This is the third day of my participation in the August More text Challenge. For details, see:August is more challenging

Today’s web site

aHR0cHM6Ly93d3cuZGlhbnBpbmcuY29tL3Nob3AvRzNybjh4bEtUR2Q1c0JZeQ==

For a long time did not write Js reverse technology, the original logic is very clear articles stumble the whole of a little long

Packet capture analysis and encryption location

A review that’s not logged in doesn’t get much information, but that doesn’t stop us from exploring its encryption

Open the page, directly find the following request

The right border is selected to analyze the encryption parameter _token

# Review several ways to locate2. XHR breakpoint can be used for XHR request, which is simple and convenient but has certain limitations. 3Copy the code

From ear to ear on the above several methods, unfamiliar can try more

We use the third method of analyzing the stack to locate the following Js logic

You can see that the requests are going through here

Line 116 has no _token

The _token value appears in line 118

So after 117 rows, the _token value is generated

Encryption logic analysis

Reload, enter 117 lines of function h logic

Now put a breakpoint on the return value of this method to avoid running logic

One step analysis shows that

R is the & concatenation of the parameter name and parameter value in parameter eCopy the code

The main logic is still in I. Loop

Continue to step debugging and find that the logic before ip.sign is also for parameter parsing, and the parameters in the previous step and the concatenation of the form of key and value pairs, is resolved into an object in JS

Then pass that object into the iJ method, and that’s part of the _token logic

We can see that ck is to sort the parameter key, which is convenient for back-end verification, the same parameter can get the same encryption result, and then the above object is divided into parameter name = parameter and amending

It’s just back and forth

And then you actually get into the logic of encryption

var iI = function(jc) {
                    jc = cD.deflate(JSON.stringify(jc));
                    jc = iD(jc);
                    return jc
                };
Copy the code

The first step is to compress the data (defalte is a Zlib-based compression algorithm)

The second step is to take the result of the first step base64

The encrypted result is then returned

Then go back to the upper layer iP. CTS and assign the parameter CTS again, and the iP will look like this

Note that _token is the result of iI(iP)

To verify the above analysis, let’s write a code validation

Now that we know the logic of _token, let’s take a segment of _token and test it to see if it can be restored to the iP above

Results The test results are consistent with the browser, decompressing the sign contained in the data once requires another logic to get the plaintext.

Well, that’s all for today’s article. See you next time