2021-07-15

最新推荐文章于 2024-05-20 22:54:06 发布

孤影啸苍天

最新推荐文章于 2024-05-20 22:54:06 发布

阅读量626

点赞数

文章标签： python

本文链接：https://blog.csdn.net/weixin_44183483/article/details/118760038

版权

某马小程序数据获取

抓包分析

打开小程序点击列表页页面通过fildder进行抓包，我用的事root过的手机，也可以虚拟机但是我没有尝试。通过抓包可以直接看到发送的数据和返回的数据，看一下历史请求发现，没有授权登录！没有授权登录！没有授权登录！！！
在这里插入图片描述
图1 令牌请求

图2 分类请求

图3 列表页请求

url分析

从图2 可以看出是get请求的url特别长，先格式化一下看看都有那些东西。

# 原始列表页url
https://acs.m.****.cn/h5/mtop.wdk.***.classify.queryclassifyitems/1.0/2.0/?jsv=2.4.12&appKey=12574478&t=1626332752550&sign=dde47c2d42910ea27b35c89174331ebd&c=d538a7401d2fb0d21a9e852d1aa52788_1626332732918%3B2b831ad9457214ac74b10bd096b2e879&needRetry=true&needLink2Login=true&api=mtop.wdk.youxuan.classify.queryclassifyitems&mock=mtop.wdk.youxuan.classify.queryclassifyitems&v=1.0&type=originaljson&ttid=wap_SG_HMYX_H5%40yxwxhmxs_iPhone_4.51.0&dataType=json&data=%7B%22channelSource%22%3A%22wechat%22%2C%22channelScenarioGroup%22%3A%22HEMA_YOUXUAN%22%2C%22channelTerminal%22%3A%22hmyx_wx_applet%22%2C%22shopIds%22%3A%22391132051%22%2C%22catId%22%3A%22acti_6748599%22%2C%22catIds%22%3A%22%5B%7B%5C%22catId%5C%22%3A%5C%22acti_6748599%5C%22%2C%5C%22catTemplateId%5C%22%3A298%2C%5C%22categoryType%5C%22%3A3%2C%5C%22displayProperties%5C%22%3A%5C%220%5C%22%2C%5C%22enableOrder%5C%22%3A%5C%220%5C%22%2C%5C%22extend%5C%22%3A%7B%5C%22hasInventoryItemCount%5C%22%3A1109%2C%5C%22virtual%5C%22%3Atrue%2C%5C%22noInventoryItemCount%5C%22%3A1007%2C%5C%22hasInventoryItemCountStrategy%5C%22%3A%5C%22AICfDB%5C%22%2C%5C%22noInventoryItemCountStrategy%5C%22%3Anull%7D%2C%5C%22firstCatId%5C%22%3A%5C%22acti_6748596%5C%22%2C%5C%22isIgraph%5C%22%3A%5C%220%5C%22%2C%5C%22itemCount%5C%22%3A1109%2C%5C%22noInventoryItemCount%5C%22%3A1007%2C%5C%22orgCode%5C%22%3A%5C%22HMYXHB%5C%22%2C%5C%22parentCatId%5C%22%3A%5C%22acti_6748599%5C%22%2C%5C%22ruleIds%5C%22%3A%5B%5D%2C%5C%22ruleWeight%5C%22%3A0%2C%5C%22tags%5C%22%3A%5C%22%E7%88%86%5C%22%2C%5C%22title%5C%22%3A%5C%22%E8%94%AC%E8%8F%9C%E8%B1%86%E5%93%81%5C%22%2C%5C%22totalItemCount%5C%22%3A2116%7D%5D%22%2C%22pagination%22%3A%22-1-2126-1%22%2C%22mockMtop%22%3Atrue%2C%22needProperties%22%3A0%2C%22needFullPageSize%22%3Atrue%2C%22isNOInventory%22%3Atrue%2C%22renderChannelCode%22%3A%22SG_WX_APPLETS%22%2C%22source%22%3A%22wechat%22%2C%22scenarioGroup%22%3A%22HEMA_YOUXUAN%22%2C%22terminal%22%3A%22hmyx_wx_applet%22%2C%22channelCode%22%3A%22SG_WX_APPLETS%22%7D

# 格式化列表页请求参数
jsv=2.4.12&
appKey=12574478&
t=1626332752550&
sign=dde47c2d42910ea27b35c89174331ebd&
c=d538a7401d2fb0d21a9e852d1aa52788_1626332732918%3B2b831ad9457214ac74b10bd096b2e879&
needRetry=true&
needLink2Login=true&
api=mtop.wdk.youxuan.classify.queryclassifyitems&
mock=mtop.wdk.youxuan.classify.queryclassifyitems&
v=1.0&
type=originaljson&
ttid=wap_SG_HMYX_H5%40yxwxhmxs_iPhone_4.51.0&
dataType=json&
data=%7B%22channelSource%22%3A%22wechat%22%2C%22channelScenarioGroup%22%3A%22HEMA_YOUXUAN%22%2C%22channelTerminal%22%3A%22hmyx_wx_applet%22%2C%22shopIds%22%3A%22391132051%22%2C%22catId%22%3A%22acti_6748599%22%2C%22catIds%22%3A%22%5B%7B%5C%22catId%5C%22%3A%5C%22acti_6748599%5C%22%2C%5C%22catTemplateId%5C%22%3A298%2C%5C%22categoryType%5C%22%3A3%2C%5C%22displayProperties%5C%22%3A%5C%220%5C%22%2C%5C%22enableOrder%5C%22%3A%5C%220%5C%22%2C%5C%22extend%5C%22%3A%7B%5C%22hasInventoryItemCount%5C%22%3A1109%2C%5C%22virtual%5C%22%3Atrue%2C%5C%22noInventoryItemCount%5C%22%3A1007%2C%5C%22hasInventoryItemCountStrategy%5C%22%3A%5C%22AICfDB%5C%22%2C%5C%22noInventoryItemCountStrategy%5C%22%3Anull%7D%2C%5C%22firstCatId%5C%22%3A%5C%22acti_6748596%5C%22%2C%5C%22isIgraph%5C%22%3A%5C%220%5C%22%2C%5C%22itemCount%5C%22%3A1109%2C%5C%22noInventoryItemCount%5C%22%3A1007%2C%5C%22orgCode%5C%22%3A%5C%22HMYXHB%5C%22%2C%5C%22parentCatId%5C%22%3A%5C%22acti_6748599%5C%22%2C%5C%22ruleIds%5C%22%3A%5B%5D%2C%5C%22ruleWeight%5C%22%3A0%2C%5C%22tags%5C%22%3A%5C%22%E7%88%86%5C%22%2C%5C%22title%5C%22%3A%5C%22%E8%94%AC%E8%8F%9C%E8%B1%86%E5%93%81%5C%22%2C%5C%22totalItemCount%5C%22%3A2116%7D%5D%22%2C%22pagination%22%3A%22-1-2126-1%22%2C%22mockMtop%22%3Atrue%2C%22needProperties%22%3A0%2C%22needFullPageSize%22%3Atrue%2C%22isNOInventory%22%3Atrue%2C%22renderChannelCode%22%3A%22SG_WX_APPLETS%22%2C%22source%22%3A%22wechat%22%2C%22scenarioGroup%22%3A%22HEMA_YOUXUAN%22%2C%22terminal%22%3A%22hmyx_wx_applet%22%2C%22channelCode%22%3A%22SG_WX_APPLETS%22%7D

# data 参数是通过rul加密后的，解密后内容
{"channelSource":"wechat",
"channelScenarioGroup":"HEMA_YOUXUAN",
"channelTerminal":"hmyx_wx_applet",
"shopIds":"391132051",
"catId":"acti_6748599",
"catIds":"[
	{\"catId\":\"acti_6748599\",
	\"catTemplateId\":298,
	\"categoryType\":3,
	\"displayProperties\":\"0\",
	\"enableOrder\":\"0\",
	\"extend\":{\"hasInventoryItemCount\":1109,
		\"virtual\":true,
		\"noInventoryItemCount\":1007,
		\"hasInventoryItemCountStrategy\":\"AICfDB\",
		\"noInventoryItemCountStrategy\":null},
	\"firstCatId\":\"acti_6748596\",
	\"isIgraph\":\"0\",
	\"itemCount\":1109,
	\"noInventoryItemCount\":1007,
	\"orgCode\":\"HMYXHB\",
	\"parentCatId\":\"acti_6748599\",
	\"ruleIds\":[],
	\"ruleWeight\":0,
	\"tags\":\"爆\",
	\"title\":\"蔬菜豆品\",
	\"totalItemCount\":2116}
	]",
"pagination":"-1-2126-1",
"mockMtop":true,
"needProperties":0,
"needFullPageSize":true,
"isNOInventory":true,
"renderChannelCode":"SG_WX_APPLETS",
"source":"wechat",
"scenarioGroup":"HEMA_YOUXUAN",
"terminal":"hmyx_wx_applet",
"channelCode":"SG_WX_APPLETS"}

多抓几个包分析后发现大部分参数都是不变的，变动的也就t、sign、data 这三个参数，t显而易见是一个时间戳，sign签名-对于我这种菜鸟只能去翻代码了，data里面的内容是分类，也就是图二返回过来的数据，还有一个不变的参数c 这个是令牌是图1 请求后端直接返回的。
所以现在要解决的就是签名。那么就拿到代码去看签名是怎么生成的。

小程序代码分析

在已经root过的手机上安装RE文件管理器，并授权，打开目录 /data/data/com.tencent.mm/MicromMsg/c6dxxxxxxxxxxxxx/appbrand/pkg/*.wxapkg
将所有的加密包都拿到电脑上，怎么搞都行我是压缩后用qq发送到电脑上的，
然后使用wxappUnpacker进行小程序源码反编译，这个软件网上有好多，如果找不着联系我给你发也行，反正我也不怎看信息，
反编译之后使用微信开发者工具打开，如下图4
这里有一个授权问题没有解决，这个不是登录授权应该是反编译后代码逻辑出现了问题
在这里插入图片描述
图4 反编译后运行结果

通过阅读代码可以看到，这里就是sign的加密方法如图5
在这里插入图片描述图5 sign 加密方法

完整代码如下

 u.sign = function(e) {
	  function t(e, t) {
	       return e << t | e >>> 32 - t;
	   }
	   function n(e, t) {
	       var n, r, a, o, i;
	       return a = 2147483648 & e, o = 2147483648 & t, i = (1073741823 & e) + (1073741823 & t), 
	       (n = 1073741824 & e) & (r = 1073741824 & t) ? 2147483648 ^ i ^ a ^ o : n | r ? 1073741824 & i ? 3221225472 ^ i ^ a ^ o : 1073741824 ^ i ^ a ^ o : i ^ a ^ o;
	   }
	   function r(e, r, a, o, i, c, s) {
	       return e = n(e, n(n(function(e, t, n) {
	           return e & t | ~e & n;
	       }(r, a, o), i), s)), n(t(e, c), r);
	   }
	   function a(e, r, a, o, i, c, s) {
	       return e = n(e, n(n(function(e, t, n) {
	           return e & n | t & ~n;
	       }(r, a, o), i), s)), n(t(e, c), r);
	   }
	   function o(e, r, a, o, i, c, s) {
	       return e = n(e, n(n(function(e, t, n) {
	           return e ^ t ^ n;
	       }(r, a, o), i), s)), n(t(e, c), r);
	   }
	   function i(e, r, a, o, i, c, s) {
	       return e = n(e, n(n(function(e, t, n) {
	           return t ^ (e | ~n);
	       }(r, a, o), i), s)), n(t(e, c), r);
	   }
	   function c(e) {
	       var t, n = "", r = "";
	       for (t = 0; t <= 3; t++) n += (r = "0" + (e >>> 8 * t & 255).toString(16)).substr(r.length - 2, 2);
	       return n;
	   }
	   var s, u, l, f, p, d, m, h, v, g;
	   for (s = function(e) {
	       for (var t, n = e.length, r = n + 8, a = 16 * ((r - r % 64) / 64 + 1), o = new Array(a - 1), i = 0, c = 0; c < n; ) i = c % 4 * 8, 
	       o[t = (c - c % 4) / 4] = o[t] | e.charCodeAt(c) << i, c++;
	       return i = c % 4 * 8, o[t = (c - c % 4) / 4] = o[t] | 128 << i, o[a - 2] = n << 3, 
	       o[a - 1] = n >>> 29, o;
	   }(e = function(e) {
	       e = e.replace(/\r\n/g, "\n");
	       for (var t = "", n = 0; n < e.length; n++) {
	           var r = e.charCodeAt(n);
	           r < 128 ? t += String.fromCharCode(r) : r > 127 && r < 2048 ? (t += String.fromCharCode(r >> 6 | 192), 
	           t += String.fromCharCode(63 & r | 128)) : (t += String.fromCharCode(r >> 12 | 224), 
	           t += String.fromCharCode(r >> 6 & 63 | 128), t += String.fromCharCode(63 & r | 128));
	       }
	       return t;
	   }(e)), m = 1732584193, h = 4023233417, v = 2562383102, g = 271733878, u = 0; u < s.length; u += 16) l = m, 
	   f = h, p = v, d = g, m = r(m, h, v, g, s[u + 0], 7, 3614090360), g = r(g, m, h, v, s[u + 1], 12, 3905402710), 
	   v = r(v, g, m, h, s[u + 2], 17, 606105819), h = r(h, v, g, m, s[u + 3], 22, 3250441966), 
	   m = r(m, h, v, g, s[u + 4], 7, 4118548399), g = r(g, m, h, v, s[u + 5], 12, 1200080426), 
	   v = r(v, g, m, h, s[u + 6], 17, 2821735955), h = r(h, v, g, m, s[u + 7], 22, 4249261313), 
	   m = r(m, h, v, g, s[u + 8], 7, 1770035416), g = r(g, m, h, v, s[u + 9], 12, 2336552879), 
	   v = r(v, g, m, h, s[u + 10], 17, 4294925233), h = r(h, v, g, m, s[u + 11], 22, 2304563134), 
	   m = r(m, h, v, g, s[u + 12], 7, 1804603682), g = r(g, m, h, v, s[u + 13], 12, 4254626195), 
	   v = r(v, g, m, h, s[u + 14], 17, 2792965006), m = a(m, h = r(h, v, g, m, s[u + 15], 22, 1236535329), v, g, s[u + 1], 5, 4129170786), 
	   g = a(g, m, h, v, s[u + 6], 9, 3225465664), v = a(v, g, m, h, s[u + 11], 14, 643717713), 
	   h = a(h, v, g, m, s[u + 0], 20, 3921069994), m = a(m, h, v, g, s[u + 5], 5, 3593408605), 
	   g = a(g, m, h, v, s[u + 10], 9, 38016083), v = a(v, g, m, h, s[u + 15], 14, 3634488961), 
	   h = a(h, v, g, m, s[u + 4], 20, 3889429448), m = a(m, h, v, g, s[u + 9], 5, 568446438), 
	   g = a(g, m, h, v, s[u + 14], 9, 3275163606), v = a(v, g, m, h, s[u + 3], 14, 4107603335), 
	   h = a(h, v, g, m, s[u + 8], 20, 1163531501), m = a(m, h, v, g, s[u + 13], 5, 2850285829), 
	   g = a(g, m, h, v, s[u + 2], 9, 4243563512), v = a(v, g, m, h, s[u + 7], 14, 1735328473), 
	   m = o(m, h = a(h, v, g, m, s[u + 12], 20, 2368359562), v, g, s[u + 5], 4, 4294588738), 
	   g = o(g, m, h, v, s[u + 8], 11, 2272392833), v = o(v, g, m, h, s[u + 11], 16, 1839030562), 
	   h = o(h, v, g, m, s[u + 14], 23, 4259657740), m = o(m, h, v, g, s[u + 1], 4, 2763975236), 
	   g = o(g, m, h, v, s[u + 4], 11, 1272893353), v = o(v, g, m, h, s[u + 7], 16, 4139469664), 
	   h = o(h, v, g, m, s[u + 10], 23, 3200236656), m = o(m, h, v, g, s[u + 13], 4, 681279174), 
	   g = o(g, m, h, v, s[u + 0], 11, 3936430074), v = o(v, g, m, h, s[u + 3], 16, 3572445317), 
	   h = o(h, v, g, m, s[u + 6], 23, 76029189), m = o(m, h, v, g, s[u + 9], 4, 3654602809), 
	   g = o(g, m, h, v, s[u + 12], 11, 3873151461), v = o(v, g, m, h, s[u + 15], 16, 530742520), 
	   m = i(m, h = o(h, v, g, m, s[u + 2], 23, 3299628645), v, g, s[u + 0], 6, 4096336452), 
	   g = i(g, m, h, v, s[u + 7], 10, 1126891415), v = i(v, g, m, h, s[u + 14], 15, 2878612391), 
	   h = i(h, v, g, m, s[u + 5], 21, 4237533241), m = i(m, h, v, g, s[u + 12], 6, 1700485571), 
	   g = i(g, m, h, v, s[u + 3], 10, 2399980690), v = i(v, g, m, h, s[u + 10], 15, 4293915773), 
	   h = i(h, v, g, m, s[u + 1], 21, 2240044497), m = i(m, h, v, g, s[u + 8], 6, 1873313359), 
	   g = i(g, m, h, v, s[u + 15], 10, 4264355552), v = i(v, g, m, h, s[u + 6], 15, 2734768916), 
	   h = i(h, v, g, m, s[u + 13], 21, 1309151649), m = i(m, h, v, g, s[u + 4], 6, 4149444226), 
	   g = i(g, m, h, v, s[u + 11], 10, 3174756917), v = i(v, g, m, h, s[u + 2], 15, 718787259), 
	   h = i(h, v, g, m, s[u + 9], 21, 3951481745), m = n(m, l), h = n(h, f), v = n(v, p), 
	   g = n(g, d);
	   return (c(m) + c(h) + c(v) + c(g)).toLowerCase();
	}(r.token + "&" + s + "&" + i + "&" + n.data)

可以看到这里是一个js加密方法，将这个方法放在本地用python代码执行一下js 就可以返回加密后的内容了。
这里面有三个四个参数调试看一下里面都是什么

r.token ：是一个空 - 这就是为什么我的开发者工具打不开的原因这里授权没有放进token中。
s：是url中的参数t 时间戳
i ：是url中的 appKey 是固定的
n.data ：是url中的data

这样参数中只有一个token 还不知道是什么，继续扣代码发现图6 继续找c 是什么见图7
在这里插入图片描述
图6 获取token代码

图7 c 函数定义

可以看出这这里是从内存中取出来的。所以看看他是怎么放进内存中的。继续扣代码图8
在这里插入图片描述
根据图6 和图8 代码大胆猜测，小心验证后可以知道 token就是 url参数中的c ，也就是图1 中请求返回的令牌经过切割后的第一串字符串"d538a7401d2fb0d21a9e852d1aa52788"
经过大胆猜测，小心验证后发现那一长串js加密是md5，

最终实现

这样最终代码就是 – 我就不放代码了，少点风险，逻辑都在这里，直接requets 就能得到结果了，不过中间有一个比较坑的就是空格的问题还有反斜杠的问题，问题都不大。

以上内容只供交流学习，切勿用于商业用途，如有违反，后果自负。如有权益问题请联系qq：1349037675删除，谢谢。

孤影啸苍天

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
2021-07-15

某马小程序数据获取抓包分析url分析小程序代码分析最终实现抓包分析打开小程序点击列表页页面通过fildder进行抓包，我用的事root过的手机，也可以虚拟机但是我没有尝试。通过抓包可以直接看到发送的数据和返回的数据，看一下历史请求发现，没有授权登录！没有授权登录！没有授权登录！！！图1 令牌请求图2 分类请求图3 列表页请求url分析从图2 可以看出是get请求的url特别长，先格式化一下看看都有那些东西。# 原始列表页urlhttps://acs.m.****.cn/h5/mt
复制链接

扫一扫