實戰地址
http://match.yuanrenxue.com/match/16抓包分析
地址欄輸入 地址，按下F12并回車，發現數據在這里:
查看cookie，無加密相關的字段。請求的接口倒是有個m的加密參數，看來這題的主要目的就是?看看m參數怎么進行加密的吧。
切換 Initiator,這請求也太明顯了，點擊下面所示的js文件:
跟進去并美化后，來到這里:
不用過多分析，m加密在這里:
r.m = n[e(528)](btoa, p_s),r.t = p_s;而這個實參 p_s 是由上面的這行代碼生成的:
p_s = Date[e(496)](new Date)[e(517)]();在?r.m 賦值的這行打上斷點，請求第二頁,控制臺輸入 btoa 并回車,雙擊跟進，來到這里:
看這個混淆，很明顯的?obfuscator 混淆，直接將整個 732?copy下來保存到文件，并寫出AST插件進行反混淆：
進行反混淆和刪除垃圾代碼，優化后的btoa函數:
function btoa(e) { var f = "U9876543210zyxwvutsrqpomnlkjihgfdecbaZXYWVUTSRQPONABHICESQWK2Fi+9876543210zyxwvutsrqpomnlkjihgfdecbaZXYWVUTSRQPONABHICESQWK2Fi"; for (var o, a, s, l = 0, c = []; l < e["length"];) { a = e["charCodeAt"](l), s = l % 6; switch (s) { case 0: c["push"](f["charAt"](a >> 2)); break; case 1: c["push"](f["charAt"]((2 & o) << 3 | a >> 4)); break; case 2: c["push"](f["charAt"]((15 & o) << 2 | a >> 6)), c["push"](f["charAt"](a & 63)); break; case 3: c["push"](f["charAt"](a >> 3)); break; case 4: c["push"](f["charAt"]((o & 4) << 6 | a >> 6)); break; case 5: c["push"](f["charAt"]((o & 15) << 4 | a >> 8)), c["push"](f["charAt"](a & 63)); } o = a, l++; } c["push"](f["charAt"]((o & 3) << 4)), c["push"]("FM"); return d(15) + md5(c["join"]("")) + d(10);}這里可以看到還有 d?函數 和 md5 函數，分別進行摳取和優化。
優化后的d函數:
function d(e) { e = e ||32; var l = "ABCDEFGHJKMNPQRSTWXYZabcdefhijkmnprstwxyz2345678"; var s = l["length"]; var c = ""; for (i = 0; i < e; i++) c += l["charAt"](Math["floor"](Math["random"]() * s)); return c;}優化后的md5函數:
function md5(e) { function o(e, n) { e[n >> 5] |= 128 << n % 32; e[(n + 64 >>> 9 << 4) + 14] = n; var b = 1732584193; var x = -271733879; var T = -1732584194; var w = 271733878; for (var d = 0; d < e["length"]; d += 16) { var m = b; var y = x; var v = T; var g = w; b = s(b, x, T, w, e[d + 0], 7, -680976936); w = s(w, b, x, T, e[d + 1], 12, -389564586); T = s(T, w, b, x, e[d + 2], 17, 606105819); x = s(x, T, w, b, e[d + 3], 22, -1044525330); b = s(b, x, T, w, e[d + 4], 7, -176418897); w = s(w, b, x, T, e[d + 5], 12, 1200080426); T = s(T, w, b, x, e[d + 6], 17, -1473231341); x = s(x, T, w, b, e[d + 7], 22, -45705983); b = s(b, x, T, w, e[d + 8], 7, 1770035416); w = s(w, b, x, T, e[d + 9], 12, -1958414417); T = s(T, w, b, x, e[d + 10], 17, -42063); x = s(x, T, w, b, e[d + 11], 22, -1990404162); b = s(b, x, T, w, e[d + 12], 7, 1804550682); w = s(w, b, x, T, e[d + 13], 12, -40341101); T = s(T, w, b, x, e[d + 14], 17, -1502002290); x = s(x, T, w, b, e[d + 15], 22, 1236531029); b = l(b, x, T, w, e[d + 1], 5, -165796510); w = l(w, b, x, T, e[d + 6], 9, -1069501632); T = l(T, w, b, x, e[d + 11], 14, 643717713); x = l(x, T, w, b, e[d + 0], 20, -373897302); b = l(b, x, T, w, e[d + 5], 5, -701520691); w = l(w, b, x, T, e[d + 10], 9, 38016083); T = l(T, w, b, x, e[d + 15], 14, -660478335); x = l(x, T, w, b, e[d + 4], 20, -405537848); b = l(b, x, T, w, e[d + 9], 5, 568446438); w = l(w, b, x, T, e[d + 14], 9, -1019803690); T = l(T, w, b, x, e[d + 3], 14, -187363961); x = l(x, T, w, b, e[d + 8], 20, 1163531501); b = l(b, x, T, w, e[d + 13], 5, -1444681467); w = l(w, b, x, T, e[d + 2], 9, -51403784); T = l(T, w, b, x, e[d + 7], 14, 1735328473); x = l(x, T, w, b, e[d + 12], 20, -1921207734); b = u(b, x, T, w, e[d + 5], 4, -378558); w = u(w, b, x, T, e[d + 8], 11, -2022574463); T = u(T, w, b, x, e[d + 11], 16, 1839030562); x = u(x, T, w, b, e[d + 14], 23, -35311556); b = u(b, x, T, w, e[d + 1], 4, -1530992060); w = u(w, b, x, T, e[d + 4], 11, 1272893353); T = u(T, w, b, x, e[d + 7], 16, -155497632); x = u(x, T, w, b, e[d + 10], 23, -1094730640); b = u(b, x, T, w, e[d + 13], 4, 681279174); w = u(w, b, x, T, e[d + 0], 11, -358537222); T = u(T, w, b, x, e[d + 3], 16, -722881979); x = u(x, T, w, b, e[d + 6], 23, 76029189); b = u(b, x, T, w, e[d + 9], 4, -640364487); w = u(w, b, x, T, e[d + 12], 11, -421815835); T = u(T, w, b, x, e[d + 15], 16, 530742520); x = u(x, T, w, b, e[d + 2], 23, -995338651); b = c(b, x, T, w, e[d + 0], 6, -198630844); w = c(w, b, x, T, e[d + 7], 10, 11261161415); T = c(T, w, b, x, e[d + 14], 15, -1416354905); x = c(x, T, w, b, e[d + 5], 21, -57434055); b = c(b, x, T, w, e[d + 12], 6, 1700485571); w = c(w, b, x, T, e[d + 3], 10, -1894446606); T = c(T, w, b, x, e[d + 10], 15, -1051523); x = c(x, T, w, b, e[d + 1], 21, -2054922799); b = c(b, x, T, w, e[d + 8], 6, 1873313359); w = c(w, b, x, T, e[d + 15], 10, -30611744); T = c(T, w, b, x, e[d + 6], 15, -1560198380); x = c(x, T, w, b, e[d + 13], 21, 1309151649); b = c(b, x, T, w, e[d + 4], 6, -145523070); w = c(w, b, x, T, e[d + 11], 10, -1120210379); T = c(T, w, b, x, e[d + 2], 15, 718787259); x = c(x, T, w, b, e[d + 9], 21, -343485551); b = f(b, m); x = f(x, y); T = f(T, v); w = f(w, g); } return Array(b, x, T, w); } function a(e, n, r, o, a, s) { return f(d(f(f(n, e), f(o, s)), a), r); } function s(e, n, r, o, s, l, u) { return a(n & r | ~n & o, e, n, s, l, u); } function l(e, n, r, o, s, l, u) { return a(n & o | r & ~o, e, n, s, l, u); } function u(e, n, r, o, s, l, u) { return a(n ^ r ^ o, e, n, s, l, u); } function c(e, n, r, o, s, l, u) { return a(r ^ (n | ~o), e, n, s, l, u); } function f(e, n) { var o = (65535 & e) + (n & 65535), a = (e >> 16) + (n >> 16) + (o >> 16); return a << 16 | o & 65535; } function d(e, n) { return e << n | e >>> 32 - n; } function p(e) { for (var r = Array(), o = 65535, a = 0; a < e["length"] * 16; a += 16) r[a >> 5] |= (e["charCodeAt"](a / 16) & o) << a % 32; return r; } function h(e) { for (var r = "0123456789abcdef", o = "", a = 0; a < e["length"] * 4; a++) o += r["charAt"](15 & e[a >> 2] >> a % 4 * 8 + 4) + r["charAt"](15 & e[a >> 2] >> a % 4 * 8); return o; } return function (e) { return h(o(p(e), 16 * e["length"])); }(e);}代碼合并后，運行不再報錯。很快就寫出了?Python代碼:
# -*- coding: utf-8 -*-import timeimport execjsimport requestsdef main(): sums = 0 headers = {"User-Agent": "yuanrenxue.project",} with open("decode_16.js","r",encoding = "utf-8") as fp: jscode = fp.read() ctx = execjs.compile(jscode) for i in range(1, 6): t = str(int(time.time()*1000)) m = ctx.call("btoa",t) params = { "m":m, "page":i, "t":t, } response = requests.get(url="http://match.yuanrenxue.com/api/match/16",params = params,headers=headers).json() for each in response["data"]: sums += each["value"] print(sums) # 287383if __name__ == "__main__": main()對于這個webpack打包的網站來說，基本沒啥難度吧，先優化一波，去混淆，刪除垃圾代碼，再缺啥補啥就好，瀏覽器相關的都不用補。
當然，webpack也有技巧，不過很少用的，無腦摳就好，然后缺啥補啥。
我也不喜歡一大坨代碼搞在一起，簡單點，事情簡單點，心情或許會好很多。
