JSRPC|看不懂加密方式？稳了！以金融为例且提供最终样板脚本

mitmdump-p6666-s main.py --mode upstream:http://127.0.0.1:6662 --ssl-insecure

def__init__(self,host:str, // 主机port:int, // 端口method:bytes, // HTTP请求方法，例如“GET”。scheme:bytes, // HTTP请求方案，应为“http”或“https”。authority:bytes, // HTTP 请求权限path:bytes, // 路径http_version:bytes,headers:Headers | tuple[tuple[bytes, bytes], ...],content:bytes | None,trailers:Headers | tuple[tuple[bytes, bytes], ...] | None,timestamp_start:float,timestamp_end:float | None):

def __init__(        self,        http_version: bytes,        status_code: int,        reason: bytes,        headers: Headers | tuple[tuple[bytes, bytes], ...],        content: bytes | None,        trailers: None | Headers | tuple[tuple[bytes, bytes], ...],        timestamp_start: float,        timestamp_end: float | None,)

functionHlclient(wsURL){this.wsURL = wsURL;this.handlers = {_execjs:function(resolve, param){varres =eval(param)if(!res) {resolve("没有返回值")}else{resolve(res)}}};this.socket =undefined;if(!wsURL) {thrownewError('wsURL can not be empty!!')}this.connect()}Hlclient.prototype.connect =function(){console.log('begin of connect to wsURL: '+this.wsURL);var_this =this;try{this.socket =newWebSocket(this.wsURL);this.socket.onmessage =function(e){_this.handlerRequest(e.data)}}catch(e) {console.log("connection failed,reconnect after 10s");setTimeout(function(){_this.connect()},10000)}this.socket.onclose =function(){console.log('rpc已关闭');setTimeout(function(){_this.connect()},10000)}this.socket.addEventListener('open', (event) => {console.log("rpc连接成功");});this.socket.addEventListener('error', (event) => {console.error('rpc连接出错,请检查是否打开服务端:', event.error);});};Hlclient.prototype.send =function(msg){this.socket.send(msg)}Hlclient.prototype.regAction =function(func_name, func){if(typeoffunc_name !=='string') {thrownewError("an func_name must be string");}if(typeoffunc !=='function') {thrownewError("must be function");}console.log("register func_name: "+ func_name);this.handlers[func_name] = func;returntrue}//收到消息后这里处理，Hlclient.prototype.handlerRequest =function(requestJson){var_this =this;try{varresult =JSON.parse(requestJson)}catch(error) {console.log("catch error", requestJson);result = transjson(requestJson)}//console.log(result)if(!result['action']) {this.sendResult('','need request param {action}');return}varaction = result["action"]vartheHandler =this.handlers[action];if(!theHandler) {this.sendResult(action,'action not found');return}try{if(!result["param"]) {theHandler(function(response){_this.sendResult(action, response);})return}varparam = result["param"]try{param =JSON.parse(param)}catch(e) {}theHandler(function(response){_this.sendResult(action, response);}, param)}catch(e) {console.log("error: "+ e);_this.sendResult(action, e);}}Hlclient.prototype.sendResult =function(action, e){if(typeofe ==='object'&& e !==null) {try{e =JSON.stringify(e)}catch(v) {console.log(v)//不是json无需操作}}this.send(action + atob("aGxeX14") + e);}functiontransjson(formdata){varregex =/"action":(?<actionName>.*?),/gvaractionName = regex.exec(formdata).groups.actionNamestringfystring = formdata.match(/{..data..:.*..w+..:s...*?..}/g).pop()stringfystring = stringfystring.replace(/\"/g,'"')paramstring =JSON.parse(stringfystring)tens =`{"action":`+ actionName +`,"param":{}}`tjson =JSON.parse(tens)tjson.param = paramstringreturntjson}

var demo = new Hlclient("ws://127.0.0.1:12080/ws?group=zzz");

demo.regAction("encode", function (resolve,param) {    //这样添加了一个param参数，http接口带上它，这里就能获得    var ret = window.hook(JSON.stringify(param))    resolve(ret);})

curl 'http://127.0.0.1:12080/go?group=zzz&action=encode&param='curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36' -d 'action=encode&group=zzz&param=' 'http://127.0.0.1:12080/go'

import requestsheaders = {    'Content-Type': 'application/x-www-form-urlencoded'}data = {    'action': 'encode',    'group': 'zzz',    'param': '',}response = requests.post('http://127.0.0.1:12080/go', headers=headers, data=data)

import requestsdef getRpc(param,method):    headers = {        'Content-Type': 'application/x-www-form-urlencoded'    }    data = {        'action': method,        'group': 'zzz',        'param': param    }    resJson = requests.post('http://127.0.0.1:12080/go', headers=headers, data=data).json()    return resJson["data"]def encode(param):    return getRpc(param, 'encode')def decode(param):    return getRpc(param, 'decode')print(encode('{"username":"admin","password":"123456","code":"2","uuid":"xxxxx"}'))

import requestsimport mitmproxyfrom mitmproxy import http,ctxfrom mitmproxy import flowfilterdef encode(param):    return getRpc(param, 'encode')def decode(param):    return getRpc(param, 'decode')def getRpc(param,method):    headers = {        'Content-Type': 'application/x-www-form-urlencoded'    }    data = {        'action': method,        'group': 'zzz',        'param': param    }    resJson = requests.post('http://127.0.0.1:12080/go', headers=headers, data=data).json()    return resJson["data"]# mitm核心处理逻辑class Interceptor:    def __init__(self):        pass    def request(self, flow: mitmproxy.http.HTTPFlow):        request = flow.request        # 直接将请求体进行一次加密处理        request.content = encode(request.content).encode('utf-8')        # 日志模块        ctx.log.info(request.content)    def response(self, flow: mitmproxy.http.HTTPFlow):        passaddons = [    Interceptor()]

demo.regAction("decode", function (resolve,param) {    //这样添加了一个param参数，http接口带上它，这里就能获得    var ret = window.decode(param)    resolve(ret);})

import requestsimport mitmproxyfrom mitmproxy import http,ctxfrom mitmproxy import flowfilterinfo = ctx.log.info# 加密方法def encode(param):    return getRpc(param, 'encode')# 解密方法def decode(param):    return getRpc(param, 'decode')# 获取RPC调用方法def getRpc(param,method):    headers = {        'Content-Type': 'application/x-www-form-urlencoded'    }    data = {        'action': method,        'group': 'zzz',        'param': param    }    resJson = requests.post('http://127.0.0.1:12080/go', headers=headers, data=data).json()    return resJson["data"]class Hook:    def __init__(self):        pass    # 处理request请求    def request(self, flow: mitmproxy.http.HTTPFlow):        request = flow.request        info("=======Request修改前:" + str(request.content) + "=======")        request.content = encode(request.content).encode('utf-8')        info("=======Request修改后:" + str(request.content) + "=======")    # 处理response请求    def response(self, flow: mitmproxy.http.HTTPFlow):        response = flow.response        info("=======Response修改前:" + response.text + "=======")        response.text = decode(response.text)        info("=======Response修改后:" + response.text + "=======")addons = [    Hook()]

mitmdump -p 6666 -s beforeRpc.py  --mode upstream:http://127.0.0.1:65530 --ssl-insecure

import jsonimport requestsimport mitmproxyfrom mitmproxy import http,ctxfrom mitmproxy import flowfilterinfo = ctx.log.info# 工具方法def is_valid_json(text):    try:        json.loads(text)        return True    except json.JSONDecodeError:        return False# signdef rpcSign(param):    return getRpc(param, 'sign')# 加密方法def rpcEncode(param):    return getRpc(param, 'encode')# 解密方法def rpcDecode(param):    return getRpc(param, 'decode')# 获取RPC调用方法def getRpc(param,method):    headers = {        'Content-Type': 'application/x-www-form-urlencoded'    }    data = {        'action': method,        'group': 'zzz',        'param': param    }    resJson = requests.post('http://127.0.0.1:12080/go', headers=headers, data=data).json()    return resJson["data"]# 处理Param模式def changeRequestParam(reqObj):    reqObj.query.set_all("要修改的key", ["要修改的任意类型,又可以改为encode(xxx)"])    info(reqObj.query)# 处理Form模式def changeRequestForm(reqObj):    reqObj.urlencoded_form["要修改的key"] = "要修改的任意类型,又可以改为encode(xxx)"    info(reqObj.urlencoded_form)# 处理JSON模式def changeRequestJson(reqObj):    if reqObj.headers["Content-Type"].find("application/json") != -1:        if len(str(reqObj.content)) != 0:            if is_valid_json(reqObj.content):                # 说明传入的是JSON                jsonObj = json.loads(reqObj.content)                jsonObj["要修改的key"] = "要修改的任意类型,又可以改为encode(xxx)"                reqObj.content = json.dumps(jsonObj).encode('utf-8')                info(reqObj.content)# 处理整个请求体都为加密时def changeRquestBody(reqObj):     reqObj.content = rpcEncode(reqObj.content).encode('utf-8')     info(reqObj.content)# 处理请求头加密时候def changeRequestHeaders(reqObj):    reqObj.headers["Sign1"] = "要修改的任意类型,又可以改为sign(xxx)"# 响应全加密时候def changeResponseBody(reqObj):    reqObj.text = rpcDecode(reqObj.text)    info(reqObj.text)# 响应为json且部分加密的时候def changeResponseJson(reqObj):    if reqObj.headers["Content-Type"].find("application/json") != -1:         if len(str(reqObj.content)) != 0:              if is_valid_json(reqObj.content):                    jsonObj = json.loads(reqObj.content)                    jsonObj["要修改的key"] = "要修改的任意类型,又可以改为encode(xxx)"                    reqObj.content = json.dumps(jsonObj).encode('utf-8')                    info(reqObj.content)# 请求处理最终控制器(只需要改这里启用)def totalRequest(reqObj):    # changeRquestBody(reqObj)    pass# 响应处理最终控制器(只需要改这里启用)def totalResponse(reqObj):    # changeResponseJson(reqObj)    passclass Hook:    def __init__(self):        pass    # 处理request请求    def request(self, flow: mitmproxy.http.HTTPFlow):        request = flow.request        totalRequest(request)    # 处理response请求    def response(self, flow: mitmproxy.http.HTTPFlow):        response = flow.response        totalResponse(response)addons = [    Hook()]