Shulou(Shulou.com)06/01 Report--

This article mainly explains "how to achieve Python encryption", the content of the article is simple and clear, easy to learn and understand, the following please follow the editor's ideas slowly in depth, together to study and learn "how to achieve Python encryption"!

Target website:

AHR0cHM6Ly9wYXNzcG9ydC41OC5jb20vbG9naW4vP3BhdGg9aHR0cHMlM0EvL2Z6LjU4LmNvbS8mUEdUSUQ9MGQxMDAwMDAtMDAxMy0wMjk0LTFjZWItYjU3NTBiZDIwNmU5JkNsaWNrSUQ9Mg==

Packet capture Analysis and encryption location

The old rule is to grab the bag and have a look at it [figure 1-1]

Figure 1-1

Today, we mainly analyze the three parameters of underlining. Let's study them one by one first.

First look at the encryption of the password, according to the previous idea, we tested the relevant search terms of password, but the search results are not satisfactory. [figure 1-2]

At the same time, this request is not a XHR request, so the xhr breakpoint is not needed.

Figure 1-2

The more relevant part of the search results is the part marked in [figure 1-2], but the encrypted location cannot be found by searching for password in the search term of the file.

I briefly summarized several methods, although it is not necessarily applicable to the encryption of other websites, which can be regarded as a new way of thinking.

First, search for relevant prompts, just like in the first APP reverse project I did before, I searched for related prompts and found the code of deduction logic, which can be followed here.

Click to log in in the encryption of this site, click the button to log in. Search for relevant prompts and then gradually break the point and keep chasing the encryption location, but this is a bad policy, it takes too long, it is easy to lose, for this is not worth it. (not recommended)

Second, refer to the method of searching keywords at the beginning, where the search is encrypt, and you often encounter encrypted variables or methods in the form of encrypt (XX).

Third, try to find the answer from the web page, I have done some simple examples before is to write the js code directly to the page for self-execution or to pass values in a hidden field, such as: more characteristic values such as PublicKey, if we can find it is of great help.

According to the methods summarized above, we search again [figure 1-3]

Figure 1-3

Search for this familiar file again, this time we went in to search, this time found a lot of similar encryption places, in order to save trouble, I put all the relevant values on the breakpoint, log in again. [figure 1-4]

Figure 1-4

When we get here, we'll locate the encrypted place.

Continue to chase in and you can see that what you enter is a VM [figure 1-5]

Figure 1-5

There is no difficulty here, the encryption of the password is RSA + eval.

If you are lucky to find the eval encryption first, but do not know how to solve it, you can refer to the previous article on js confusion.

Click me to read the article.

Or open the developer tool of the browser directly, switch to the console tab, paste the relevant eval code in, and replace the eval at the beginning of the code with console.log, and you can get the original code. [figure 1-6]

Figure 1-6

Next look at the two fingerprint-related parameters, here is relatively simple, directly search fingerprint can find the relevant encrypted files, directly in the break point on it. [figure 1-7]

The note here is that if you want to regenerate the fingerprint, remember to refresh the page.

Thank you for your reading, the above is the content of "how to achieve Python encryption", after the study of this article, I believe you have a deeper understanding of how to achieve Python encryption, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.