AES加密分析

Ye夜夜夜夜夜

已于 2022-12-12 15:08:49 修改

阅读量1.7k

点赞数 1

分类专栏：爬虫文章标签： javascript python 爬虫

于 2022-12-12 14:58:57 首次发布

本文链接：https://blog.csdn.net/weixin_54779181/article/details/128285864

版权

爬虫专栏收录该内容

4 篇文章 0 订阅

订阅专栏

声明：本文章所有内容仅供学习使用，无其它任何目的，严禁用于商业用途和非法用途，否则产生一切后果均与作者无关

目标链接：aHR0cHM6Ly9qenNjLm1vaHVyZC5nb3YuY24vZGF0YS9jb21wYW55

在这里插入图片描述

1.抓包分析

F12打开控制台，输入目标链接，搜索需要的数据发现没有，推测那就是js解密后数据
在这里插入图片描述

连续翻页发现都是xhr请求返回的结果，响应数据是密文，请求参数都是明文

2.控制台调试

对这种密文我们可以选择xhr断点，找到返回数据的地方，然后一步一步往前跟栈肯定能找到明文加密的地方；但现在很多网站都是webpack打包的代码防止我们跟栈，这里我们可以直接搜 decrypt 一般需要解密的话都会用到这个方法，除非是混淆的代码，这个站我们随便打开看看js文件没有做任何混淆，那就全局搜索 decrypt 发现有两个js文件：
在这里插入图片描述
先打开第一个js文件，然后格式话代码，搜索 decrypt 打上一个断点去页面翻页

断点断住后发现 t 和前面返回的加密数据很像，逐语句运行到返回值的地方，打印一下 r.toString() 发现就是我们想要的最终结果，这里就已经看到了 AES 加密地方，直接本地实现 AES 解密：
在这里插入图片描述

3.本地生成

AES 加密库在JavaScript里面可以用 crypto-js库进行生成：

var CryptoJS = require("crypto-js")

var decrypt_request = function (t){
    var f = CryptoJS.enc.Utf8.parse("jo8j9wGw%6HbxfFn"),
        m = CryptoJS.enc.Utf8.parse("0123456789ABCDEF");
    var e = CryptoJS.enc.Hex.parse(t);
    var n = CryptoJS.enc.Base64.stringify(e);
    var a = CryptoJS.AES.decrypt(n, f, {
        mode: CryptoJS.mode.CBC,
        padding: CryptoJS.pad.Pkcs7,
        iv: m
    })
    return CryptoJS.enc.Utf8.stringify(a).toString()
}

var t = "95780ba0943730051dccb5fe3918f9fe1b6f2130681f99d5620c5497aa480f1392717ba5c3c59e30518f577df1528bf39c0df828253437d856cf7236c58e267cd1ddb144703a7f2ee92e0732a573f1e5ceabd65fb7f6a3d162dfa225dcf9315a15c6a871cf612e268c38b1f446fd1202bc051027fe73bef7cd0d6d41cf1163196df3b28763b74d7452e7ceb7a72dc7d9363b3e2badbe69048f584c1ebe551f424c931c70d6e6027fd6709aaca8450a198a4bb5db93dfa37f720e05d4b4583ee18227114b465924cd280df3253a2cbfafcfede6a3c5f4b13e1c465a974b3cdf0fd349f9d54ba4f3c2952793632820b20b3f931e21eae9222193bb0e819b45d75f631be10e8ac5622bab8f3ba3452278775727a44e3265558868c43e17ab0f24c53a7f08e7c6f2c757f65d9876125924907fa2c229deff0fd2f04fcb9e0ee036959930158ce0786c8584784357a22bd592793b4fecfa6364c08092c92c8599ffa406d258829608370d0a0bf14bf048e534798b63b97a4ef4e93e41e3d7d5d2b1c9765ef9162767cf9be663aead41fecc629c058a26877e78aee4e2acf7bb8786817465d4073e599da7729cd4b8aedf3031af8d94d3281030ade7bff73d87429bdd0ea4ec0844123c0ffb01bdb14816a5e5d019cfbdb8e30c088ac65d2743c4f7e5ba91588e363a54528c851640baf68fc74efa95b72dbeb88e7a024c42e4b02ac75a919a32b69676893fc3b252d5136e4722f2506fa3776d19422596381fb4e255cf766d631ec051e949278051f78ce7c34cd7704dc7482c0e4024bf012c149148030eb6f4ce7842a665365d37fe51580d6cac2f53cdf2a2b102140385f3c34321e1d6bbc688b6c96d47e5ec1823d2ce0fa5c34e2b7f84cfe5e6af3d1f24ac751c150d0f5a942fef2c189b9a5a19b53f5a841adbe85a7659c658399b6e2f5b41b9b17fe232f495adb0b7d5dfad0e593a0710674e3653cb6c0276c54f4927be6bac7d9d625c2dd4b1d5824a87bb72dae5138a3022a92d8449baa505889f970868c6a2a2046ecfe7054480a011fcd133ca6696bc6ab2d6a97882d1097754fc0e993ff26cecc551b2015c7a1eff25b5bcb4a3d090cc7ab8ff54ff0e1a5a3a1a7c2305ad59de562df3494dd839d2ffa8bc620fbbb472d4952fd83c7fd7bc9715d835ed6ad22d7de67565a3b6aba33953c95de2d8e7469bcce149685669a4d9169a1de8bceb41b3776de1e5e8aed443dc5c9960c04c6194e927aa7255ccefb5886702d2a95bf7e9b182208e09574f4d8c210f4981bd89bb73167162517f811b7bd8885d41a89b59f05b7325a9611502c01a76d7986937da51015555522e9132dc247cb70f80c539380066dbd8a349b5666ccd57fb598c7a37bd86a167fd8b6a1c1823c2bb19b5e9879b0ad6d31d8f49f927cc081e88ff8fe1a9e7f68f73fab79b90f6198f7773d236cb8ff4f17793d01ffc3e2a147033343606620223f79ff5ed1ac4143ed6729f5b6d978001c1ec1b6f6730fef54e411f9eee2c669f3fd8da41c88701fc6b5c46978e06cb9200ce453b09ac6829a63ccd9adfc1befd6ef7c056fa9eaaed7fbb1a358ca1730101567ea4b6fb4773b32cd54f9d439f7b0c83744bd738b795d921457fa0bef8f199ce1e93095eb7d6e9415c72d6e04751a5cde722be0d2cc90383082b6a86a373cf2c0f4432f8c287956f1ea3dc2a94e776db87e9d3c6061af37cfb622aa9c90c0d68e5f8d699832653e711f61ab599ae7e72758598301632461217c73d946b49a7eac1b6a0e5efb22d4303b2d2c790cb02a80510b9e5917838f3a3ece8b1871b182c9b44a163bd5ca65ee673275739606128e062603311b5096c1cca168d3a96f7123dd192b86fad52cd4cbda5074dac228ce4cf91ed3049fa19956591e87491dad0018007b2adc03ab38d2b48bebdb5d86546993156ed5c724aa20f3f2bd686553c41b5b65ab9c4d45486a56d8a871a7d85ab41ef614eb742345d66672428b323b321f54dfd61d80e97a530ab90328470130ec09ce76c2cc62e24ce19c20eaaf1e5131e2d1fd539e180fa309498d3ef8779a8fd8ba0c8972b278ec5637fa56e7065b9b4c135bc984784070999fdaec1250637af805095716d1a9b7f780a4b670d2ef65b47ad001eac812778534b07fdb8d4f5545eb3960f8e77ef7075ed4b5c53a6305130deeca8f051015033a43aecbae341ff8c948f99b76aa31dfc70287eb66b0a0c060808ac42d9ecadc9e95d07eac96c3baad5463df74ff4539f8c178f5f04a2f9d69a911d828a26391af06cf550143a65086c8bb6645520124ccee3e4a1f4c48d919a879429bae857755d50c130c1fa3c3e801630a35933decca8a100949d858877d2cacc4289fe7f45197af9656abe7f76bcb3a304585b2e68d1d791650aeb90113016d7f95530284c65761653ec52e6fe7c1673cf40558699c997d5e1ab4795f72d2e08e874e673f20277ffa7db9184bdea0eb797f636719f513e55c4a723752113dd0d1320c761f303fbaf8a2d80818b4c9c6e72d52ab24e3f54de9572366896afc6a30f94d51b0f428f9c5a9f55b3fa88571c8375cc62589da2f8890527aa01cbe400ad6fc37ba6c231156714b6f729dcaa1fbb875660b6f6305de1fe0c199bdba12f9340ec21eec282ba1071923c7d250e2862aa6fbcada6ffa4d1a7a22e8443944fdf6b2a33337254ed4c0acaaa47139ec2f049515d48107d9af4b8fe7b2f8cbe154cc07752a023226934afcb02c7343624a19473113fa17a772634673e0dbd6622a629d1da867a7f0f88639588382ebd89db168e9ce15b9ac2fc72bfd1a70e536d0ece8093af8227829bc2bbd4a016a6bfeaa24f09444413e52170388bc23e57e14eca0da75a69765d2a67ec20804cd3b8fe7f16b829eb262dd82dcc504954bcc924481ccd29204263f519f575d9771be81242244e371470b126528ccfdfe89a8e867ba82c09afbf1491767f3aae4a709f1b2046e1d2631929a3a346c6be154e361ff69fb0dab49938314c9801186ba58c6498f27f4b7cd1b82a1077500bb825bad184009c8bc38fcda67ffed4b8cb6ffce4b2e3e8a74ed3a9aad2b12e067a7f58e4ddc54aeabc11329a76e70293ad7830b25c732f4afb5e3ad8a5dcf4b9255e8d64262cd8f90daa696b357d5cde82102eadade7eb0668967cf118ab6ea85a830adbeb21e2c04c59c691d707d99f4edd598b5fa6248a4a3d9c4bd04076861d891eb5c9e6a9b8e454f7f72f00c075743a8f61a47859e763e990eb984af0d88c80faa6bc8703df56faab90de58fb3d82c32e9ae75a03942cf48ee5e38118f3c9a016c7a5d4f7ac2793bdee63901fced4ae0ead1b67ba2fb36704d6a0fc9707b72a2b622ff442591b233e64b41b01fa402f8731322084807b20d59fdbf0381e097055b2a1c2af16dae463d92dcff91b1a4f4d88592d437ae42cf91a904d2ac428090b13705344f95d7d73fa1f3490b2728d04f853ca95b8e05479606d18b0c16994a945ce774052be6e406a922a8cac14e64773b16389a403fb078baab69b7d8b084c3084276e8163c8f2517dfdd61c93ba8bfd0c8c9de19cd8a4c46bf9482074e087607868f8e138d009ee3c2327099e519270f3c7693ac17f75189ba390478f6892cddcd964e8b1d71fed35f9fa0e7d4223724e4d53371a4de40c2a9295e210053837665bca41e054dddedc4ed064df6cfb36c5809ca7d4fe739fbebfd6bcf744b1dcb5072496ea97f0fe6b0889e9889e049998e0c034841fabe068699108644c6d74ce903eab3797d4b7443d85adeb469b39a55252d0cbc12fb48a6cd918e2291a3593c18a0532e8238373e1de326288e94a8c8ab365123dfa1fb36f7f6ce6e9d1e4494bd3e648456c3da2f567c795c854ff1072af59100c87b385d5b71feaf51fa31e929ff5d1a40a68664e250bd84d0e7b21223c4af9faab93c2c205e7d6a5c28cabbf54795ed705cdceeb1307953915e8fc1351746f50be560c7764b5b8a119ef8aecb9ab48eb614cbf57d4db6279904fe2ff15e06906adfcf1ae53fde7c1cf73729694b05f849b33fe6866d968b08676144f3015da92dda820ab3f8aff35e092a8534bd3b1fba3f15c6747be7dffec88d5bbd785c4fd75a4d1edbb24a4e9b16d849eb7d58651f78b29c762865c7d61f93148e442e3f6fc4389b39b2d912356848c4dfe5a00bd863fb43447b0ec2e8f154eb148e170df3bea0b37244f343fc7e589fbde16f657428d506fb27d74d5e90cb5e47296048aef2ce006026a215938d31b1c33ab57c0d6fca9437db5df97f2695948672b4a134befaab348e4009584de8e38cd029e411519ff5633cb1982df0bd404edc681b9d00a4cf5ab574505fab6f250b204b04187d932eae9d892e91ca7f7bba797519ba6e37d67584484551c4ce475db02d6c77e1fd610afe496247fedb8437bad42fded84856a014c607da1c962b7c4dc78825836755e98d17e0209f2495203276e2a2020490926af67ca1973524492ab16ed3993c6def6e8e61ca3ec2b2bcc7301ba87cf2d2fcf88a45575ba1b8491e46aa7a29296bbe422fb226ae346bbe3e6e2a2bebbb3892b497eeeea83a5678a4ea12c24cc6fc194cafa8ab081efe742410acf2adf248889de4ca3a9f469a8f220b336cbfe629ad63fa7dd6fb7a91620246c6a892a51abba61fa0ed8982c7e2b6ae88898974f3ed297e7553b3b6ed176eb7e3eabdf428e67a12ef795067669c4ca052ee9b26be492986cb7dd6cd566e2941d4947c994fa8d46b5d7f9a11c495d4d7e2ed5054c1162bcc24ba1f119bd230bb2d3415135edfe80f852e3237f3ea30187f8f2735158d95d61ae68e0c2eba6a26751048a3f9311369ea6156301e328bb1f700b52c043fad9636a4653992ccb0c714684422605f711baac7491d0b4d79eef7a83a6063b564dba69dfdcfb49467c0bce0857d6304f9843686b44c5b42af4fd2c8a2aa7960fabc7b28cdb8b68df3ca3c5f3c7ebbba727ede63b1550227f62eb6e5c0bc719817e5f6a2a3f03ec1903ad097ea8fd3a6caf7e5dede5a05552e2506c72c9c6d62d185eb201422f252f0638fe9764f09f7978b238b2e2db2c2427af85dc73ddda5ec1245801542bc2553314c03c16a5b3befb339d3edeb032d5ef3e3439e9482806b59817156f79445437d162b516db86e82144194cd7c209b4fec014f9da04493f74c034e33b9b002e7efbfbaef102123123f5e1788b34fe4a0253e5936cf898f12c5f689a7f63f707a15df9cc52cc555e90058d3c0d9b51f951df8f1b159212b561c38dbe6bda07ee82d2387a9fd8998977b54185b066ea5fb68931d3364115da57d60e7128ace10099e532d7b622511f5def2a7d4f25f38579836ca40f57cd7f8f552d2d41e9b26aad78c5be25fe15e31d2906e64a9c34ead825e656d5544ef73355c4729907ec0026683f70fddb9a723df0b8b01a9c5959f31a40fd459abc2e0ad7780a578b67491e51be1b5446b560e3d2927ff0a5c898ddd4cb6f0f4df118171acd510d5b925171dab72c201770ac664a1524da3bb3872b240f7682264279aa06d42c3c4e88f8adcecdd08119b045afc7eafe38e80b3355ab487065ca585a5d2dd4e8ad558ba8258bdcfe38214250d503cd5ea21d9c63076fb955dd7e5a98ecc701eec84950ca2e595615f0c2318a95b075b65ae8dcbf91369b7399bc1d01f9e9b03c6c99510a9863200abc233c548cf23b32b92863407564690d793052940832e0d14d24f2cb35ad4e055f32c653c9d72dd4e03cee20751788f4d6042d035fa174f6623af80557fab99e32426bc791b34cc8f4c1ad4805113518f655abc38b615805f8520e3385029559dcfd8a57fcd5c6bb3fb406b53b7bc4f33125e4679b4dd3b33136bb58beeb1eebd3b7f993d0aaddb2bb9df7eeca8a53cc9c18f961ba69a9efaa2e6e2e98c395c82b41094aea864a69cd1c4d5b0f88a0131ce70c0093f1bf8e68f4fbee2a91b4fd3a8fba3b293cd5f1111bff6ea951a8f74f3beacd7f54d76d5a051e57955592760d6cf54415bacbc28cea0eb73dc87cf3cd40efb00c455a2bf40f7ce482ffa18f95172f32ccee360cbda15f97230500e9f408abc729fc9fdd4828f9ab50dab366b97ff9d89f97987042d2899d51d126c9bf0f0312fa4667f031a23796044d6a974db8e7c80ef87b11afa5a16965c7c18afb89bf0a52899709971a97727ab30ca13a8121a4515f580c4ae951681a940817a65c25a286437c4fd96c9bdc0c9d1e93d3b92f5a1f51c5767b63f8031cd16e5d98959deee5ceeb58a37ca6d67b9ddf45184b2b0ba51b2a495e4f36356d82ab6d2334664318d057"
console.log("aes解密：", decrypt_request(t))

AES 加密库在python里面可以用 pycryptodome库进行生成：

# -*- coding: utf-8 -*-
import requests
import json
from Crypto.Cipher import AES
from binascii import a2b_hex


def start_request():
    url = "https://jzsc.mohurd.gov.cn/api/webApi/dataservice/query/comp/list"
    headers = {
        "Accept": "application/json, text/plain, */*",
        "Accept-Encoding": "gzip, deflate",
        "Accept-Language": "zh-CN,zh;q=0.9",
        "accessToken": "",
        "Cache-Control": "no-cache",
        "Connection": "keep-alive",
        "Host": "jzsc.mohurd.gov.cn",
        "Pragma": "no-cache",
        "Sec-Fetch-Dest": "empty",
        "Sec-Fetch-Mode": "cors",
        "Sec-Fetch-Site": "same-origin",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36"
    }
    params = {
        "pg": "1",
        "pgsz": "15",
        "total": "450"
    }
    response = requests.request("GET", url=url, headers=headers, params=params)
    if response.status_code == 200:
        return response.text


def pkcs7unpadding(text):
    length = len(text)
    unpadding = ord(text[length - 1])
    return text[0:length - unpadding]


def decrypt_text(decrypt_str: str, key, iv):
    encrypt_bytes = a2b_hex(decrypt_str)
    key = key.encode("utf-8")
    iv = iv.encode("utf-8")
    cipher = AES.new(key, AES.MODE_CBC, iv)
    decrypt_bytes = cipher.decrypt(encrypt_bytes)
    result = str(decrypt_bytes, encoding='utf-8')
    result = pkcs7unpadding(result)
    print(json.loads(result))


if __name__ == '__main__':
    decrypt_str = start_request()
    key = "jo8j9wGw%6HbxfFn"
    iv = "0123456789ABCDEF"
    decrypt_text(decrypt_str, key=key, iv=iv)