146 字
1 分钟
Web 逆向笔记

web逆向#

页面加载 => 填充数据

api

fuzz

对一个 api 接口发起请求

import requests
conf = {
'url': 'http://www.whggzy.com/portal/category',
'method': 'post',
'headers': {
'Accept': "application/json, text/plain, */*",
"Content-Type": "application/json;charset=utf-8",
"X-Requested-With": "XMLHttpRequest"
},
'data': '{"pageNo":1,"pageSize":15,"categoryCode":"MostImportant","_t":1699667047000}'
# 'json': {
# "pageNo": 1,
# "pageSize": 15,
# "categoryCode": "MostImportant",
# "_t": 1699666604000
# }
}
response = requests.request(**conf)
print(response)
print(response.text)

朝地址发送请求,拦截,看他是怎么发送的 => 仿照

axios,ajax

发送请求的函数 <= 数据

index => api => 密文 => js 解密 => 渲染到网页

let data = "MZphJmFlelDpw2aSCfdFb/N2pTHjfeAwtDLyvUJjNtc9uQ38v3qfLPSa8aHUOp11/nLUW7Oh0nsTNlcykLqCB2oQjmA46V1gwnaP/yhXe+GYnIJbyQfvFy2dzl5nzhez8XzVrEk40vycjn4uGZVw16Xj6FtHrNnVE2mrCKdMmf+Qh5vnU5DjD91q7UpSSgUAyWGgteD+ehMbwmfjrGJg5VLISb7kWLP+"
let crypt = require('crypto-js')
function b(t) {
let e = crypt.enc.Utf8.parse("EB444973714E4A40876CE66BE45D5930" ),
n = crypt.enc.Utf8.parse("B5A8904209931867" ),
a = crypt.AES.decrypt(t, e, {
iv: n,
mode: crypt.mode.CBC,
padding: crypt.pad.Pkcs7
});
return a.toString(crypt.enc.Utf8)
}
console.log(b(data))
Web 逆向笔记
https://wangyi187.top/posts/web-reverse/
作者
WangYi
发布于
2023-11-11
许可协议
CC BY-NC-SA 4.0