【js逆向tips】- wxgz平台登录验证

0. 写在最前

• 现在很多时候我们再网页上进行操作时都是用http协议进行一个交流，前端后也是如此，现在的开发模式大部分都是前后端分离的一个交互模式，那就意味着前端发送请求时也是和我们点击按钮一样去向后端发送一个请求，那这种请求就可以被模拟。 甚至是被一些自动化程序模拟以达到批量获取数据的目的。
• 因此为了防止被程序模拟，前端一般都会设置加密函数对正常用户在浏览器传来的数据进行加密，然后后端也会有一样的加密函数进行加密然后进行对比，即反爬虫技术，这些函数一般都设置在复杂的js代码里面，让破密者难以模拟复现
• 而js逆向要做的就是就是复现这些前端加密代码，然后伪装成正常用户与后端程序沟通以拿到返回体的正常的数据
• 此专栏是记录以下一些破解的有意思的验证，仅仅用作学习为目的，绝不会有任何盈利，如果损害到了网站开发者的利益，请立即联系我进行删除，本人邮箱:zh00612@126.com

1. 分析

按照惯例我们都是输入一些账号密码去尝试一下，可以发现这个登录验证在发送post请求的时候在前端只对密码做了加密，我们去找找它是这么加密的。

2. 找加密函数

我们在右上角找到search按钮，输入pwd，找到.js文件

找到加密函数，点进去定义

可以看到这里有一个函数，我们只要复现就可以，这里类似于三目表达式，可以看到我们可以只输入e这个函数

3. 代码复现

function l(e, t) {
    var n = (65535 & e) + (65535 & t);
    return (e >> 16) + (t >> 16) + (n >> 16) << 16 | 65535 & n
}
function a(e, t, n, o, r, i) {
    return l((t = l(l(t, e), l(o, i))) << r | t >>> 32 - r, n)
}
function p(e, t, n, o, r, i, s) {
    return a(t & n | ~t & o, e, t, r, i, s)
}
function f(e, t, n, o, r, i, s) {
    return a(t & o | n & ~o, e, t, r, i, s)
}
function m(e, t, n, o, r, i, s) {
    return a(t ^ n ^ o, e, t, r, i, s)
}
function g(e, t, n, o, r, i, s) {
    return a(n ^ (t | ~o), e, t, r, i, s)
}
function s(e, t) {
    e[t >> 5] |= 128 << t % 32,
        e[14 + (t + 64 >>> 9 << 4)] = t;
    for (var n, o, r, d, i = 1732584193, s = -271733879, a = -1732584194, c = 271733878, u = 0; u < e.length; u += 16)
        i = p(n = i, o = s, r = a, d = c, e[u], 7, -680876936),
            c = p(c, i, s, a, e[u + 1], 12, -389564586),
            a = p(a, c, i, s, e[u + 2], 17, 606105819),
            s = p(s, a, c, i, e[u + 3], 22, -1044525330),
            i = p(i, s, a, c, e[u + 4], 7, -176418897),
            c = p(c, i, s, a, e[u + 5], 12, 1200080426),
            a = p(a, c, i, s, e[u + 6], 17, -1473231341),
            s = p(s, a, c, i, e[u + 7], 22, -45705983),
            i = p(i, s, a, c, e[u + 8], 7, 1770035416),
            c = p(c, i, s, a, e[u + 9], 12, -1958414417),
            a = p(a, c, i, s, e[u + 10], 17, -42063),
            s = p(s, a, c, i, e[u + 11], 22, -1990404162),
            i = p(i, s, a, c, e[u + 12], 7, 1804603682),
            c = p(c, i, s, a, e[u + 13], 12, -40341101),
            a = p(a, c, i, s, e[u + 14], 17, -1502002290),
            i = f(i, s = p(s, a, c, i, e[u + 15], 22, 1236535329), a, c, e[u + 1], 5, -165796510),
            c = f(c, i, s, a, e[u + 6], 9, -1069501632),
            a = f(a, c, i, s, e[u + 11], 14, 643717713),
            s = f(s, a, c, i, e[u], 20, -373897302),
            i = f(i, s, a, c, e[u + 5], 5, -701558691),
            c = f(c, i, s, a, e[u + 10], 9, 38016083),
            a = f(a, c, i, s, e[u + 15], 14, -660478335),
            s = f(s, a, c, i, e[u + 4], 20, -405537848),
            i = f(i, s, a, c, e[u + 9], 5, 568446438),
            c = f(c, i, s, a, e[u + 14], 9, -1019803690),
            a = f(a, c, i, s, e[u + 3], 14, -187363961),
            s = f(s, a, c, i, e[u + 8], 20, 1163531501),
            i = f(i, s, a, c, e[u + 13], 5, -1444681467),
            c = f(c, i, s, a, e[u + 2], 9, -51403784),
            a = f(a, c, i, s, e[u + 7], 14, 1735328473),
            i = m(i, s = f(s, a, c, i, e[u + 12], 20, -1926607734), a, c, e[u + 5], 4, -378558),
            c = m(c, i, s, a, e[u + 8], 11, -2022574463),
            a = m(a, c, i, s, e[u + 11], 16, 1839030562),
            s = m(s, a, c, i, e[u + 14], 23, -35309556),
            i = m(i, s, a, c, e[u + 1], 4, -1530992060),
            c = m(c, i, s, a, e[u + 4], 11, 1272893353),
            a = m(a, c, i, s, e[u + 7], 16, -155497632),
            s = m(s, a, c, i, e[u + 10], 23, -1094730640),
            i = m(i, s, a, c, e[u + 13], 4, 681279174),
            c = m(c, i, s, a, e[u], 11, -358537222),
            a = m(a, c, i, s, e[u + 3], 16, -722521979),
            s = m(s, a, c, i, e[u + 6], 23, 76029189),
            i = m(i, s, a, c, e[u + 9], 4, -640364487),
            c = m(c, i, s, a, e[u + 12], 11, -421815835),
            a = m(a, c, i, s, e[u + 15], 16, 530742520),
            i = g(i, s = m(s, a, c, i, e[u + 2], 23, -995338651), a, c, e[u], 6, -198630844),
            c = g(c, i, s, a, e[u + 7], 10, 1126891415),
            a = g(a, c, i, s, e[u + 14], 15, -1416354905),
            s = g(s, a, c, i, e[u + 5], 21, -57434055),
            i = g(i, s, a, c, e[u + 12], 6, 1700485571),
            c = g(c, i, s, a, e[u + 3], 10, -1894986606),
            a = g(a, c, i, s, e[u + 10], 15, -1051523),
            s = g(s, a, c, i, e[u + 1], 21, -2054922799),
            i = g(i, s, a, c, e[u + 8], 6, 1873313359),
            c = g(c, i, s, a, e[u + 15], 10, -30611744),
            a = g(a, c, i, s, e[u + 6], 15, -1560198380),
            s = g(s, a, c, i, e[u + 13], 21, 1309151649),
            i = g(i, s, a, c, e[u + 4], 6, -145523070),
            c = g(c, i, s, a, e[u + 11], 10, -1120210379),
            a = g(a, c, i, s, e[u + 2], 15, 718787259),
            s = g(s, a, c, i, e[u + 9], 21, -343485551),
            i = l(i, n),
            s = l(s, o),
            a = l(a, r),
            c = l(c, d);
    return [i, s, a, c]
}
function c(e) {
    for (var t = "", n = 0; n < 32 * e.length; n += 8)
        t += String.fromCharCode(e[n >> 5] >>> n % 32 & 255);
    return t
}
function u(e) {
    var t, n = [];
    for (n[(e.length >> 2) - 1] = void 0,
             t = 0; t < n.length; t += 1)
        n[t] = 0;
    for (t = 0; t < 8 * e.length; t += 8)
        n[t >> 5] |= (255 & e.charCodeAt(t / 8)) << t % 32;
    return n
}
function o(e) {
    for (var t, n = "0123456789abcdef", o = "", r = 0; r < e.length; r += 1)
        t = e.charCodeAt(r),
            o += n.charAt(t >>> 4 & 15) + n.charAt(15 & t);
    return o
}
function d(e) {
    return unescape(encodeURIComponent(e))
}
function r(e) {
    return c(s(u(e = d(e)), 8 * e.length))
}
function i(e, t) {
    var n, e = d(e), t = d(t), o = u(e), r = [], i = [];
    for (r[15] = i[15] = void 0,
         16 < o.length && (o = s(o, 8 * e.length)),
             n = 0; n < 16; n += 1)
        r[n] = 909522486 ^ o[n],
            i[n] = 1549556828 ^ o[n];
    return e = s(r.concat(u(t)), 512 + 8 * t.length),
        c(s(i.concat(e), 640))
}

var decode = function (e, t, n) {
    return t ? n ? i(t, e) : o(i(t, e)) : n ? r(e) : o(r(e))
}

console.log(decode("123456"))

可以看到输出的加密和我们请求时帮我们发送的请求参数一样