js逆向步驟
- js調試工具
- PyExecJs
- 實現使用python執行js代碼
- 安裝環境
- 安裝node.js開發環境
- pip install PyExecJs
- js算法改寫初探
- 打斷點
- 代碼調試時，如果發現了相關變量的缺失，一般給其定義成空字典即可。
- 代碼調試時，如果js內置對象確實，直接將該內置對象賦值為
this。例如：window = this;
js反混淆
- 相關概念
- js混淆：對核心的js代碼進行加密
- js反混淆：對js加密代碼進行解密
- 破解
- 使用瀏覽器自帶的反混淆工具【推薦】：打開開發者工具 ----> 點擊小齒輪 ----> 找到Souces選項卡 ----> 勾選Search in anonymous and scripts框 ----> 刷新頁面
- 暴力破解【迫不得已】：暴力破解網站
1. 微信公眾號平台js算法逆向【MD5算法】
import execjs
# 1. 實例化一個node對象
node = execjs.get()
# 2. js源文件編譯
ctx = node.compile(open('./js源文件./wechat.js',encoding='utf-8').read())
# 3. 執行js函數
funcName = 'getPwd("{}")'.format('123123123')
pwd = ctx.eval(funcName)
print(pwd)
2. Steam游戲平台js算法逆向【RSA算法】
import requests
import execjs
import time
# 動態獲取mod和exp串
url = 'https://store.steampowered.com/login/getrsakey/'
data = {
'donotcache': str(int(time.time() * 1000)), # 時間戳
'username': '123@qq.com',
}
headers = {
'user-agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36',
}
response_json = requests.post(url=url,headers=headers,data=data).json()
mod = response_json['publickey_mod']
exp = response_json['publickey_exp']
# 1. 實例化一個node對象
node = execjs.get()
# 2. js源文件編譯
ctx = node.compile(open('./js源文件./steam.js',encoding='utf-8').read())
# 3. 執行js函數
funcName = 'getPwd("{0}","{1}","{2}")'.format('123123123',mod,exp)
pwd = ctx.eval(funcName)
print(pwd)
3. 凡科網js算法逆向【MD5算法】
import execjs
# 1. 實例化一個node對象
node = execjs.get()
# 2. js源文件編譯
ctx = node.compile(open('./js源文件/fanke.js',encoding='utf-8').read())
# 3. 執行js函數
funcName = 'md5("{0}")'.format('123123123')
pwd = ctx.eval(funcName)
print(pwd)
4. 完美世界游戲js算法逆向【RSA算法】
import requests
from lxml import etree
import execjs
# 獲取公鑰串
url = 'https://passport.wanmei.com/sso/login?service=passport&isiframe=1&location=2f736166652f'
headers = {
'user-agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36',
}
response_text = requests.post(url=url,headers=headers).text
tree = etree.HTML(response_text)
publicKey = tree.xpath('//input[@id="e"]/@value')[0]
# 1. 實例化一個node對象
node = execjs.get()
# 2. js源文件編譯
ctx = node.compile(open('./js源文件/wanmei.js',encoding='utf-8').read())
# 3. 執行js函數
funcName = 'getPwd("{0}","{1}")'.format('123123123',publicKey)
pwd = ctx.eval(funcName)
print(pwd)
5. 試客聯盟js算法逆向【RSA算法】
import requests
from lxml import etree
import execjs
import re
# 獲取rsa_n串
url = 'http://login.shikee.com/getkey?v=19b53e441bc51f28a9e6afead8e665ea'
headers = {
'user-agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36',
}
response_text = requests.get(url=url,headers=headers).text
ex = 'var rsa_n = "(.*?)";'
rsa_n = re.findall(ex,response_text)[0]
# 1. 實例化一個node對象
node = execjs.get()
# 2. js源文件編譯
ctx = node.compile(open('./js源文件/shike.js',encoding='utf-8').read())
# 3. 執行js函數
funcName = 'getPwd("{}","{}")'.format('123123123',rsa_n)
pwd = ctx.eval(funcName)
print(pwd)
6. 空中網js算法逆向【RSA算法】
import requests
import execjs
import re
import json
# 獲取j_data['dc']串
url = 'https://sso.kongzhong.com/ajaxLogin?j=j&jsonp=j&service=https://passport.kongzhong.com/&_=1626875097213'
headers = {
'user-agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36',
'Referer': 'https://passport.kongzhong.com/'
}
response_text = requests.get(url=url,headers=headers).text
ex = "KZLoginHandler.jsonpCallbackKongZ\((.*?)\)"
data = re.findall(ex,response_text)[0]
dc = json.loads(data)['dc']
# 1. 實例化一個node對象
node = execjs.get()
# 2. js源文件編譯
ctx = node.compile(open('./js源文件/kongzhong.js',encoding='utf-8').read())
# 3. 執行js函數
funcName = 'getPwd("{}","{}")'.format('123123123',dc)
pwd = ctx.eval(funcName)
print(pwd)
7. 長房網js算法逆向【DES算法】
import execjs
# 1. 實例化一個node對象
node = execjs.get()
# 2. js源文件編譯
ctx = node.compile(open('./js源文件/changfang.js',encoding='utf-8').read())
# 3. 執行js函數
funcName = 'getPwd("{}")'.format('123123123')
pwd = ctx.eval(funcName)
print(pwd)
8. 有道翻譯js算法逆向【MD5算法】
import time
import random
import execjs
import requests
word = input("Please input a English word：")
r = str(int(time.time() * 1000))
i = r + str(random.randint(0,9))
# 1. 實例化一個node對象
node = execjs.get()
# 2. js源文件編譯
ctx = node.compile(open('./js源文件/youdao.js',encoding='utf-8').read())
# 3. 執行js函數
funcName = 'getSign("{}","{}")'.format(word,i)
sign = ctx.eval(funcName)
url = 'https://fanyi.youdao.com/translate_o?smartresult=dict&smartresult=rule'
headers = {
'user-agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36',
'Referer': 'https://fanyi.youdao.com/',
'Cookie': 'OUTFOX_SEARCH_USER_ID_NCOO=512615467.85577774; OUTFOX_SEARCH_USER_ID="-673357154@10.169.0.82"; _ga=GA1.2.446310143.1622377950; _ntes_nnid=4ef5ec83bdbbbe870ec8f8c735810336,1622941677257; JSESSIONID=aaa-vW4aILneN-aFSiiRx; ___rl__test__cookies=1626879075736',
}
data = {
'i': word,
'from': 'AUTO',
'to': 'AUTO',
'smartresult': 'dict',
'client': 'fanyideskweb',
'salt': i,
'sign': sign,
'lts': r,
'bv': '24ecb70ba6203e4453baed50aa26b78e',
'doctype': 'json',
'version': '2.1',
'keyfrom': 'fanyi.web',
'action': 'FY_BY_REALTlME',
}
response_json = requests.post(url=url,headers=headers,data=data).json()
print(response_json)
9. CTE四六級js算法逆向【DES算法】
import execjs
# 1. 實例化一個node對象
node = execjs.get()
# 2. js源文件編譯
ctx = node.compile(open('./js源文件/CTE.js',encoding='utf-8').read())
# 3. 執行js函數
funcName = 'getPwd("{}")'.format('123123123')
pwd = ctx.eval(funcName)print(pwd)
