顶好的JS反爬破解——有道翻译

爱被打了一巴掌 2022-12-19 03:55 219阅读 0赞

嘿 大漂亮大帅逼，老Amy又来了~大家好像对JS反爬都非常感兴趣，而这方面的资料也是少之又少，毕竟难度系数也是有的…emmm，所以今天再次来学习这顶好的JS反爬之有道翻译

#### 需求 ####

1.打开有道翻译 http://fanyi.youdao.com/

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ_size_16_color_FFFFFF_t_70_pic_center]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ_size_16_color_FFFFFF_t_70_pic_center 1]  
输入hello后抓包的请求为post，所以在发送请求时是有一系列的参数的。而这些参数我们需要知道哪些是变化的，哪些是不变的，所以多加载几个。观察如下：

*  输入hello的参数

i: hello
    from: AUTO
    to: AUTO
    smartresult: dict
    client: fanyideskweb
    salt: 16044875956897
    sign: f2e025a59410a41c04bec2f3194737be
    lts: 1604487595689
    bv: 4abf2733c66fbf953861095a23a839a8
    doctype: json
    version: 2.1
    keyfrom: fanyi.web
    action: FY_BY_CLICKBUTTION

*  输入china的参数

i: china
    from: AUTO
    to: AUTO
    smartresult: dict
    client: fanyideskweb
    salt: 16044880196198
    sign: 5a575b04ba07b4eae33de58448356d48
    lts: 1604488019619
    bv: 4abf2733c66fbf953861095a23a839a8
    doctype: json
    version: 2.1
    keyfrom: fanyi.web
    action: FY_BY_CLICKBUTTION

总结如下：

*  变动参数
    
     *  i
     *  salt
     *  sign
     *  lts

现在我们就着重来关注变动的参数。因为这些参数好像都是随机生成的，我们人为很难去揣测参数的生成，那应该就是代码控制生成的，揣测是JS加密出来的结果。

于是我们回到抓包处，看到Initiator，此处是该链接所涉及到的JS文件。

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ_size_16_color_FFFFFF_t_70_pic_center 2]  
在此处Ctrl+F搜索sign

*  1.对需要执行的行进行点击打断点，变为蓝色的
 *  2.点击翻译
 *  3.执行往下走

function md5(e) {
        var t, n, i, a, o, s, m, g, v, y = Array();
        for (e = h(e),
                 y = f(e),
                 s = 1732584193,
                 m = 4023233417,
                 g = 2562383102,
                 v = 271733878,
                 t = 0; t < y.length; t += 16)
            n = s,
                i = m,
                a = g,
                o = v,
                s = l(s, m, g, v, y[t + 0], 7, 3614090360),
                v = l(v, s, m, g, y[t + 1], 12, 3905402710),
                g = l(g, v, s, m, y[t + 2], 17, 606105819),
                m = l(m, g, v, s, y[t + 3], 22, 3250441966),
                s = l(s, m, g, v, y[t + 4], 7, 4118548399),
                v = l(v, s, m, g, y[t + 5], 12, 1200080426),
                g = l(g, v, s, m, y[t + 6], 17, 2821735955),
                m = l(m, g, v, s, y[t + 7], 22, 4249261313),
                s = l(s, m, g, v, y[t + 8], 7, 1770035416),
                v = l(v, s, m, g, y[t + 9], 12, 2336552879),
                g = l(g, v, s, m, y[t + 10], 17, 4294925233),
                m = l(m, g, v, s, y[t + 11], 22, 2304563134),
                s = l(s, m, g, v, y[t + 12], 7, 1804603682),
                v = l(v, s, m, g, y[t + 13], 12, 4254626195),
                g = l(g, v, s, m, y[t + 14], 17, 2792965006),
                m = l(m, g, v, s, y[t + 15], 22, 1236535329),
                s = c(s, m, g, v, y[t + 1], 5, 4129170786),
                v = c(v, s, m, g, y[t + 6], 9, 3225465664),
                g = c(g, v, s, m, y[t + 11], 14, 643717713),
                m = c(m, g, v, s, y[t + 0], 20, 3921069994),
                s = c(s, m, g, v, y[t + 5], 5, 3593408605),
                v = c(v, s, m, g, y[t + 10], 9, 38016083),
                g = c(g, v, s, m, y[t + 15], 14, 3634488961),
                m = c(m, g, v, s, y[t + 4], 20, 3889429448),
                s = c(s, m, g, v, y[t + 9], 5, 568446438),
                v = c(v, s, m, g, y[t + 14], 9, 3275163606),
                g = c(g, v, s, m, y[t + 3], 14, 4107603335),
                m = c(m, g, v, s, y[t + 8], 20, 1163531501),
                s = c(s, m, g, v, y[t + 13], 5, 2850285829),
                v = c(v, s, m, g, y[t + 2], 9, 4243563512),
                g = c(g, v, s, m, y[t + 7], 14, 1735328473),
                m = c(m, g, v, s, y[t + 12], 20, 2368359562),
                s = u(s, m, g, v, y[t + 5], 4, 4294588738),
                v = u(v, s, m, g, y[t + 8], 11, 2272392833),
                g = u(g, v, s, m, y[t + 11], 16, 1839030562),
                m = u(m, g, v, s, y[t + 14], 23, 4259657740),
                s = u(s, m, g, v, y[t + 1], 4, 2763975236),
                v = u(v, s, m, g, y[t + 4], 11, 1272893353),
                g = u(g, v, s, m, y[t + 7], 16, 4139469664),
                m = u(m, g, v, s, y[t + 10], 23, 3200236656),
                s = u(s, m, g, v, y[t + 13], 4, 681279174),
                v = u(v, s, m, g, y[t + 0], 11, 3936430074),
                g = u(g, v, s, m, y[t + 3], 16, 3572445317),
                m = u(m, g, v, s, y[t + 6], 23, 76029189),
                s = u(s, m, g, v, y[t + 9], 4, 3654602809),
                v = u(v, s, m, g, y[t + 12], 11, 3873151461),
                g = u(g, v, s, m, y[t + 15], 16, 530742520),
                m = u(m, g, v, s, y[t + 2], 23, 3299628645),
                s = d(s, m, g, v, y[t + 0], 6, 4096336452),
                v = d(v, s, m, g, y[t + 7], 10, 1126891415),
                g = d(g, v, s, m, y[t + 14], 15, 2878612391),
                m = d(m, g, v, s, y[t + 5], 21, 4237533241),
                s = d(s, m, g, v, y[t + 12], 6, 1700485571),
                v = d(v, s, m, g, y[t + 3], 10, 2399980690),
                g = d(g, v, s, m, y[t + 10], 15, 4293915773),
                m = d(m, g, v, s, y[t + 1], 21, 2240044497),
                s = d(s, m, g, v, y[t + 8], 6, 1873313359),
                v = d(v, s, m, g, y[t + 15], 10, 4264355552),
                g = d(g, v, s, m, y[t + 6], 15, 2734768916),
                m = d(m, g, v, s, y[t + 13], 21, 1309151649),
                s = d(s, m, g, v, y[t + 4], 6, 4149444226),
                v = d(v, s, m, g, y[t + 11], 10, 3174756917),
                g = d(g, v, s, m, y[t + 2], 15, 718787259),
                m = d(m, g, v, s, y[t + 9], 21, 3951481745),
                s = r(s, n),
                m = r(m, i),
                g = r(g, a),
                v = r(v, o);
        return (p(s) + p(m) + p(g) + p(v)).toLowerCase()
    }

那现在，我们需要使用python去模拟这个JS代码，但是会发现…哇好长呀。那现在我们需要介绍神器——pyexecjs。该库是python用来执行JS代码的，在tool.py中具体代码如下：

import execjs
    
    
    def get_js_function(js_path, func_name, func_args):
        with open(js_path, encoding="utf-8") as f:
            js = f.read()
            ctx = execjs.compile(js)
            return ctx.call(func_name, func_args)
    
    
    res = get_js_function("youdao.js","md5","hello")
    print(res)

执行代码报错：

execjs._exceptions.ProgramError: ReferenceError: h is not defined

也就是说，h函数没有找到，我们则需要去找h函数的定义。

*  1.进入md5
 *  2.给8198行打断点
 *  3.给h(e)打断点
 *  4.进入下一步

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ_size_16_color_FFFFFF_t_70_pic_center 5]  
跳转如下：

5d41402abc4b2a76b9719d911017c592

现在，我们想输出所有的可变参数，所以将以下复制到JS里面。

![在这里插入图片描述][20201105141444210.png_pic_center]  
但是发现navigator.appVersion又是一个未知的东西，所以我们来找传进去md5的参数e是啥。如下图，发现e好像是我们的UA…于是代码如下：

![在这里插入图片描述][20201105142046167.png_pic_center]

function youdao(e) {
        var t = md5("5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36")
          , r = "" + (new Date).getTime()
          , i = r + parseInt(10 * Math.random(), 10);
        return {
            lts: r,
            bv: t,
            salt: i,
            sign: md5("fanyideskweb" + e + i + "]BjuETDhU)zqSxf-=B#7m")
        }
    };

OK，我们再来执行youdao.py

from tool import get_js_function
    
    dic = get_js_function("youdao.js","youdao","hello")
    print(dic)

输出如下：

{'lts': '1604557839594', 'bv': '4abf2733c66fbf953861095a23a839a8', 'salt': '16045578395947', 'sign': 'e4eef867494f2768a324d0f8e1502abe'}

奥啦啦，那么这些动态参数就被我们全部破解完毕啦~代码什么都非常简单，不过JS代码就很长，我就不重复写啦！如果有需要的话可以扫码关注以下公众号，留言：有道翻译 获取完整代码奥

![在这里插入图片描述][2020110514342489.gif_pic_center]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ_size_16_color_FFFFFF_t_70_pic_center]: /images/20221120/2b2aafb1c5f042ff9be346f92829a7b6.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ_size_16_color_FFFFFF_t_70_pic_center 1]: https://img-blog.csdnimg.cn/20201105134218893.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ_size_16_color_FFFFFF_t_70_pic_center 2]: https://img-blog.csdnimg.cn/20201105134921819.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ_size_16_color_FFFFFF_t_70_pic_center 3]: https://img-blog.csdnimg.cn/20201105134951616.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ_size_16_color_FFFFFF_t_70_pic_center 4]: https://img-blog.csdnimg.cn/20201105135037655.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ_size_16_color_FFFFFF_t_70_pic_center 5]: https://img-blog.csdnimg.cn/20201105141119717.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ_size_16_color_FFFFFF_t_70_pic_center 6]: https://img-blog.csdnimg.cn/20201105141331453.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80NDM1Mjk4MQ==,size_16,color_FFFFFF,t_70#pic_center
[20201105141444210.png_pic_center]: https://img-blog.csdnimg.cn/20201105141444210.png#pic_center
[20201105142046167.png_pic_center]: https://img-blog.csdnimg.cn/20201105142046167.png#pic_center
[2020110514342489.gif_pic_center]: https://img-blog.csdnimg.cn/2020110514342489.gif#pic_center