注意?。。?！某XX網站逆向實例僅作為學習案例，禁止其他個人以及團體做謀利用途?。?！
第一步：抓包工具第一次請求頁面，得到響應。本次我使用的fiddle進行抓包，可以直接請求得到響應，響應內容一樣。發(fā)現(xiàn)響應內容是不可直接用的內容，但是有明確的cookie關鍵詞，同時響應里的headers得到了set-cookie的值
?第二步：抓包工具第二次請求。將第一次請求拿到的cookie放在請求headers 里再次請求，同時將步驟一里響應內容進行解析。也就是圖里的cookie的兩個值。（看不懂的等下看代碼吧）
?第三步：抓包工具第三次請求?？梢钥吹降玫搅苏_的頁面響應內容，同時cookie值也和前兩次的不一樣
?第四步：這里將是一段描述梳理一下每次請求的作用
第一次請求：響應內容為混淆后的cookie值，該cookie作用為第二次請求的必要條件；
第二次請求：響應內容為混淆后的cookie值，該cookie作用為最終請求的必要條件；
最終請求：響應內容為我們看到的頁面內容。
第五步：解析第一次請求的響應內容。通過正則表達式 將cookie內容取出，利用eval() 函數(shù)直接在本地或者瀏覽器的console 就可以直接解析。
第步六：注意啦！?。?！這步開始容易豬豬迷惑了。分析并解析第二次請求的響應內容。根據(jù)觀察響應內容為ob 混淆加密建議找個工具或者用什么方法進行解密。(可以參考JS逆向 | ob混淆一鍵還原工具_js反混淆還原工具_丁仔.的博客-CSDN博客和GitHub - DingZaiHub/ob-decrypt: ob混淆還原工具，歡迎star！親測用著還可以).這里可以使用hook方式進行解析，在瀏覽器中按照圖所示進行操作
?第七步：將一大坨響應內容進行ob混淆解密操作，沒有工具這部可以忽略。為方便分析，我將第二次響應內容存在本地.html 文件。將ob混淆代碼另存在.js 文件，使用工具進行解密，成功后把解密后的js代碼替換本地.html中的js 內容。
?
?
第八步：在 .html 中補充 debugger 關鍵詞，同時將.html 文件復制到第六步新建的文件夾中?。此時瀏覽器上會自動識別，按圖勾選即可。由于我們分析解析目的是為了找cookie，因此和cookie有關的就是document ,所以在替換文件里 搜索?document ，找到后打上斷點。
?
第九步：清除瀏覽器上的cookie重新請求，注意清除cookie后會首先斷在debugger處，接著按下F8(藍色的按鈕，執(zhí)行下一個斷點)就可以。執(zhí)行到document['cookie'] 處可以看到已經被賦值，直接看一下被哪些所賦值，可以看到標紅處就是我們需要的cooke
?第十一步：找cookie出處。
?
?第十二步：cookie生成包含兩個參數(shù)，均是從同一個對象中獲取的，將該對象進行全局所有找到其出處
?
最后代碼展示?文章來源：http://www.zghlxwxcb.cn/news/detail-612763.html
# 注意啦！?。。。。。∮捎趃o方法傳的參數(shù)不是固定值且 “ha”加密方式也不一樣。因此代碼里才有顯示三種方式，目前我只遇到三種。后面有的話在補充。
import json
import re
import execjs
import requests
s = requests.session()
url = 'https://XXXXX.gov.cn/#/Integrated/index'
headers = {'User-Agent':'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36'}
# 第一次請求
res = s.get(url=url, headers=headers, verify=False)
print(res.text)
n_cookies = requests.utils.dict_from_cookiejar(s.cookies)
res.encoding='utf-8'
jsl = ''.join(re.findall(r'document\.cookie=(.*?);location', res.text))
cookie = execjs.eval(jsl)
n_k = cookie.split(';')[0].split('=')[0]
n_v = cookie.split(';')[0].split('=')[1]
n_cookies.update({n_k:n_v})
coock = ''
for k, v in n_cookies.items():
coock += k+'='+v+';'
headers['Cookie'] = coock.strip(';')
# 第二次請求
res = s.get(url=url, headers=headers, verify=False)
res.encoding='utf-8'
with open('./域名.html', 'w', encoding='utf-8')as f:
f.write(res.text)
f.close()
go_data = json.loads(''.join(re.findall(r';go\((.*)\)', res.text)))
ha = go_data.get('ha','')
if ha == 'md5':
file = '域名_md5.js'
elif ha == 'sha1':
file = '域名_sha1.js'
elif ha == 'sha256':
file = '域名_sha256.js'
else:
file = '域名'
print(res.text)
with open('./{}'.format(file), 'r', encoding='utf-8')as f:
infos = ''.join(f.readlines())
f.close()
ctx = execjs.compile(infos)
cookie = ctx.call("go",go_data)
# 第三次請求
headers['Cookie'] = headers['Cookie'].split(';')[0]+';__jsl_clearance_s='+cookie
url = 'https://XXXXX.gov.cn/'
res = requests.get(url=url, headers=headers)
res.encoding='utf-8'
print(res.text)
附件：生成cookie的js ----- sha1(直接在本地執(zhí)行即可)文章來源地址http://www.zghlxwxcb.cn/news/detail-612763.html
// sha1
function hash(_0x3e501b) {
var _0x1fb4f5 = {};
_0x1fb4f5['vcJIZ'] = function (_0x5e23c5, _0x29f030) {
return _0x5e23c5 ^ _0x29f030;
};
_0x1fb4f5['nnILZ'] = function (_0x589c24, _0x27233f) {
return _0x589c24 + _0x27233f;
};
_0x1fb4f5['tTwDl'] = function (_0x3cfed1, _0x22a05a) {
return _0x3cfed1 & _0x22a05a;
};
_0x1fb4f5['MfRVd'] = function (_0x3fc96c, _0x32c2a5) {
return _0x3fc96c >= _0x32c2a5;
};
_0x1fb4f5['fDweB'] = function (_0x808b4c, _0x45d31f) {
return _0x808b4c * _0x45d31f;
};
_0x1fb4f5['tUtAf'] = function (_0x2b4b54, _0x47bf25) {
return _0x2b4b54 >> _0x47bf25;
};
_0x1fb4f5['GlcUf'] = function (_0x56ff28, _0x51f0d9) {
return _0x56ff28 << _0x51f0d9;
};
_0x1fb4f5['Egxmp'] = function (_0x17e4a7, _0x154189) {
return _0x17e4a7 - _0x154189;
};
_0x1fb4f5['WtxKA'] = function (_0x13f1da, _0xcedb20) {
return _0x13f1da * _0xcedb20;
};
_0x1fb4f5['AUjcG'] = function (_0x56ede6, _0xce5419) {
return _0x56ede6 << _0xce5419;
};
_0x1fb4f5['aImhj'] = function (_0x15103f, _0x4d991e) {
return _0x15103f * _0x4d991e;
};
_0x1fb4f5['LZbSM'] = function (_0xbc81cb, _0x673e4) {
return _0xbc81cb - _0x673e4;
};
_0x1fb4f5['PCjCU'] = function (_0x30f142, _0x3add8c) {
return _0x30f142 < _0x3add8c;
};
_0x1fb4f5['uQyRR'] = function (_0x1bb4b9, _0xbd0d67) {
return _0x1bb4b9 | _0xbd0d67;
};
_0x1fb4f5['rBwUP'] = function (_0x50526a, _0x1b9c16) {
return _0x50526a & _0x1b9c16;
};
_0x1fb4f5['CVCuK'] = function (_0x1474de, _0x5433e8) {
return _0x1474de ^ _0x5433e8;
};
_0x1fb4f5['hMtHv'] = function (_0x144411, _0x566ba2) {
return _0x144411 < _0x566ba2;
};
_0x1fb4f5['OjxgU'] = function (_0x32770d, _0x584a87) {
return _0x32770d + _0x584a87;
};
_0x1fb4f5['kxupd'] = function (_0x5a63ba, _0x1a75ca, _0x11cb71) {
return _0x5a63ba(_0x1a75ca, _0x11cb71);
};
_0x1fb4f5['QZBIa'] = function (_0x36d06d, _0x573dc0) {
return _0x36d06d - _0x573dc0;
};
_0x1fb4f5['ahQNH'] = function (_0x521c6a, _0x44faed, _0x975942) {
return _0x521c6a(_0x44faed, _0x975942);
};
_0x1fb4f5['gZCtm'] = function (_0x3ecc1d, _0x683115, _0x26b6fb, _0x30262f, _0x3a4a9e) {
return _0x3ecc1d(_0x683115, _0x26b6fb, _0x30262f, _0x3a4a9e);
};
_0x1fb4f5['rXdRR'] = function (_0xd234a, _0x90bdc3, _0x433aa7) {
return _0xd234a(_0x90bdc3, _0x433aa7);
};
_0x1fb4f5['QTmzZ'] = function (_0x187211, _0x490abd) {
return _0x187211(_0x490abd);
};
_0x1fb4f5['RnoGt'] = function (_0x2e7670, _0x3f1cd3) {
return _0x2e7670(_0x3f1cd3);
};
var _0x43e73a = _0x1fb4f5;
function _0x2b41b9(_0x533e58, _0x74964d) {
return _0x43e73a['vcJIZ'](_0x43e73a['nnILZ'](_0x43e73a['tTwDl'](_0x533e58, 0x7fffffff), _0x43e73a['tTwDl'](_0x74964d, 0x7fffffff)), _0x43e73a['tTwDl'](_0x533e58, 0x80000000)) ^ _0x74964d & 0x80000000;
}
function _0x537251(_0x4c333c) {
var _0x52058c = '0123456789abcdef';
var _0x4661a5 = '';
for (var _0x3c067f = 0x7; _0x43e73a['MfRVd'](_0x3c067f, 0x0); _0x3c067f--) {
_0x4661a5 += _0x52058c['charAt'](_0x43e73a['tTwDl'](_0x4c333c >> _0x43e73a['fDweB'](_0x3c067f, 0x4), 0xf));
}
return _0x4661a5;
}
function _0xb227e2(_0x55acf7) {
var _0x59cbf2 = (_0x43e73a['nnILZ'](_0x55acf7['length'], 0x8) >> 0x6) + 0x1,
_0x1cf031 = new Array(_0x43e73a['fDweB'](_0x59cbf2, 0x10));
for (var _0x30e700 = 0x0; _0x30e700 < _0x59cbf2 * 0x10; _0x30e700++) {
_0x1cf031[_0x30e700] = 0x0;
}
for (_0x30e700 = 0x0; _0x30e700 < _0x55acf7['length']; _0x30e700++) {
_0x1cf031[_0x43e73a['tUtAf'](_0x30e700, 0x2)] |= _0x43e73a['GlcUf'](_0x55acf7['charCodeAt'](_0x30e700), _0x43e73a['Egxmp'](0x18, _0x43e73a['WtxKA'](_0x30e700 & 0x3, 0x8)));
}
_0x1cf031[_0x43e73a['tUtAf'](_0x30e700, 0x2)] |= _0x43e73a['AUjcG'](0x80, 0x18 - _0x43e73a['aImhj'](_0x30e700 & 0x3, 0x8));
_0x1cf031[_0x43e73a['LZbSM'](_0x59cbf2 * 0x10, 0x1)] = _0x43e73a['aImhj'](_0x55acf7['length'], 0x8);
return _0x1cf031;
}
function _0x3a304e(_0x5a8556, _0x130fdf) {
return _0x5a8556 << _0x130fdf | _0x5a8556 >>> 0x20 - _0x130fdf;
}
function _0x520671(_0x2d8c1c, _0x40483b, _0x15ba0f, _0x38aa47) {
if (_0x2d8c1c < 0x14) return _0x40483b & _0x15ba0f | _0x43e73a['tTwDl'](~_0x40483b, _0x38aa47);
if (_0x43e73a['PCjCU'](_0x2d8c1c, 0x28)) return _0x43e73a['vcJIZ'](_0x40483b ^ _0x15ba0f, _0x38aa47);
if (_0x2d8c1c < 0x3c) return _0x43e73a['uQyRR'](_0x40483b & _0x15ba0f, _0x40483b & _0x38aa47) | _0x43e73a['rBwUP'](_0x15ba0f, _0x38aa47);
return _0x43e73a['CVCuK'](_0x40483b, _0x15ba0f) ^ _0x38aa47;
}
function _0x29ed(_0x3d4ecb) {
return _0x3d4ecb < 0x14 ? 0x5a827999 : _0x3d4ecb < 0x28 ? 0x6ed9eba1 : _0x3d4ecb < 0x3c ? -0x70e44324 : -0x359d3e2a;
}
var _0x35db9f = _0xb227e2(_0x3e501b);
var _0xa676a2 = new Array(0x50);
var _0x1fe9ed = 0x67452301;
var _0x30040d = -0x10325477;
var _0x15967b = -0x67452302;
var _0x184d43 = 0x10325476;
var _0x441ea8 = -0x3c2d1e10;
for (var _0x2527e = 0x0; _0x43e73a['hMtHv'](_0x2527e, _0x35db9f['length']); _0x2527e += 0x10) {
var _0x242d65 = _0x1fe9ed;
var _0x111547 = _0x30040d;
var _0x570546 = _0x15967b;
var _0x36025e = _0x184d43;
var _0x56cb39 = _0x441ea8;
for (var _0x56c656 = 0x0; _0x56c656 < 0x50; _0x56c656++) {
if (_0x56c656 < 0x10) {
_0xa676a2[_0x56c656] = _0x35db9f[_0x43e73a['OjxgU'](_0x2527e, _0x56c656)];
} else {
_0xa676a2[_0x56c656] = _0x43e73a['kxupd'](_0x3a304e, _0x43e73a['CVCuK'](_0xa676a2[_0x43e73a['LZbSM'](_0x56c656, 0x3)] ^ _0xa676a2[_0x43e73a['LZbSM'](_0x56c656, 0x8)], _0xa676a2[_0x56c656 - 0xe]) ^ _0xa676a2[_0x43e73a['QZBIa'](_0x56c656, 0x10)], 0x1);
}
t = _0x43e73a['ahQNH'](_0x2b41b9, _0x2b41b9(_0x43e73a['ahQNH'](_0x3a304e, _0x1fe9ed, 0x5), _0x43e73a['gZCtm'](_0x520671, _0x56c656, _0x30040d, _0x15967b, _0x184d43)), _0x2b41b9(_0x43e73a['rXdRR'](_0x2b41b9, _0x441ea8, _0xa676a2[_0x56c656]), _0x29ed(_0x56c656)));
_0x441ea8 = _0x184d43;
_0x184d43 = _0x15967b;
_0x15967b = _0x3a304e(_0x30040d, 0x1e);
_0x30040d = _0x1fe9ed;
_0x1fe9ed = t;
}
_0x1fe9ed = _0x2b41b9(_0x1fe9ed, _0x242d65);
_0x30040d = _0x43e73a['rXdRR'](_0x2b41b9, _0x30040d, _0x111547);
_0x15967b = _0x2b41b9(_0x15967b, _0x570546);
_0x184d43 = _0x2b41b9(_0x184d43, _0x36025e);
_0x441ea8 = _0x43e73a['rXdRR'](_0x2b41b9, _0x441ea8, _0x56cb39);
}
return _0x43e73a['OjxgU'](_0x43e73a['OjxgU'](_0x43e73a['OjxgU'](_0x43e73a['QTmzZ'](_0x537251, _0x1fe9ed) + _0x43e73a['RnoGt'](_0x537251, _0x30040d), _0x43e73a['RnoGt'](_0x537251, _0x15967b)), _0x537251(_0x184d43)), _0x43e73a['RnoGt'](_0x537251, _0x441ea8));
}
function go(_0x268948) {
var _0x225662 = {};
_0x225662['yYDkD'] = function (_0x5126f0, _0x3b3575) {
return _0x5126f0 < _0x3b3575;
};
_0x225662['kvFwD'] = function (_0x16a4ff, _0x530f7e) {
return _0x16a4ff != _0x530f7e;
};
_0x225662['frrXH'] = function (_0x32c21a, _0x14e517) {
return _0x32c21a < _0x14e517;
};
_0x225662['SpsfD'] = function (_0x3e7e11, _0x1d6dba) {
return _0x3e7e11 == _0x1d6dba;
};
_0x225662['CoTAd'] = function (_0x31c498, _0x2b21b3) {
return _0x31c498(_0x2b21b3);
};
_0x225662['qvRxI'] = function (_0x489d0c, _0x2103a3) {
return _0x489d0c + _0x2103a3;
};
_0x225662['XOBkW'] = function (_0xd7f68f, _0x449d27) {
return _0xd7f68f + _0x449d27;
};
_0x225662['jjOHZ'] = function (_0x362da3) {
return _0x362da3();
};
_0x225662['KtJNL'] = function (_0x5a35c5, _0x102625, _0x42b3f4) {
return _0x5a35c5(_0x102625, _0x42b3f4);
};
_0x225662['sRcCE'] = function (_0x45e436, _0x1a4b8a) {
return _0x45e436 > _0x1a4b8a;
};
_0x225662['fjvps'] = function (_0xcd3d09, _0x797f52) {
return _0xcd3d09 - _0x797f52;
};
_0x225662['RFwHe'] = '請求驗證失敗';
var _0x55796d = _0x225662;
function _0x21c0a0() {
var _0x8c81c5 = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36',
_0x4f9c34 = ['Phantom'];
for (var _0x663d22 = 0x0; _0x55796d['yYDkD'](_0x663d22, _0x4f9c34['length']); _0x663d22++) {
if (_0x55796d['kvFwD'](_0x8c81c5['indexOf'](_0x4f9c34[_0x663d22]), -0x1)) {
return !![];
}
}
if (undefined) {
return !![];
}
};
if (_0x55796d['jjOHZ'](_0x21c0a0)) {
return;
}
var _0x5eb57d = new Date();
function _0x6c8612(_0x46fd88, _0xdc1245) {
var _0x3fca5a = _0x268948['chars']['length'];
for (var _0x35b219 = 0x0; _0x55796d['frrXH'](_0x35b219, _0x3fca5a); _0x35b219++) {
for (var _0x252718 = 0x0; _0x252718 < _0x3fca5a; _0x252718++) {
var _0x236c3d = _0xdc1245[0x0] + _0x268948['chars']['substr'](_0x35b219, 0x1) + _0x268948['chars']['substr'](_0x252718, 0x1) + _0xdc1245[0x1];
if (_0x55796d['SpsfD'](_0x55796d['CoTAd'](hash, _0x236c3d), _0x46fd88)) {
return [_0x236c3d, new Date() - _0x5eb57d];
}
}
}
};
var _0x375f7d = _0x55796d['KtJNL'](_0x6c8612, _0x268948['ct'], _0x268948['bts']);
return _0x375f7d[0]
};
cookie = go({
"bts": ["1690516426.653|0|rRT", "DKS8EVDzKevNzhePIdloyU%3D"],
"chars": "pycPPMayT9bXKYdZdnURpd",
"ct": "1073cc6066c93a07c810a5451165a7654310858a",
"ha": "sha1",
"tn": "__jsl_clearance_s",
"vt": "3600",
"wt": "1500"
})
console.log(cookie)
僅作為筆記記錄，如有問題請各位大佬來指導
到了這里，關于python爬蟲-加速樂cookie混淆解析實例小記的文章就介紹完了。如果您還想了解更多內容，請在右上角搜索TOY模板網以前的文章或繼續(xù)瀏覽下面的相關文章，希望大家以后多多支持TOY模板網！
