
- JMeter 21 day clock in day02
- Hi guys, I would like to ask why startupoptions in MySQL CDC only supports initi
- Leetcode - add two numbers
- 用户登录
- 018. A shielding sensitive vocabulary made by proxy mode knot and filter
猜你喜欢
随机推荐
Q3 QmainWindow 状态栏 铆接部件 核心部件
Matlab底层源代码实现Halcon scale_image_max算子效果
360 released semi annual performance forecast, and the revenue of security business continued to grow
JMeter 21 天打卡 day03
034. Code rollback reset current branch to here
Q5 dialog box (modal and modeless)
【有用的SQL】查Greenplum的数据字典
Software testing? Monthly salary 20K +? I can't automate the test. It's really hard for me
C语言实现贪吃蛇
This is the most detailed arrangement of the basic knowledge of network workers in the whole network, and there is no one
001层次选择器
Learning of SVM (I)
Analysis of technical design details dynamically displayed or hidden by SAP Fiori application adapt UI
Important - Im open source project openim about version management and v2.3.0 release plan
DBPack 读写分离功能发布公告
Q5 standard dialog box
Working sql: it is required that the average number of awards cannot be displayed by ranking
GCC rust is approved to be included in the mainline code base, or will meet you in GCC 13
018. A shielding sensitive vocabulary made by proxy mode knot and filter
Go1.18 upgrade function - Generic | go language from scratch









