26_某壳找房模拟登录+百度喵星人指纹加密破解.

声明

目标

aHR0cHM6Ly9iai5rZS5jb20v

抓包分析

1. password

2. context 字典中的值

3. loginTicketId

// ==== 第一次请求 ====
"password": "FtvyGhja3uFP+aVoKUuUntFybn8/O4BoDGoNdfrfm2BAbZo3NXw0VliAhSE39jBiYbXH7kEMetiXEmSsO4WZEtU51uSkV3rrsPDYjuGk2SzEDzvTZ2iLpC8ghY0Na8xqZqA/CvFOrNR8DTdjeuPNur9+y4KQ5U1S+yQ08+38cng=",
"loginTicketId": "N33YL74DgakMzd3UDU2xml3OLxypILHf",
"srcId": "eyJ0Ijoie1wiZGF0YVwiOlwiMmFmNDE2MGViODlmZjY5MzYyYzhhYjYwZjk2M2U4OTVmNWY0YmZjN2U1NTE3NThlZGI3MDYzZDY2Y2JlZWVmYTRhZDJmZWVmYzgyZWQxMDg1ODJlODk1OGIzNDNmNDAxYTRjMzk5MzhlNmU1YThlZjc3YjhmY2E1MDU4ZGQ2ZTdmMGUyYjljMzViMTcxYTA4NzE5M2M4MmVkMjZmOTEwMWMyMjYxOTQ1ZGY1MWE0NDAxOGUyZDJiZWJlYTg3NDU4NGE0ZWVjZWRlZWFhZmZlNWU3NmU2ZjQ2YWFiMzgxODJjMzFmMDA3ZDFkODUxM2VmMmFhODBlZGZhN2ZlMzkyNVwiLFwia2V5X2lkXCI6XCIxXCIsXCJzaWduXCI6XCIwOTMzYjdiN1wifSIsInIiOiJodHRwczovL2JqLmtlLmNvbS8iLCJvcyI6IndlYiIsInYiOiIwLjEifQ==",

// ==== 第二次请求
"password": "MCHQCwLmp3O22OmWoIv1qvkRfTkkzGiZmHZnEDaTdgY0mLwD9Ve+XcsZYiT/i+8V4rB2j3JCF5kWUp8Hx/YNkiL6FuBO4MWujradjYkkv8WN92creehj+RnvXUKkLNe4vMXUWKSMxVM9kbq+OFOOWJAtc3tocLjqJlN7apvYtKs=",
"loginTicketId": "dagM7n2Hn8NNUJLemfLanH7MCk4wYYNz",
"srcId": "eyJ0Ijoie1wiZGF0YVwiOlwiMmFmNDE2MGViODlmZjY5MzYyYzhhYjYwZjk2M2U4OTVmNWY0YmZjN2U1NTE3NThlZGI3MDYzZDY2Y2JlZWVmYTRhZDJmZWVmYzgyZWQxMDg1ODJlODk1OGIzNDNmNDAxYTRjMzk5MzhlNmU1YThlZjc3YjhmY2E1MDU4ZGQ2ZTdmMGUyYjljMzViMTcxYTA4NzE5M2M4MmVkMjZmOTEwMWMyMjYxOTQ1ZGY1MWE0NDAxOGUyZDJiZWJlYTg3NDU4NGE0ZWVjZWRlZWFhZmZlNWU3NmU2ZjQ2YWFiMzgxODJjMzFmMDA3ZDFkODUxM2VmMmFhODBlZGZhN2ZlMzkyNVwiLFwia2V5X2lkXCI6XCIxXCIsXCJzaWduXCI6XCIwOTMzYjdiN1wifSIsInIiOiJodHRwczovL2JqLmtlLmNvbS8iLCJvcyI6IndlYiIsInYiOiIwLjEifQ==",

• t 有点像一个接口的返回值。

• n是当前页面的 URL 地址

• os和v是定值。

window= global;
function get_srcID(t) {

    srcId = window.btoa(JSON.stringify({
            t: t, r: "<https://bj.ke.com/>", os: "web", v: "0.1"
        })
    )
    return srcId

}

this.getKey().encrypt(t)

o.ec.encrypt(t.password)

1. 定义全局变量

2. 把这个o.ec赋值给全局变量

3. 最下面调用这个全局变量.encrypt

**.ec**

• * 找到new 声明函数的位置**

n.m.forEach(function(func,index) {
    if (func.toString().indexOf('o.ec.encrypt(t.password)')!=-1){
        console.log(index)
    }

})

扣代码

window = global;

!function(n) {
    var r = {};
    function i(t) {
        if (r[t])
            return r[t].exports;
        var e = r[t] = {
            i: t,
            l: !1,
            exports: {}
        };
        console.log(t)
        return n[t].call(e.exports, e, e.exports, i),
        e.l = !0,
        e.exports
    }
  	...
    window.bk = i
}(
    {
      53:...
      ....
    }
);

window.bk(53).default()

window = global;

navigator = {
    appName:"Netscape"
}

window.location= {
    href:'<https://bj.ke.com/>'
}

window.bk(53).default()
console.log(window.zx.encrypt("admin*123"))

初始化

密码加密

百度miao URL 指纹加密

base64