146 字
1 分钟
Web 逆向笔记
web逆向
页面加载 => 填充数据
api
fuzz
对一个 api 接口发起请求
import requests
conf = { 'url': 'http://www.whggzy.com/portal/category', 'method': 'post', 'headers': { 'Accept': "application/json, text/plain, */*", "Content-Type": "application/json;charset=utf-8", "X-Requested-With": "XMLHttpRequest" }, 'data': '{"pageNo":1,"pageSize":15,"categoryCode":"MostImportant","_t":1699667047000}' # 'json': { # "pageNo": 1, # "pageSize": 15, # "categoryCode": "MostImportant", # "_t": 1699666604000 # }}
response = requests.request(**conf)print(response)print(response.text)朝地址发送请求,拦截,看他是怎么发送的 => 仿照
axios,ajax
发送请求的函数 <= 数据
index => api => 密文 => js 解密 => 渲染到网页
let data = "MZphJmFlelDpw2aSCfdFb/N2pTHjfeAwtDLyvUJjNtc9uQ38v3qfLPSa8aHUOp11/nLUW7Oh0nsTNlcykLqCB2oQjmA46V1gwnaP/yhXe+GYnIJbyQfvFy2dzl5nzhez8XzVrEk40vycjn4uGZVw16Xj6FtHrNnVE2mrCKdMmf+Qh5vnU5DjD91q7UpSSgUAyWGgteD+ehMbwmfjrGJg5VLISb7kWLP+"
let crypt = require('crypto-js')
function b(t) { let e = crypt.enc.Utf8.parse("EB444973714E4A40876CE66BE45D5930" ), n = crypt.enc.Utf8.parse("B5A8904209931867" ), a = crypt.AES.decrypt(t, e, { iv: n, mode: crypt.mode.CBC, padding: crypt.pad.Pkcs7 }); return a.toString(crypt.enc.Utf8)}
console.log(b(data))
闽公网安备 35050402880173号