目标网站:http://glidedsky.com/level/web/crawler-javascript-obfuscation-1
既然叫js加密,那么打开源代码看看,果然没有这些数字。
然后抱着试试心态,来个省时省力操作在左边搜索框搜索,哟吼.......发现了,还是个xhr文件,恩不错
打开它在底部发现page,t,sign
虽然才学js逆向一个月不到,那还是能分辨出page应该就是页了,t就是时间戳,sign就是密文。
接下来就是找加密位置,刚好它又是个xhr,可以用xhr断点
首先在最上方url处随意复制:cation-1/items?pag
再如图1,2,添加完xhr断点后,刷新,会出现如图3,那是个调用栈,可以进行追踪。
然后就往下点点啊点点啊点
嗯?有p,t,sign,应该就这里了,在往下点看看,
嗯..这里应该就是加密后的代码,好,回到上面,打断点,去掉原先的xhr断点,刷新,果然停住了。
然后点击下一步,嗯 ,不错,p=1,下一步,t=1587370827,下一步,原来是传入了一个固定字符串加时间戳,鼠标悬停在sha1,然后进入函数内部,在黄行处。
观察发现这个js里就一个函数,不管了,整体复制到编辑器里,在传入参数:如下
!function() { "use strict"; function t(t) { t ? (f[0] = f[16] = f[1] = f[2] = f[3] = f[4] = f[5] = f[6] = f[7] = f[8] = f[9] = f[10] = f[11] = f[12] = f[13] = f[14] = f[15] = 0, this.blocks = f) : this.blocks = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], this.h0 = 1732584193, this.h1 = 4023233417, this.h2 = 2562383102, this.h3 = 271733878, this.h4 = 3285377520, this.block = this.start = this.bytes = this.hBytes = 0, this.finalized = this.hashed = !1, this.first = !0 } var h = "object" == typeof window ? window : {} , s = !h.JS_SHA1_NO_NODE_JS && "object" == typeof process && process.versions && process.versions.node; s && (h = global); var i = !h.JS_SHA1_NO_COMMON_JS && "object" == typeof module && module.exports , e = "function" == typeof define && define.amd , r = "0123456789abcdef".split("") , o = [-2147483648, 8388608, 32768, 128] , n = [24, 16, 8, 0] , a = ["hex", "array", "digest", "arrayBuffer"] , f = [] , u = function(h) { return function(s) { return new t(!0).update(s)[h]() } } , c = function() { var h = u("hex"); s && (h = p(h)), h.create = function() { return new t } , h.update = function(t) { return h.create().update(t) } ; for (var i = 0; i < a.length; ++i) { var e = a[i]; h[e] = u(e) } return h } , p = function(t) { var h = eval("require('crypto')") , s = eval("require('buffer').Buffer") , i = function(i) { if ("string" == typeof i) return h.createHash("sha1").update(i, "utf8").digest("hex"); if (i.constructor === ArrayBuffer) i = new Uint8Array(i); else if (void 0 === i.length) return t(i); return h.createHash("sha1").update(new s(i)).digest("hex") }; return i }; t.prototype.update = function(t) { if (!this.finalized) { var s = "string" != typeof t; s && t.constructor === h.ArrayBuffer && (t = new Uint8Array(t)); for (var i, e, r = 0, o = t.length || 0, a = this.blocks; r < o; ) { if (this.hashed && (this.hashed = !1, a[0] = this.block, a[16] = a[1] = a[2] = a[3] = a[4] = a[5] = a[6] = a[7] = a[8] = a[9] = a[10] = a[11] = a[12] = a[13] = a[14] = a[15] = 0), s) for (e = this.start; r < o && e < 64; ++r) a[e >> 2] |= t[r] << n[3 & e++]; else for (e = this.start; r < o && e < 64; ++r) (i = t.charCodeAt(r)) < 128 ? a[e >> 2] |= i << n[3 & e++] : i < 2048 ? (a[e >> 2] |= (192 | i >> 6) << n[3 & e++], a[e >> 2] |= (128 | 63 & i) << n[3 & e++]) : i < 55296 || i >= 57344 ? (a[e >> 2] |= (224 | i >> 12) << n[3 & e++], a[e >> 2] |= (128 | i >> 6 & 63) << n[3 & e++], a[e >> 2] |= (128 | 63 & i) << n[3 & e++]) : (i = 65536 + ((1023 & i) << 10 | 1023 & t.charCodeAt(++r)), a[e >> 2] |= (240 | i >> 18) << n[3 & e++], a[e >> 2] |= (128 | i >> 12 & 63) << n[3 & e++], a[e >> 2] |= (128 | i >> 6 & 63) << n[3 & e++], a[e >> 2] |= (128 | 63 & i) << n[3 & e++]); this.lastByteIndex = e, this.bytes += e - this.start, e >= 64 ? (this.block = a[16], this.start = e - 64, this.hash(), this.hashed = !0) : this.start = e } return this.bytes > 4294967295 && (this.hBytes += this.bytes / 4294967296 << 0, this.bytes = this.bytes % 4294967296), this } } , t.prototype.finalize = function() { if (!this.finalized) { this.finalized = !0; var t = this.blocks , h = this.lastByteIndex; t[16] = this.block, t[h >> 2] |= o[3 & h], this.block = t[16], h >= 56 && (this.hashed || this.hash(), t[0] = this.block, t[16] = t[1] = t[2] = t[3] = t[4] = t[5] = t[6] = t[7] = t[8] = t[9] = t[10] = t[11] = t[12] = t[13] = t[14] = t[15] = 0), t[14] = this.hBytes << 3 | this.bytes >>> 29, t[15] = this.bytes << 3, this.hash() } } , t.prototype.hash = function() { var t, h, s = this.h0, i = this.h1, e = this.h2, r = this.h3, o = this.h4, n = this.blocks; for (t = 16; t < 80; ++t) h = n[t - 3] ^ n[t - 8] ^ n[t - 14] ^ n[t - 16], n[t] = h << 1 | h >>> 31; for (t = 0; t < 20; t += 5) s = (h = (i = (h = (e = (h = (r = (h = (o = (h = s << 5 | s >>> 27) + (i & e | ~i & r) + o + 1518500249 + n[t] << 0) << 5 | o >>> 27) + (s & (i = i << 30 | i >>> 2) | ~s & e) + r + 1518500249 + n[t + 1] << 0) << 5 | r >>> 27) + (o & (s = s << 30 | s >>> 2) | ~o & i) + e + 1518500249 + n[t + 2] << 0) << 5 | e >>> 27) + (r & (o = o << 30 | o >>> 2) | ~r & s) + i + 1518500249 + n[t + 3] << 0) << 5 | i >>> 27) + (e & (r = r << 30 | r >>> 2) | ~e & o) + s + 1518500249 + n[t + 4] << 0, e = e << 30 | e >>> 2; for (; t < 40; t += 5) s = (h = (i = (h = (e = (h = (r = (h = (o = (h = s << 5 | s >>> 27) + (i ^ e ^ r) + o + 1859775393 + n[t] << 0) << 5 | o >>> 27) + (s ^ (i = i << 30 | i >>> 2) ^ e) + r + 1859775393 + n[t + 1] << 0) << 5 | r >>> 27) + (o ^ (s = s << 30 | s >>> 2) ^ i) + e + 1859775393 + n[t + 2] << 0) << 5 | e >>> 27) + (r ^ (o = o << 30 | o >>> 2) ^ s) + i + 1859775393 + n[t + 3] << 0) << 5 | i >>> 27) + (e ^ (r = r << 30 | r >>> 2) ^ o) + s + 1859775393 + n[t + 4] << 0, e = e << 30 | e >>> 2; for (; t < 60; t += 5) s = (h = (i = (h = (e = (h = (r = (h = (o = (h = s << 5 | s >>> 27) + (i & e | i & r | e & r) + o - 1894007588 + n[t] << 0) << 5 | o >>> 27) + (s & (i = i << 30 | i >>> 2) | s & e | i & e) + r - 1894007588 + n[t + 1] << 0) << 5 | r >>> 27) + (o & (s = s << 30 | s >>> 2) | o & i | s & i) + e - 1894007588 + n[t + 2] << 0) << 5 | e >>> 27) + (r & (o = o << 30 | o >>> 2) | r & s | o & s) + i - 1894007588 + n[t + 3] << 0) << 5 | i >>> 27) + (e & (r = r << 30 | r >>> 2) | e & o | r & o) + s - 1894007588 + n[t + 4] << 0, e = e << 30 | e >>> 2; for (; t < 80; t += 5) s = (h = (i = (h = (e = (h = (r = (h = (o = (h = s << 5 | s >>> 27) + (i ^ e ^ r) + o - 899497514 + n[t] << 0) << 5 | o >>> 27) + (s ^ (i = i << 30 | i >>> 2) ^ e) + r - 899497514 + n[t + 1] << 0) << 5 | r >>> 27) + (o ^ (s = s << 30 | s >>> 2) ^ i) + e - 899497514 + n[t + 2] << 0) << 5 | e >>> 27) + (r ^ (o = o << 30 | o >>> 2) ^ s) + i - 899497514 + n[t + 3] << 0) << 5 | i >>> 27) + (e ^ (r = r << 30 | r >>> 2) ^ o) + s - 899497514 + n[t + 4] << 0, e = e << 30 | e >>> 2; this.h0 = this.h0 + s << 0, this.h1 = this.h1 + i << 0, this.h2 = this.h2 + e << 0, this.h3 = this.h3 + r << 0, this.h4 = this.h4 + o << 0 } , t.prototype.hex = function() { this.finalize(); var t = this.h0 , h = this.h1 , s = this.h2 , i = this.h3 , e = this.h4; return r[t >> 28 & 15] + r[t >> 24 & 15] + r[t >> 20 & 15] + r[t >> 16 & 15] + r[t >> 12 & 15] + r[t >> 8 & 15] + r[t >> 4 & 15] + r[15 & t] + r[h >> 28 & 15] + r[h >> 24 & 15] + r[h >> 20 & 15] + r[h >> 16 & 15] + r[h >> 12 & 15] + r[h >> 8 & 15] + r[h >> 4 & 15] + r[15 & h] + r[s >> 28 & 15] + r[s >> 24 & 15] + r[s >> 20 & 15] + r[s >> 16 & 15] + r[s >> 12 & 15] + r[s >> 8 & 15] + r[s >> 4 & 15] + r[15 & s] + r[i >> 28 & 15] + r[i >> 24 & 15] + r[i >> 20 & 15] + r[i >> 16 & 15] + r[i >> 12 & 15] + r[i >> 8 & 15] + r[i >> 4 & 15] + r[15 & i] + r[e >> 28 & 15] + r[e >> 24 & 15] + r[e >> 20 & 15] + r[e >> 16 & 15] + r[e >> 12 & 15] + r[e >> 8 & 15] + r[e >> 4 & 15] + r[15 & e] } , t.prototype.toString = t.prototype.hex, t.prototype.digest = function() { this.finalize(); var t = this.h0 , h = this.h1 , s = this.h2 , i = this.h3 , e = this.h4; return [t >> 24 & 255, t >> 16 & 255, t >> 8 & 255, 255 & t, h >> 24 & 255, h >> 16 & 255, h >> 8 & 255, 255 & h, s >> 24 & 255, s >> 16 & 255, s >> 8 & 255, 255 & s, i >> 24 & 255, i >> 16 & 255, i >> 8 & 255, 255 & i, e >> 24 & 255, e >> 16 & 255, e >> 8 & 255, 255 & e] } , t.prototype.array = t.prototype.digest, t.prototype.arrayBuffer = function() { this.finalize(); var t = new ArrayBuffer(20) , h = new DataView(t); return h.setUint32(0, this.h0), h.setUint32(4, this.h1), h.setUint32(8, this.h2), h.setUint32(12, this.h3), h.setUint32(16, this.h4), t } ; var y = c(); i ? module.exports = y : (h.sha1 = y, e && define(function() { return y })) }(); var t = '1587370827' let sign = sha1('Xr0Z-javascript-obfuscation-1' + t); console.log(sign)
然后运行,竟然报错了,ReferenceError: sha1 is not defined,突然发现末尾处和之前做过的一个md5加密案例很像,于是加上了
global.sha1 = y,如下:
var y = c();
global.sha1 = y
i ? module.exports = y : (h.sha1 = y,
e && define(function() { return y
然后运行,嗯....没毛病。这时突然想到既然是sha1加密,是不是可以用CryptoJS呢?心动不如行动。
var CryptoJS = require('crypto-js') var value = 'Xr0Z-javascript-obfuscation-11587370827' let hash = CryptoJS.SHA1(value) console.log(hash.toString())
果然加密结果是一模一样,嗯,不错。
这时又突然想到,python有md5加密,那是否有sha1加密?心动不如行动。
import hashlib value = 'Xr0Z-javascript-obfuscation-11587370827' print(hashlib.sha1(value.encode(encoding='UTF-8')).hexdigest())
果然加密结果是一模一样,嗯,不错。
到这里,程序框架已然成型
程序有待补充...........