9-爬虫高级实战【js逆向】

js逆向步骤

js调试工具
- 发条js调试工具
PyExecJs
- 实现使用python执行js代码
- 安装环境
  - 安装node.js开发环境
  - pip install PyExecJs
js算法改写初探
- 打断点
- 代码调试时，如果发现了相关变量的缺失，一般给其定义成空字典即可。
- 代码调试时，如果js内置对象确实，直接将该内置对象赋值为this。例如：window = this;

js反混淆

相关概念
- js混淆：对核心的js代码进行加密
- js反混淆：对js加密代码进行解密
破解
- 使用浏览器自带的反混淆工具【推荐】：打开开发者工具 ----> 点击小齿轮 ----> 找到Souces选项卡 ----> 勾选Search in anonymous and scripts框 ----> 刷新页面
- 暴力破解【迫不得已】：暴力破解网站

1. 微信公众号平台js算法逆向【MD5算法】

url：https://mp.weixin.qq.com/

import execjs
# 1. 实例化一个node对象
node = execjs.get()

# 2. js源文件编译
ctx = node.compile(open(\'./js源文件./wechat.js\',encoding=\'utf-8\').read())

# 3. 执行js函数
funcName = \'getPwd("{}")\'.format(\'123123123\')
pwd = ctx.eval(funcName)
print(pwd)

2. Steam游戏平台js算法逆向【RSA算法】

url：https://store.steampowered.com/login/?redir=&redir_ssl=1&snr=1_4_4__global-header

import requests
import execjs
import time

# 动态获取mod和exp串
url = \'https://store.steampowered.com/login/getrsakey/\'
data = {
    \'donotcache\': str(int(time.time() * 1000)), # 时间戳
    \'username\': \'123@qq.com\',
}
headers = {
    \'user-agent\':\'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36\',
}
response_json = requests.post(url=url,headers=headers,data=data).json()
mod = response_json[\'publickey_mod\']
exp = response_json[\'publickey_exp\']

# 1. 实例化一个node对象
node = execjs.get()

# 2. js源文件编译
ctx = node.compile(open(\'./js源文件./steam.js\',encoding=\'utf-8\').read())

# 3. 执行js函数
funcName = \'getPwd("{0}","{1}","{2}")\'.format(\'123123123\',mod,exp)
pwd = ctx.eval(funcName)
print(pwd)

3. 凡科网js算法逆向【MD5算法】

注意：如果需要逆向的js函数的实现时出现在一个闭包中，那么直接将闭包的整个代码拷贝出进行调试即可
url：https://i.fkw.com/

import execjs

# 1. 实例化一个node对象
node = execjs.get()

# 2. js源文件编译
ctx = node.compile(open(\'./js源文件/fanke.js\',encoding=\'utf-8\').read())

# 3. 执行js函数
funcName = \'md5("{0}")\'.format(\'123123123\')
pwd = ctx.eval(funcName)
print(pwd)

4. 完美世界游戏js算法逆向【RSA算法】

url：https://passport.wanmei.com/login?location=L3NhZmUv

import requests
from lxml import etree
import execjs

# 获取公钥串
url = \'https://passport.wanmei.com/sso/login?service=passport&isiframe=1&location=2f736166652f\'
headers = {
    \'user-agent\':\'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36\',
}
response_text = requests.post(url=url,headers=headers).text
tree = etree.HTML(response_text)
publicKey = tree.xpath(\'//input[@id="e"]/@value\')[0]

# 1. 实例化一个node对象
node = execjs.get()

# 2. js源文件编译
ctx = node.compile(open(\'./js源文件/wanmei.js\',encoding=\'utf-8\').read())

# 3. 执行js函数
funcName = \'getPwd("{0}","{1}")\'.format(\'123123123\',publicKey)
pwd = ctx.eval(funcName)
print(pwd)

5. 试客联盟js算法逆向【RSA算法】

url：http://login.shikee.com/

import requests
from lxml import etree
import execjs
import re
# 获取rsa_n串
url = \'http://login.shikee.com/getkey?v=19b53e441bc51f28a9e6afead8e665ea\'
headers = {
    \'user-agent\':\'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36\',
}
response_text = requests.get(url=url,headers=headers).text
ex = \'var rsa_n = "(.*?)";\'
rsa_n = re.findall(ex,response_text)[0]

# 1. 实例化一个node对象
node = execjs.get()

# 2. js源文件编译
ctx = node.compile(open(\'./js源文件/shike.js\',encoding=\'utf-8\').read())

# 3. 执行js函数
funcName = \'getPwd("{}","{}")\'.format(\'123123123\',rsa_n)
pwd = ctx.eval(funcName)
print(pwd)

6. 空中网js算法逆向【RSA算法】

url：https://passport.kongzhong.com/

import requests
import execjs
import re
import json

# 获取j_data[\'dc\']串
url = \'https://sso.kongzhong.com/ajaxLogin?j=j&jsonp=j&service=https://passport.kongzhong.com/&_=1626875097213\'
headers = {
    \'user-agent\':\'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36\',
    \'Referer\': \'https://passport.kongzhong.com/\'
}
response_text = requests.get(url=url,headers=headers).text
ex = "KZLoginHandler.jsonpCallbackKongZ\((.*?)\)"
data = re.findall(ex,response_text)[0]
dc = json.loads(data)[\'dc\']

# 1. 实例化一个node对象
node = execjs.get()

# 2. js源文件编译
ctx = node.compile(open(\'./js源文件/kongzhong.js\',encoding=\'utf-8\').read())

# 3. 执行js函数
funcName = \'getPwd("{}","{}")\'.format(\'123123123\',dc)
pwd = ctx.eval(funcName)
print(pwd)

7. 长房网js算法逆向【DES算法】

url：http://eip.chanfine.com/login.jsp;jsessionid=191E9473B6FBF42F66EE0AC57FEAC7AD

import execjs

# 1. 实例化一个node对象
node = execjs.get()

# 2. js源文件编译
ctx = node.compile(open(\'./js源文件/changfang.js\',encoding=\'utf-8\').read())

# 3. 执行js函数
funcName = \'getPwd("{}")\'.format(\'123123123\')
pwd = ctx.eval(funcName)
print(pwd)

8. 有道翻译js算法逆向【MD5算法】

https://fanyi.youdao.com/

import time
import random
import execjs
import requests

word = input("Please input a English word：")
r = str(int(time.time() * 1000))
i = r + str(random.randint(0,9))

# 1. 实例化一个node对象
node = execjs.get()

# 2. js源文件编译
ctx = node.compile(open(\'./js源文件/youdao.js\',encoding=\'utf-8\').read())

# 3. 执行js函数
funcName = \'getSign("{}","{}")\'.format(word,i)
sign = ctx.eval(funcName)

url = \'https://fanyi.youdao.com/translate_o?smartresult=dict&smartresult=rule\'
headers = {
    \'user-agent\':\'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36\',
    \'Referer\': \'https://fanyi.youdao.com/\',
    \'Cookie\': \'OUTFOX_SEARCH_USER_ID_NCOO=512615467.85577774; OUTFOX_SEARCH_USER_ID="-673357154@10.169.0.82"; _ga=GA1.2.446310143.1622377950; _ntes_nnid=4ef5ec83bdbbbe870ec8f8c735810336,1622941677257; JSESSIONID=aaa-vW4aILneN-aFSiiRx; ___rl__test__cookies=1626879075736\',
}
data = {
    \'i\': word,
    \'from\': \'AUTO\',
    \'to\': \'AUTO\',
    \'smartresult\': \'dict\',
    \'client\': \'fanyideskweb\',
    \'salt\': i,
    \'sign\': sign,
    \'lts\': r,
    \'bv\': \'24ecb70ba6203e4453baed50aa26b78e\',
    \'doctype\': \'json\',
    \'version\': \'2.1\',
    \'keyfrom\': \'fanyi.web\',
    \'action\': \'FY_BY_REALTlME\',
}
response_json = requests.post(url=url,headers=headers,data=data).json()
print(response_json)

9. CTE四六级js算法逆向【DES算法】

url：https://passport.neea.edu.cn/CETLogin?ReturnUrl=http://cet-bm.neea.edu.cn/Home/VerifyPassport/?LoginType=0

import execjs
# 1. 实例化一个node对象
node = execjs.get()

# 2. js源文件编译
ctx = node.compile(open(\'./js源文件/CTE.js\',encoding=\'utf-8\').read())

# 3. 执行js函数
funcName = \'getPwd("{}")\'.format(\'123123123\')
pwd = ctx.eval(funcName)print(pwd)