声明：本文只作学习研究，禁止用于非法用途，否则后果自负，如有侵权，请告知删除，谢谢！(手动狗头)
login_url:aHR0cDovL3d3dy54aW5zaGFuZ21lbmcuY29tL3hzbTIvP1ZlcnNpb249MjAyMjA5MTAwMA==
1.发送请求查看载荷数据
jsonp: jQuery9990791993491979402_1690199057250 # jQuery9990791993491979402 是固定的值 后面的是一个时间戳 protocol: http: # 固定的 loginIndex: http://www.xinshangmeng.com/xsm2/?Version=2022091000 # 固定的 j_mmrm: 123456 # 账号 j_mcmm: 3216b822d1c5efd9a9245d9d105b8ad7 # 加密密码 j_valcode: # 验证码 _: 1690199702218 # 时间戳
2.寻找加密入口
可以发现请求头并没有加密的参数,我们直接来到调用堆栈
ajax已经开始发送请求了，所以咱先来到c.login看看，参数是不是已经生成了
果然不出我所料，传过来的a已经生成了,继续往前找
发现在g这里就出现了，g又是在哪里出来的呢？咱别急，往上看看，有没有定义
瞧瞧，多么美的代码，没有混淆清清楚楚，咱要搞的密码（j_mcmm就是个b)（没有藏话哦)，b = F(F(b) + c);
废话不多说，咱直接自己构建
3.逆向加密js 代码
可以把代码扣过来 jiayanmd5.js 后修改 下代码 新增个 get_pwd 函数给Python调用
如图，b是密码、c是验证码，别问我咋知道的，问就是猜的
function pwd_encrypt(pwd,c){
return F(F(pwd) + c);
}
F呢？简简单单，直接来到调用处
发现是小d函数下的return，盲猜md5,现在咱缺n、e、o、m，what？缺那么多，怎么那么麻烦
知道你很急，但你先别急，咱先来到m处
来到了，怎么了？往上翻翻
艹，搞错了，咱还没定位到F，这傻了吧唧的开发者工具给咱引到错误的地方了，先回去
好，就当啥也没发生，咱现在定位到这里了，看看m
芜湖，多么美好的代码，看到n了吗？看到m了吗？不够，再往前看看，wc,咱要的都有了，那还客气啥，直接拿来吧你
function e(a, b) {
for (var c = 1732584193, d = -271733879, e = -1732584194, f = 271733878, l = 0; l < a.length; l += 16) {
var m = c
, n = d
, o = e
, p = f;
c = g(c, d, e, f, a[l + 0], 7, -680876936),
f = g(f, c, d, e, a[l + 1], 12, -389564586),
e = g(e, f, c, d, a[l + 2], 17, 606105819),
d = g(d, e, f, c, a[l + 3], 22, -1044525330),
c = g(c, d, e, f, a[l + 4], 7, -176418897),
f = g(f, c, d, e, a[l + 5], 12, 1200080426),
e = g(e, f, c, d, a[l + 6], 17, -1473231341),
d = g(d, e, f, c, a[l + 7], 22, -45705983),
c = g(c, d, e, f, a[l + 8], 7, 1770035416),
f = g(f, c, d, e, a[l + 9], 12, -1958414417),
e = g(e, f, c, d, a[l + 10], 17, -42063),
d = g(d, e, f, c, a[l + 11], 22, -1990404162),
c = g(c, d, e, f, a[l + 12], 7, 1804603682),
f = g(f, c, d, e, a[l + 13], 12, -40341101),
e = g(e, f, c, d, a[l + 14], 17, -1502002290),
d = g(d, e, f, c, a[l + 15], 22, 1236535329),
c = h(c, d, e, f, a[l + 1], 5, -165796510),
f = h(f, c, d, e, a[l + 6], 9, -1069501632),
e = h(e, f, c, d, a[l + 11], 14, 643717713),
d = h(d, e, f, c, a[l + 0], 20, -373897302),
c = h(c, d, e, f, a[l + 5], 5, -701558691),
f = h(f, c, d, e, a[l + 10], 9, 38016083),
e = h(e, f, c, d, a[l + 15], 14, -660478335),
d = h(d, e, f, c, a[l + 4], 20, -405537848),
c = h(c, d, e, f, a[l + 9], 5, 568446438),
f = h(f, c, d, e, a[l + 14], 9, -1019803690),
e = h(e, f, c, d, a[l + 3], 14, -187363961),
d = h(d, e, f, c, a[l + 8], 20, 1163531501),
c = h(c, d, e, f, a[l + 13], 5, -1444681467),
f = h(f, c, d, e, a[l + 2], 9, -51403784),
e = h(e, f, c, d, a[l + 7], 14, 1735328473),
d = h(d, e, f, c, a[l + 12], 20, -1926607734),
c = i(c, d, e, f, a[l + 5], 4, -378558),
f = i(f, c, d, e, a[l + 8], 11, -2022574463),
e = i(e, f, c, d, a[l + 11], 16, 1839030562),
d = i(d, e, f, c, a[l + 14], 23, -35309556),
c = i(c, d, e, f, a[l + 1], 4, -1530992060),
f = i(f, c, d, e, a[l + 4], 11, 1272893353),
e = i(e, f, c, d, a[l + 7], 16, -155497632),
d = i(d, e, f, c, a[l + 10], 23, -1094730640),
c = i(c, d, e, f, a[l + 13], 4, 681279174),
f = i(f, c, d, e, a[l + 0], 11, -358537222),
e = i(e, f, c, d, a[l + 3], 16, -722521979),
d = i(d, e, f, c, a[l + 6], 23, 76029189),
c = i(c, d, e, f, a[l + 9], 4, -640364487),
f = i(f, c, d, e, a[l + 12], 11, -421815835),
e = i(e, f, c, d, a[l + 15], 16, 530742520),
d = i(d, e, f, c, a[l + 2], 23, -995338651),
c = j(c, d, e, f, a[l + 0], 6, -198630844),
f = j(f, c, d, e, a[l + 7], 10, 1126891415),
e = j(e, f, c, d, a[l + 14], 15, -1416354905),
d = j(d, e, f, c, a[l + 5], 21, -57434055),
c = j(c, d, e, f, a[l + 12], 6, 1700485571),
f = j(f, c, d, e, a[l + 3], 10, -1894986606),
e = j(e, f, c, d, a[l + 10], 15, -1051523),
d = j(d, e, f, c, a[l + 1], 21, -2054922799),
c = j(c, d, e, f, a[l + 8], 6, 1873313359),
f = j(f, c, d, e, a[l + 15], 10, -30611744),
e = j(e, f, c, d, a[l + 6], 15, -1560198380),
d = j(d, e, f, c, a[l + 13], 21, 1309151649),
c = j(c, d, e, f, a[l + 4], 6, -145523070),
f = j(f, c, d, e, a[l + 11], 10, -1120210379),
e = j(e, f, c, d, a[l + 2], 15, 718787259),
d = j(d, e, f, c, a[l + 9], 21, -343485551),
c = k(c, m),
d = k(d, n),
e = k(e, o),
f = k(f, p)
}
return new Array(c,d,e,f)
}
function f(a, b, c, d, e, f) {
return k(l(k(k(b, a), k(d, f)), e), c)
}
function g(a, b, c, d, e, g, h) {
return f(b & c | ~b & d, a, b, e, g, h)
}
function h(a, b, c, d, e, g, h) {
return f(b & d | c & ~d, a, b, e, g, h)
}
function i(a, b, c, d, e, g, h) {
return f(b ^ c ^ d, a, b, e, g, h)
}
function j(a, b, c, d, e, g, h) {
return f(c ^ (b | ~d), a, b, e, g, h)
}
function k(a, b) {
var c = (65535 & a) + (65535 & b);
return (a >> 16) + (b >> 16) + (c >> 16) << 16 | 65535 & c
}
function l(a, b) {
return a << b | a >>> 32 - b
}
function m(a) {
for (var b = a.length, c = new Array(b), d = 0; d < b; d++) {
var e = a.charCodeAt(d);
c[d] = 255 & e
}
return c
}
function n(a) {
for (var b = "0123456789abcdef", c = "", d = 0; d < 4 * a.length; d++)
c += b.charAt(a[d >> 2] >> d % 4 * 8 + 4 & 15) + b.charAt(a[d >> 2] >> d % 4 * 8 & 15);
return c
}
function o(a) {
for (var b = 1 + (a.length + 8 >> 6), c = new Array(16 * b), d = 0; d < 16 * b; d++)
c[d] = 0;
for (var e = 0; e < a.length; e++)
c[e >> 2] |= (255 & a[e]) << e % 4 * 8;
return c[e >> 2] |= 128 << e % 4 * 8,
c[16 * b - 2] = 8 * a.length,
c
}
function F(a) {
return n(e(o(m(a + "{1#2$3%4(5)6@7!poeeww$3%4(5)djjkkldss}")), 32))
}
function pwd_encrypt(pwd,c){
return F(F(pwd) + c);
}
爽
话不多说，去python
4.编写脚本发送请求 main.py
提醒一下：咱要的验证码必须携带cookie，不然你懂的
# -*- coding: utf-8 -*-
'''
@IDE : PyCharm
@version : 3.9
@Auth : gouzi
@time : 2023/10/4 19:29
@Description:
'''
import requests
import time
import execjs
from ddddocr import DdddOcr
from urllib import parse
headers = {
"Accept": "*/*",
"Accept-Language": "zh-CN,zh;q=0.9",
"Cache-Control": "no-cache",
"Connection": "keep-alive",
"Pragma": "no-cache",
"Referer": "http://www.xinshangmeng.com/",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47",
#'Cookie':"lgroute=37897cdb34141b89a2b26344df7aa38e; JSESSIONID=C1D15945AE16A6679BB228559F9C7013"
}
# 发送请求获取验证码
def get_code():
ocr = DdddOcr()
code_url = 'http://login.xinshangmeng.com/login/users/forlogin/img?width=80&height=30&{}'.format(int(time.time() * 1000))
code_content = requests.get(code_url,headers=headers).content
with open('code.png', 'wb') as fp:
fp.write(code_content)
validcode = ocr.classification(code_content)
print('验证码识别:',validcode)
return validcode
def login(validcode):
url = "http://login.xinshangmeng.com/login/users/dologin/dfaup"
pwd = "123456"
username = '123456'
with open('data.js', 'r', encoding='utf8') as f:
js = execjs.compile(f.read())
pwd_md5_encrypt = js.call('pwd_encrypt', pwd , validcode)
print(pwd_md5_encrypt)
params = {
"jsonp": "jQuery99907133298365500631_{}".format(int(time.time() * 1000)),
"protocol": "http:",
"loginIndex": "http://www.xinshangmeng.com/xsm2/?Version=2022091000",
"j_mmrm": username,
"j_mcmm": pwd_md5_encrypt,
"j_valcode": validcode,
"_": str(int(time.time() * 1000))
}
response = requests.get(url, headers=headers, params=params, verify=False).text
print(parse.unquote(response))#要将url编码过的进行解码,不然是乱码，看的心烦
def main():
validcode = get_code()
login(validcode)
main()运行结果:
上面是我特意没带cookie失败案例，再给你们看看
好吧，被封了，你们自己拿去测测吧。
难度等级：简单
总结：
按照登录流程查找加密的入口 ,然后查看加密流程 扣代码 ,在根据请求流程获取验证码 带入 密码 和验证码二次加密.因为我的IP被限制了所以该案例自行测试。嗯，就这样，拜拜
896
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
