测评几大js加密站的加密质量(3)

1.简介

​ 公司网站的接口经常被爬虫爬,时不时就导致服务器压力过大,白白消耗公司服务器资源。于是开始接触js加密这块的业务。发现了不少支持js在线加密的站,以及各种加密方案,在这做个笔记,一一列举各大加密站的优缺点。看看哪种才是最安全的html代码加密方式。

2.加密探索

​ 最开始在网络上搜索js加密,看到了很多解决方案,例如crypto、base64、MD5、sha1、sha256、unicode编码、AES/DES、RSA都是优秀的js加密算法,但是最终我发现,这些加密都是在前端完成的,也就是在用户电脑上完成的,完全透明化的,所以爬虫作者破解难度也很低,他不需要去摸索你这个算法计算的过程,他只要拿到你相同的加密算法代码,就可以通过同样的手段加密出来,继而盗取接口信息。

3.工具介绍

Sojson支持js的不可逆混淆加密,和很多高级的加密配置,还增加了小白专用的一键配置常规配置,和禁控制台调试输出、A级保护、变量方法全混淆等诸多高级配置,很多细节做的不错。查了一下资历,这家站13年创建的,搞了快有十个年头了,是个老品牌。接下来我们做个demo加密一下试试,以下加密,除了基本配置,我还勾选了方法函数变量全部重命名。

4.js案例代码
(function () {
    String.prototype.searchAB = function (){
        return this.match(/[^A|B]/g);
    }
    const str = '本工具由 wwBw.jsjiami.cAom 提供接口。\n专注JS安全领域近10年\n企业化运营\n专业的JS加密研发团队。'.searchAB().toString().replaceAll(',', '');
    alert(str);
    console.log(str);
}());
5.经过Sojson加密后
/*
 * 加密工具已经升级了一个版本,目前为 jsjiami.com.v5 ,主要加强了算法,以及防破解【绝对不可逆】配置,耶稣也无法100%还原,我说的。;
 * 已经打算把这个工具基础功能一直免费下去。还希望支持我。
 * 另外 jsjiami.com.v5 已经强制加入校验,注释可以去掉,但是 jsjiami.com.v5 不能去掉(如果你开通了VIP,可以手动去掉),其他都没有任何绑定。
 * 誓死不会加入任何后门,jsjiami.com JS 加密的使命就是为了保护你们的Javascript 。
 * 警告:如果您恶意去掉 jsjiami.com.v5 那么我们将不会保护您的JavaScript代码。请遵守规则
 * 新版本: https://www.jsjiami.com/ 支持批量加密,支持大文件加密,拥有更多加密。 */
 
;var encode_version = 'jsjiami.com.v5', aoveg = '__0xeb218',  __0xeb218=['54mt5p2G5Yye77+5IS3kv5Llr5zmnLjlvYbnqJ7vvYDovI7or6Xml5Pmj4vmiI7kupHnmqXltbDkv50=','BMKReQ==','wpgkecKkdQ==','RhBiw7bCuw==','woFvacOrDQ==','5p6C5bWn5YSE55WXZXjDhSPDpVdHwp3ChhvDnMO/w73CscOZE8O7BsOB5o2+5Lyx5o2h5Y6R44ORb+S7m+azsSJR5a+K5Yaq6aKB5Z2u6Ly4A8OX5bqkw4PkvJPkurvlj6PovITok7LDsuS7oeS4hOeapSjCluWKq+Wtl+ehlOWPmeWagumZnOOAtg==','e8OtNMOWS8KYw4lRwrw=','E8O/Q0LDpQ==','w7gRwol2wrM=','wqoGwpw0wpnChsKZYg==','bgBaw6LCtMOzwqDDk1XDuQ==','woNyf1nChA==','E3NL','w7UQwow=','wrRoQMKJXR3DjsKKWQ==','TxnCg8KcKjPCoWhEEMOkYsKgJw==','wrI9Gg==','wqrDjcK6','5Yiz6ZuD54ml5p2w5Y6y77+8wqPDq+S8leWsoeacseW9seeokw==','M8OpdGfDgw==','BMKBc8KSGA==','JcODH8KswqI=','w5Ibw6kzAQ==','w5F8QMK0w6s=','wqjDlcKPaW8=','OsKBaMKRwoA='];(function(_0x104565,_0x3c3110){var _0xe5012c=function(_0x311857){while(--_0x311857){_0x104565['push'](_0x104565['shift']());}};_0xe5012c(++_0x3c3110);}(__0xeb218,0x6d));var _0x3f28=function(_0x231fd0,_0x4f680a){_0x231fd0=_0x231fd0-0x0;var _0x5b4826=__0xeb218[_0x231fd0];if(_0x3f28['initialized']===undefined){(function(){var _0x550fbc=typeof window!=='undefined'?window:typeof process==='object'&&typeof require==='function'&&typeof global==='object'?global:this;var _0x18d5c9='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0x550fbc['atob']||(_0x550fbc['atob']=function(_0x4ce2f1){var _0x333808=String(_0x4ce2f1)['replace'](/=+$/,'');for(var _0x432180=0x0,_0x2ab90b,_0x991246,_0x981158=0x0,_0x57b080='';_0x991246=_0x333808['charAt'](_0x981158++);~_0x991246&&(_0x2ab90b=_0x432180%0x4?_0x2ab90b*0x40+_0x991246:_0x991246,_0x432180++%0x4)?_0x57b080+=String['fromCharCode'](0xff&_0x2ab90b>>(-0x2*_0x432180&0x6)):0x0){_0x991246=_0x18d5c9['indexOf'](_0x991246);}return _0x57b080;});}());var _0x219af0=function(_0x441e3a,_0x2cc193){var _0x5f41ea=[],_0x503809=0x0,_0xe42b77,_0x56465b='',_0x52cace='';_0x441e3a=atob(_0x441e3a);for(var _0x39753a=0x0,_0xf81284=_0x441e3a['length'];_0x39753a<_0xf81284;_0x39753a++){_0x52cace+='%'+('00'+_0x441e3a['charCodeAt'](_0x39753a)['toString'](0x10))['slice'](-0x2);}_0x441e3a=decodeURIComponent(_0x52cace);for(var _0x307b3e=0x0;_0x307b3e<0x100;_0x307b3e++){_0x5f41ea[_0x307b3e]=_0x307b3e;}for(_0x307b3e=0x0;_0x307b3e<0x100;_0x307b3e++){_0x503809=(_0x503809+_0x5f41ea[_0x307b3e]+_0x2cc193['charCodeAt'](_0x307b3e%_0x2cc193['length']))%0x100;_0xe42b77=_0x5f41ea[_0x307b3e];_0x5f41ea[_0x307b3e]=_0x5f41ea[_0x503809];_0x5f41ea[_0x503809]=_0xe42b77;}_0x307b3e=0x0;_0x503809=0x0;for(var _0x3ab53f=0x0;_0x3ab53f<_0x441e3a['length'];_0x3ab53f++){_0x307b3e=(_0x307b3e+0x1)%0x100;_0x503809=(_0x503809+_0x5f41ea[_0x307b3e])%0x100;_0xe42b77=_0x5f41ea[_0x307b3e];_0x5f41ea[_0x307b3e]=_0x5f41ea[_0x503809];_0x5f41ea[_0x503809]=_0xe42b77;_0x56465b+=String['fromCharCode'](_0x441e3a['charCodeAt'](_0x3ab53f)^_0x5f41ea[(_0x5f41ea[_0x307b3e]+_0x5f41ea[_0x503809])%0x100]);}return _0x56465b;};_0x3f28['rc4']=_0x219af0;_0x3f28['data']={};_0x3f28['initialized']=!![];}var _0xfeb75b=_0x3f28['data'][_0x231fd0];if(_0xfeb75b===undefined){if(_0x3f28['once']===undefined){_0x3f28['once']=!![];}_0x5b4826=_0x3f28['rc4'](_0x5b4826,_0x4f680a);_0x3f28['data'][_0x231fd0]=_0x5b4826;}else{_0x5b4826=_0xfeb75b;}return _0x5b4826;};(function(){var _0x51ca65={'zfcaT':_0x3f28('0x0','utdG'),'yIOxN':function _0x5e1682(_0xc8f5a3,_0x3eeb2a){return _0xc8f5a3(_0x3eeb2a);}};String[_0x3f28('0x1','*4dD')]['searchAB']=function(){return this[_0x3f28('0x2','HY[j')](/[^A|B]/g);};const _0x443d66=_0x51ca65[_0x3f28('0x3','UvGD')]['searchAB']()[_0x3f28('0x4','^1Wj')]()[_0x3f28('0x5','b)dh')](',','');_0x51ca65[_0x3f28('0x6','57Mq')](alert,_0x443d66);console[_0x3f28('0x7','L@A#')](_0x443d66);}());;(function(_0x25294e,_0x4b28ed,_0x23e1ad){var _0x306eb6={'cTziY':_0x3f28('0x8','9b2u'),'MwCFN':function _0x3934fb(_0x58f1e0,_0x47a748){return _0x58f1e0!==_0x47a748;},'ZlecP':_0x3f28('0x9','[H2q'),'vnTmH':_0x3f28('0xa','h4hX'),'vubId':function _0x57d6b5(_0x526c42,_0x2f0ce6){return _0x526c42!==_0x2f0ce6;},'ebTrQ':_0x3f28('0xb','Rusa'),'ZuHxn':'版本号,js会定期弹窗,还请支持我们的工作','hvkTq':function _0x1feda9(_0x123602,_0x126847){return _0x123602!==_0x126847;},'qZugo':function _0x3bfcab(_0x75fc32,_0x5a0410){return _0x75fc32===_0x5a0410;},'mYCQK':function _0x43657f(_0x12ea6b,_0x482a3c){return _0x12ea6b+_0x482a3c;},'Masgs':function _0x5e166e(_0x37744e,_0x464172){return _0x37744e===_0x464172;},'Zkiry':_0x3f28('0xc','kzwQ'),'ZDrsf':function _0x4670c0(_0x437455,_0x41038e){return _0x437455+_0x41038e;},'pYULy':_0x3f28('0xd','7&K@')};_0x23e1ad='al';try{_0x23e1ad+=_0x306eb6['cTziY'];_0x4b28ed=encode_version;if(!(_0x306eb6[_0x3f28('0xe','HY[j')](typeof _0x4b28ed,_0x306eb6[_0x3f28('0xf','oZC$')])&&_0x4b28ed===_0x306eb6['vnTmH'])){if(_0x306eb6['vubId'](_0x306eb6[_0x3f28('0x10','h&*k')],'nuU')){_0x25294e[_0x23e1ad]('删除'+_0x306eb6[_0x3f28('0x11','$0E%')]);}else{_0x23e1ad+=_0x306eb6[_0x3f28('0x12','NVu)')];_0x4b28ed=encode_version;if(!(_0x306eb6['hvkTq'](typeof _0x4b28ed,_0x306eb6[_0x3f28('0x13','kzwQ')])&&_0x306eb6['qZugo'](_0x4b28ed,'jsjiami.com.v5'))){_0x25294e[_0x23e1ad](_0x306eb6[_0x3f28('0x14','cOs@')]('删除',_0x3f28('0x15','h4hX')));}}}}catch(_0x1a8b3c){if(_0x306eb6['Masgs'](_0x306eb6['Zkiry'],_0x3f28('0x16','cOs@'))){_0x25294e[_0x23e1ad](_0x306eb6[_0x3f28('0x17','ht3S')]('删除',_0x306eb6[_0x3f28('0x18','b)dh')]));}else{_0x25294e[_0x23e1ad](_0x306eb6[_0x3f28('0x19','n4i$')]);}}}(window));;encode_version = 'jsjiami.com.v5';
6.格式化一下,把注释清理掉。
;var encode_version = 'jsjiami.com.v5', aoveg = '__0xeb218',
    __0xeb218 = ['54mt5p2G5Yye77+5IS3kv5Llr5zmnLjlvYbnqJ7vvYDovI7or6Xml5Pmj4vmiI7kupHnmqXltbDkv50=', 'BMKReQ==', 'wpgkecKkdQ==', 'RhBiw7bCuw==', 'woFvacOrDQ==', '5p6C5bWn5YSE55WXZXjDhSPDpVdHwp3ChhvDnMO/w73CscOZE8O7BsOB5o2+5Lyx5o2h5Y6R44ORb+S7m+azsSJR5a+K5Yaq6aKB5Z2u6Ly4A8OX5bqkw4PkvJPkurvlj6PovITok7LDsuS7oeS4hOeapSjCluWKq+Wtl+ehlOWPmeWagumZnOOAtg==', 'e8OtNMOWS8KYw4lRwrw=', 'E8O/Q0LDpQ==', 'w7gRwol2wrM=', 'wqoGwpw0wpnChsKZYg==', 'bgBaw6LCtMOzwqDDk1XDuQ==', 'woNyf1nChA==', 'E3NL', 'w7UQwow=', 'wrRoQMKJXR3DjsKKWQ==', 'TxnCg8KcKjPCoWhEEMOkYsKgJw==', 'wrI9Gg==', 'wqrDjcK6', '5Yiz6ZuD54ml5p2w5Y6y77+8wqPDq+S8leWsoeacseW9seeokw==', 'M8OpdGfDgw==', 'BMKBc8KSGA==', 'JcODH8KswqI=', 'w5Ibw6kzAQ==', 'w5F8QMK0w6s=', 'wqjDlcKPaW8=', 'OsKBaMKRwoA='];
(function (_0x104565, _0x3c3110) {
    var _0xe5012c = function (_0x311857) {
        while (--_0x311857) {
            _0x104565['push'](_0x104565['shift']());
        }
    };
    _0xe5012c(++_0x3c3110);
}(__0xeb218, 0x6d));
var _0x3f28 = function (_0x231fd0, _0x4f680a) {
    _0x231fd0 = _0x231fd0 - 0x0;
    var _0x5b4826 = __0xeb218[_0x231fd0];
    if (_0x3f28['initialized'] === undefined) {
        (function () {
            var _0x550fbc = typeof window !== 'undefined' ? window : typeof process === 'object' && typeof require === 'function' && typeof global === 'object' ? global : this;
            var _0x18d5c9 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
            _0x550fbc['atob'] || (_0x550fbc['atob'] = function (_0x4ce2f1) {
                var _0x333808 = String(_0x4ce2f1)['replace'](/=+$/, '');
                for (var _0x432180 = 0x0, _0x2ab90b, _0x991246, _0x981158 = 0x0, _0x57b080 = ''; _0x991246 = _0x333808['charAt'](_0x981158++); ~_0x991246 && (_0x2ab90b = _0x432180 % 0x4 ? _0x2ab90b * 0x40 + _0x991246 : _0x991246, _0x432180++ % 0x4) ? _0x57b080 += String['fromCharCode'](0xff & _0x2ab90b >> (-0x2 * _0x432180 & 0x6)) : 0x0) {
                    _0x991246 = _0x18d5c9['indexOf'](_0x991246);
                }
                return _0x57b080;
            });
        }());
        var _0x219af0 = function (_0x441e3a, _0x2cc193) {
            var _0x5f41ea = [], _0x503809 = 0x0, _0xe42b77, _0x56465b = '', _0x52cace = '';
            _0x441e3a = atob(_0x441e3a);
            for (var _0x39753a = 0x0, _0xf81284 = _0x441e3a['length']; _0x39753a < _0xf81284; _0x39753a++) {
                _0x52cace += '%' + ('00' + _0x441e3a['charCodeAt'](_0x39753a)['toString'](0x10))['slice'](-0x2);
            }
            _0x441e3a = decodeURIComponent(_0x52cace);
            for (var _0x307b3e = 0x0; _0x307b3e < 0x100; _0x307b3e++) {
                _0x5f41ea[_0x307b3e] = _0x307b3e;
            }
            for (_0x307b3e = 0x0; _0x307b3e < 0x100; _0x307b3e++) {
                _0x503809 = (_0x503809 + _0x5f41ea[_0x307b3e] + _0x2cc193['charCodeAt'](_0x307b3e % _0x2cc193['length'])) % 0x100;
                _0xe42b77 = _0x5f41ea[_0x307b3e];
                _0x5f41ea[_0x307b3e] = _0x5f41ea[_0x503809];
                _0x5f41ea[_0x503809] = _0xe42b77;
            }
            _0x307b3e = 0x0;
            _0x503809 = 0x0;
            for (var _0x3ab53f = 0x0; _0x3ab53f < _0x441e3a['length']; _0x3ab53f++) {
                _0x307b3e = (_0x307b3e + 0x1) % 0x100;
                _0x503809 = (_0x503809 + _0x5f41ea[_0x307b3e]) % 0x100;
                _0xe42b77 = _0x5f41ea[_0x307b3e];
                _0x5f41ea[_0x307b3e] = _0x5f41ea[_0x503809];
                _0x5f41ea[_0x503809] = _0xe42b77;
                _0x56465b += String['fromCharCode'](_0x441e3a['charCodeAt'](_0x3ab53f) ^ _0x5f41ea[(_0x5f41ea[_0x307b3e] + _0x5f41ea[_0x503809]) % 0x100]);
            }
            return _0x56465b;
        };
        _0x3f28['rc4'] = _0x219af0;
        _0x3f28['data'] = {};
        _0x3f28['initialized'] = !![];
    }
    var _0xfeb75b = _0x3f28['data'][_0x231fd0];
    if (_0xfeb75b === undefined) {
        if (_0x3f28['once'] === undefined) {
            _0x3f28['once'] = !![];
        }
        _0x5b4826 = _0x3f28['rc4'](_0x5b4826, _0x4f680a);
        _0x3f28['data'][_0x231fd0] = _0x5b4826;
    } else {
        _0x5b4826 = _0xfeb75b;
    }
    return _0x5b4826;
};
(function () {
    var _0x51ca65 = {
        'zfcaT': _0x3f28('0x0', 'utdG'), 'yIOxN': function _0x5e1682(_0xc8f5a3, _0x3eeb2a) {
            return _0xc8f5a3(_0x3eeb2a);
        }
    };
    String[_0x3f28('0x1', '*4dD')]['searchAB'] = function () {
        return this[_0x3f28('0x2', 'HY[j')](/[^A|B]/g);
    };
    const _0x443d66 = _0x51ca65[_0x3f28('0x3', 'UvGD')]['searchAB']()[_0x3f28('0x4', '^1Wj')]()[_0x3f28('0x5', 'b)dh')](',', '');
    _0x51ca65[_0x3f28('0x6', '57Mq')](alert, _0x443d66);
    console[_0x3f28('0x7', 'L@A#')](_0x443d66);
}());
;(function (_0x25294e, _0x4b28ed, _0x23e1ad) {
    var _0x306eb6 = {
        'cTziY': _0x3f28('0x8', '9b2u'),
        'MwCFN': function _0x3934fb(_0x58f1e0, _0x47a748) {
            return _0x58f1e0 !== _0x47a748;
        },
        'ZlecP': _0x3f28('0x9', '[H2q'),
        'vnTmH': _0x3f28('0xa', 'h4hX'),
        'vubId': function _0x57d6b5(_0x526c42, _0x2f0ce6) {
            return _0x526c42 !== _0x2f0ce6;
        },
        'ebTrQ': _0x3f28('0xb', 'Rusa'),
        'ZuHxn': '版本号,js会定期弹窗,还请支持我们的工作',
        'hvkTq': function _0x1feda9(_0x123602, _0x126847) {
            return _0x123602 !== _0x126847;
        },
        'qZugo': function _0x3bfcab(_0x75fc32, _0x5a0410) {
            return _0x75fc32 === _0x5a0410;
        },
        'mYCQK': function _0x43657f(_0x12ea6b, _0x482a3c) {
            return _0x12ea6b + _0x482a3c;
        },
        'Masgs': function _0x5e166e(_0x37744e, _0x464172) {
            return _0x37744e === _0x464172;
        },
        'Zkiry': _0x3f28('0xc', 'kzwQ'),
        'ZDrsf': function _0x4670c0(_0x437455, _0x41038e) {
            return _0x437455 + _0x41038e;
        },
        'pYULy': _0x3f28('0xd', '7&K@')
    };
    _0x23e1ad = 'al';
    try {
        _0x23e1ad += _0x306eb6['cTziY'];
        _0x4b28ed = encode_version;
        if (!(_0x306eb6[_0x3f28('0xe', 'HY[j')](typeof _0x4b28ed, _0x306eb6[_0x3f28('0xf', 'oZC$')]) && _0x4b28ed === _0x306eb6['vnTmH'])) {
            if (_0x306eb6['vubId'](_0x306eb6[_0x3f28('0x10', 'h&*k')], 'nuU')) {
                _0x25294e[_0x23e1ad]('删除' + _0x306eb6[_0x3f28('0x11', '$0E%')]);
            } else {
                _0x23e1ad += _0x306eb6[_0x3f28('0x12', 'NVu)')];
                _0x4b28ed = encode_version;
                if (!(_0x306eb6['hvkTq'](typeof _0x4b28ed, _0x306eb6[_0x3f28('0x13', 'kzwQ')]) && _0x306eb6['qZugo'](_0x4b28ed, 'jsjiami.com.v5'))) {
                    _0x25294e[_0x23e1ad](_0x306eb6[_0x3f28('0x14', 'cOs@')]('删除', _0x3f28('0x15', 'h4hX')));
                }
            }
        }
    } catch (_0x1a8b3c) {
        if (_0x306eb6['Masgs'](_0x306eb6['Zkiry'], _0x3f28('0x16', 'cOs@'))) {
            _0x25294e[_0x23e1ad](_0x306eb6[_0x3f28('0x17', 'ht3S')]('删除', _0x306eb6[_0x3f28('0x18', 'b)dh')]));
        } else {
            _0x25294e[_0x23e1ad](_0x306eb6[_0x3f28('0x19', 'n4i$')]);
        }
    }
}(window));
encode_version = 'jsjiami.com.v5';
    
7.加密后分析

​ 说实话,看到加密后的代码,第一眼人是崩溃的,没看到啥有用的信息。所有方法和变量都混淆了。格式化后我们从头开始看起。首先是变量**__0xeb218**,存的是一个数组,和上篇讲到的那个加密一样,但是这里把里边的值都加密过了,初步看格式是进行了一个Base64编码。然后下方第二个方法对上边的数组做了元素位置的调换。然后第二个看起来是个加密函数,因为我们知道自己的源码是什么,找到了自己的alert和console代码,还有我们自己写的一个正则,发现有两处一模一样的。

这个加密让我给评分的话 我给8分

1.加密把函数名变量名全加密了,破解的人看到的第一眼心态已经麻了

2.代码方法中层层镶嵌的调用,别有用心的人破解起来比较烧脑

3.连参数值都要给他混淆一下,简直是惨无人道

基本上用这个sojson.v5加密的话,可以挡住所有白嫖党了,再也不用担心代码被白嫖了。

sojson.v6

sojson.com
在这里插入图片描述

在这里插入图片描述

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值