js调试之dom事件与断点调试
实例网站：http://www.xinshangmeng.com/xsm2/?Version=2020121900
目的：分析password的加密方式
1、打开这个网站，输入相应的账号、密码、验证码。这里以账号：13511111111， 密码：123456 验证码：1111示例。F12抓包，发现登录请求是以下链接：
http://login.xinshangmeng.com/login/users/dologin/dfaup?jsonp=jQuery172015136950385625791_1609751029736&protocol=http%3A&loginIndex=https%3A%2F%2Fround-lake.dustinice.workers.dev%3A443%2Fhttp%2Fwww.xinshangmeng.com%2Fxsm2%2F%3FVersion%3D2020121900&j_mmrm=13511111111&j_mcmm=c2b02e94fa9c95c331638dcd19cf9ad2&j_valcode=1111&_=1609759222814
url解码之后：
http://login.xinshangmeng.com/login/users/dologin/dfaup?jsonp=jQuery172015136950385625791_1609751029736&protocol=http:&loginIndex=http://www.xinshangmeng.com/xsm2/?Version=2020121900&j_mmrm=13511111111&j_mcmm=c2b02e94fa9c95c331638dcd19cf9ad2&j_valcode=1111&_=1609759222814
具体的请求头和查询字符串如下：
由图可知j_mmrm就是我们的手机号， j_mcmm应该就是我们的密码，j_valcode就是验证码.
2、分析j_mcmm的加密方式：在这里使用的是事件追踪的方式
-
2.1将调试工具切换到Elements选项中，并在右侧选中EventListeners
2.2 选中调试工具的左上角的按钮，在网页中选中登录按钮
-
2.3 发现
登录按钮多了个submit事件，点击submit选项如下图：
-
2.4 在submit的选项下右侧有个该提交事件js的位置，点击跳转到相应的js并格式化：
通过js了解到，在1103行打断点， 了解该行主要是获取用户名，然后一直单步执行，发现1110行获取的是密码，但是此时密码并没有被加密，于是继续单步执行，直到1126行发现，b的值已经被加密了，所以加密的方式应该就在1126行。 -
2.5 鼠标移动到F函数上会出现F函数定义的位置，在函数F(b)的内部打上端点，过掉本次断点，代码执行到如下位置：
由此发现，这个函数就是加密密码的函数，我们只需要扣出m，o，e，n函数即可破解加密参数password；我们发现这几个函数都在一个函数内部，就是如图的1929行函数，因此我们可以整体把，这个函数拿出来，并进行相应的改写即可,改写如下：
window = {}; // 添加浏览器环境
var xx = function(a, b, c) {
function d(a) {
return n(e(o(m(a + "{1#2$3%4(5)6@7!poeeww$3%4(5)djjkkldss}")), 32))
}
window.d = d; // 这是一种将d函数导出的方式
function e(a, b) {
for (var c = 1732584193, d = -271733879, e = -1732584194, f = 271733878, l = 0; l < a.length; l += 16) {
var m = c
, n = d
, o = e
, p = f;
c = g(c, d, e, f, a[l + 0], 7, -680876936),
f = g(f, c, d, e, a[l + 1], 12, -389564586),
e = g(e, f, c, d, a[l + 2], 17, 606105819),
d = g(d, e, f, c, a[l + 3], 22, -1044525330),
c = g(c, d, e, f, a[l + 4], 7, -176418897),
f = g(f, c, d, e, a[l + 5], 12, 1200080426),
e = g(e, f, c, d, a[l + 6], 17, -1473231341),
d = g(d, e, f, c, a[l + 7], 22, -45705983),
c = g(c, d, e, f, a[l + 8], 7, 1770035416),
f = g(f, c, d, e, a[l + 9], 12, -1958414417),
e = g(e, f, c, d, a[l + 10], 17, -42063),
d = g(d, e, f, c, a[l + 11], 22, -1990404162),
c = g(c, d, e, f, a[l + 12], 7, 1804603682),
f = g(f, c, d, e, a[l + 13], 12, -40341101),
e = g(e, f, c, d, a[l + 14], 17, -1502002290),
d = g(d, e, f, c, a[l + 15], 22, 1236535329),
c = h(c, d, e, f, a[l + 1], 5, -165796510),
f = h(f, c, d, e, a[l + 6], 9, -1069501632),
e = h(e, f, c, d, a[l + 11], 14, 643717713),
d = h(d, e, f, c, a[l + 0], 20, -373897302),
c = h(c, d, e, f, a[l + 5], 5, -701558691),
f = h(f, c, d, e, a[l + 10], 9, 38016083),
e = h(e, f, c, d, a[l + 15], 14, -660478335),
d = h(d, e, f, c, a[l + 4], 20, -405537848),
c = h(c, d, e, f, a[l + 9], 5, 568446438),
f = h(f, c, d, e, a[l + 14], 9, -1019803690),
e = h(e, f, c, d, a[l + 3], 14, -187363961),
d = h(d, e, f, c, a[l + 8], 20, 1163531501),
c = h(c, d, e, f, a[l + 13], 5, -1444681467),
f = h(f, c, d, e, a[l + 2], 9, -51403784),
e = h(e, f, c, d, a[l + 7], 14, 1735328473),
d = h(d, e, f, c, a[l + 12], 20, -1926607734),
c = i(c, d, e, f, a[l + 5], 4, -378558),
f = i(f, c, d, e, a[l + 8], 11, -2022574463),
e = i(e, f, c, d, a[l + 11], 16, 1839030562),
d = i(d, e, f, c, a[l + 14], 23, -35309556),
c = i(c, d, e, f, a[l + 1], 4, -1530992060),
f = i(f, c, d, e, a[l + 4], 11, 1272893353),
e = i(e, f, c, d, a[l + 7], 16, -155497632),
d = i(d, e, f, c, a[l + 10], 23, -1094730640),
c = i(c, d, e, f, a[l + 13], 4, 681279174),
f = i(f, c, d, e, a[l + 0], 11, -358537222),
e = i(e, f, c, d, a[l + 3], 16, -722521979),
d = i(d, e, f, c, a[l + 6], 23, 76029189),
c = i(c, d, e, f, a[l + 9], 4, -640364487),
f = i(f, c, d, e, a[l + 12], 11, -421815835),
e = i(e, f, c, d, a[l + 15], 16, 530742520),
d = i(d, e, f, c, a[l + 2], 23, -995338651),
c = j(c, d, e, f, a[l + 0], 6, -198630844),
f = j(f, c, d, e, a[l + 7], 10, 1126891415),
e = j(e, f, c, d, a[l + 14], 15, -1416354905),
d = j(d, e, f, c, a[l + 5], 21, -57434055),
c = j(c, d, e, f, a[l + 12], 6, 1700485571),
f = j(f, c, d, e, a[l + 3], 10, -1894986606),
e = j(e, f, c, d, a[l + 10], 15, -1051523),
d = j(d, e, f, c, a[l + 1], 21, -2054922799),
c = j(c, d, e, f, a[l + 8], 6, 1873313359),
f = j(f, c, d, e, a[l + 15], 10, -30611744),
e = j(e, f, c, d, a[l + 6], 15, -1560198380),
d = j(d, e, f, c, a[l + 13], 21, 1309151649),
c = j(c, d, e, f, a[l + 4], 6, -145523070),
f = j(f, c, d, e, a[l + 11], 10, -1120210379),
e = j(e, f, c, d, a[l + 2], 15, 718787259),
d = j(d, e, f, c, a[l + 9], 21, -343485551),
c = k(c, m),
d = k(d, n),
e = k(e, o),
f = k(f, p)
}
return new Array(c,d,e,f)
}
function f(a, b, c, d, e, f) {
return k(l(k(k(b, a), k(d, f)), e), c)
}
function g(a, b, c, d, e, g, h) {
return f(b & c | ~b & d, a, b, e, g, h)
}
function h(a, b, c, d, e, g, h) {
return f(b & d | c & ~d, a, b, e, g, h)
}
function i(a, b, c, d, e, g, h) {
return f(b ^ c ^ d, a, b, e, g, h)
}
function j(a, b, c, d, e, g, h) {
return f(c ^ (b | ~d), a, b, e, g, h)
}
function k(a, b) {
var c = (65535 & a) + (65535 & b);
return (a >> 16) + (b >> 16) + (c >> 16) << 16 | 65535 & c
}
function l(a, b) {
return a << b | a >>> 32 - b
}
function m(a) {
for (var b = a.length, c = new Array(b), d = 0; d < b; d++) {
var e = a.charCodeAt(d);
c[d] = 255 & e
}
return c
}
function n(a) {
for (var b = "0123456789abcdef", c = "", d = 0; d < 4 * a.length; d++)
c += b.charAt(a[d >> 2] >> d % 4 * 8 + 4 & 15) + b.charAt(a[d >> 2] >> d % 4 * 8 & 15);
return c
}
function o(a) {
for (var b = 1 + (a.length + 8 >> 6), c = new Array(16 * b), d = 0; d < 16 * b; d++)
c[d] = 0;
for (var e = 0; e < a.length; e++)
c[e >> 2] |= (255 & a[e]) << e % 4 * 8;
return c[e >> 2] |= 128 << e % 4 * 8,
c[16 * b - 2] = 8 * a.length,
c
}
c.hex_md5 = d
}
xx("账号","密码", "验证码")
var x1 = window.d("密码");
var x2 = window.d(x1+"验证码"); // x2就是加密之后的密码值
扫一扫
1051
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
