js逆向：rpc远程调用

websocket  python代码： 

#服务端，先开启这个
import asyncio
import websockets

connected = set()


async def server(websocket):
    connected.add(websocket)
    try:
        async for message in websocket:
            for conn in connected:
                if conn != websocket:
                    await conn.send(message)
    finally:
        connected.remove(websocket)


start_server = websockets.serve(server, "localhost", 8888)
asyncio.get_event_loop().run_until_complete(start_server)
asyncio.get_event_loop().run_forever()

#客户端，调用rpc例子
import asyncio
import websockets

loop = asyncio.get_event_loop()


async def hello(message):
    # 连接 websocket 并发送消息 获取相应
    async with websockets.connect("ws://localhost:8888") as websocket:
        await websocket.send(message)
        return await websocket.recv()


def get_encrypt(message):
    return str(loop.run_until_complete(hello(message)))


if __name__ == "__main__":
    print(get_encrypt(str("1234565")))

值得注意的一点是，需要替换到本地注入的js代码

例子：这里用rsa加密为例

//自执行函数
!(function () {
    window.test = f;
    var ws = new WebSocket('ws://127.0.0.1:8888');
    ws.onopen = function (evt) {
        console.log('Connection open ...');
    };
    ws.onmessage = function (evt) {
        console.log(evt.data)
        console.log(window.test.encrypt([me.servertime, me.nonce].join("\t") + "\n" + evt.data))
        ws.send(window.test.encrypt([me.servertime, me.nonce].join("\t") + "\n" + evt.data))
    };
    ws.onclose = function (evt) {
        console.log("closed")
    };
})();

1.一般来说开启的顺序是，服务端python代码，然后是浏览器中的js代码（调试一下），最后可以按照客户端模式调用rpc加密接口。

2.js本地替换，先下断点测试一下，然后右键js代码保存以备替代，最后单独测试一下，如果下断点没走，说明断点没找对，建议用alert()测试一下。