安卓渗透第四弹-Reqable抓包神器安装使用&自动化脚本解密

https://reqable.com/en-US/download

# API Docs: https://reqable.com/docs/capture/addonsfrom reqable import *import base64import hashlibfrom urllib.parse import quotefrom Crypto.Cipher import DESfrom Crypto.Util.Padding import pad, unpadclass DuDu:    def __init__(self, key, iv):        if key is None:            raise ValueError("Parameter is null!")        self.init_cipher(key.encode(), iv.encode())    def init_cipher(self, sec_key, sec_iv):        md5 = hashlib.md5()        md5.update(sec_key)        des_key = md5.digest()[:8]  # DES uses an 8-byte key        self.iv = sec_iv[:8]  # DES uses an 8-byte IV        self.en_cipher = DES.new(des_key, DES.MODE_CBC, self.iv)        self.de_cipher = DES.new(des_key, DES.MODE_CBC, self.iv)    def encrypt64(self, data):        padded_data = pad(data, DES.block_size)        encrypted_bytes = self.en_cipher.encrypt(padded_data)        return base64.b64encode(encrypted_bytes).decode()    def decrypt64(self, data):        encrypted_data = base64.b64decode(data)        decrypted_data = self.de_cipher.decrypt(encrypted_data)        return unpad(decrypted_data, DES.block_size).decode()    def sign(self, data):        append = "sdlkjsdljf0j2fsjk"        # 将 JSON 字符串转换为字典        param_map = dict(item.split(":") for item in data.replace("{", "").replace("}", "").split(","))        # 对字典中的键进行排序        sorted_keys = sorted(param_map.keys())        # 拼接参数字符串        param_str = "&".join([f"{key}={quote(param_map[key].strip().replace('"', ''))}" for key in sorted_keys if key != "sign"])        param_str += f"&key={quote(append)}"        print("sign明文:", param_str)        # 对拼接后的参数字符串进行 MD5 加密        md5 = hashlib.md5()        md5.update(param_str.encode())        return md5.hexdigest().upper()def onRequest(context, request):    data = request.body.payload    start_index = data.find('"Encrypt":"') + len('"Encrypt":"')    end_index = data.find('"', start_index)    encrypted_str = data[start_index:end_index]    cleaned_str = encrypted_str.replace(' ', '').replace('\n', '')    # print(cleaned_str)    du = DuDu("65102933", "32028092")    decrypted_string = du.decrypt64(cleaned_str)    print("body明文:", decrypted_string)    print("sign密文:", du.sign(decrypted_string))    return requestdef onResponse(context, response):    return response