Itisstatedthatallthecontentinthisarticleisforlearningandcommunicationonly,anditisstrictlyprohibitedforcommercialandillegalpurposes,otherwiseallconsequencesarisingtherefromhavenothingtodowiththeauthor.Ifthereisanyinfringement,pleasecontactmetodeleteitimmediately!逆向目标目标：房天下账号密码登录主页：https://passport.fang.com/接口：https://passport.fang.com/log...逆向参数：FormData：pwd:044b527dba64d1e82657668beae1d61e4d86643d231792c78d5c538461a146b01c8e28d98b14915a11758deb6095aba16688a07427150434681949529f02e808e8891e1f90b5c91d42058a83f2c6902bd69825577dc4efb993f1aa4c9bb43a2bbe1acad5781a8738614ddafbda3cca99a0c03fb634d8e1001f25bca59a8d421b`逆向过程抓PacketanalysisEnteranaccountpasswordcasually,clicklogin,capturethepacketandlocatethelogininterfacehttps://passport.fang.com/log...,POSTrequest,inFormData,thepasswordpwdisencrypted.Parameterreverseencryptionparameteronlyhasonepwd,directglobalsearch,aloginbypassword.jsappears,whichisobviouslyencryptedJS,thisJSisthoughtfullywrittenwithChinesecomments,directlytotheloginmodule,andburiedabreakpoint:uid:that.username.val(),pwd:encryptedString(key_to_encode,that.password.val()),Service:that.service.val(),AutoLogin:that.autoLogin.val()encryptedStringThisfunctioncanbeseeninafunctioncalledRSAIntheencryptedJSof.min.js,itisobviousthatRSAencryptionisused,justcopyitdirectly.Thekey_to_encodeparametercanbefounddirectlyonthehomepage.YoucanseethatitisobtainedbypassingparameterstotheRSAKeyPairfunction:thecompletecodeisonlyshownbelowPartofthekeycode,thecompletecodecanbedownloadedfromGitHub:https://github.com/kuaidali/...fang_encrypt.jsfunctionsetMaxDigits(n){}functionBigInt(n){}functionbiFromDecimal(n){}//此处省略N个数functiontwoDigit(n){}functionencryptedString(n,t){}functiondecryptedString(n,t){}varbiRadixBase=2,biRadixBits=16,bitsPerDigit=biRadixBits,biRadix=65536,biHalfRadix=biRadix>>>1,biRadixSquared=biRadix*biRadix,maxDigitVal=biRadix-1,maxInteger=9999999999999DigitsRA,Y最大整数,bigZero,bigOne,dpl10,lr10,hexatrigesimalToChar,hexToChar,highBitMasks,lowBitMasks;setMaxDigits(20);dpl10=15;lr10=biFromNumber(1e15);hexatrigesimalToChar=["0","1","2","3","4","5","6","7","8","9","a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","y","z"];hexToChar=["0","1","2","3","4","5","6","7","8","9","a","b","c","d","e","f"];highBitMasks=[0,32768,49152,57344,61440,63488,64512,65024,65280,65408,65472,65504,65520,65528,65532,65534,65535];lowBitMasks=[0,1,3,7,15,31,63,127,255,511,1023,2047,4095,8191,16383,625567],;setMaxDigits(129);functiongetEncryptedPassword(pwd,n,i,t){varkey_to_encode=newRSAKeyPair(n,i,t);returnencryptedString(key_to_encode,pwd)}//测试样例//console.log(getEncryptedPassword("16521689404","010001","","978C0A92D2173439707498F0944AA476B1B62595877DD6FA87F6E2AC6DCB3D0BF0B82857439C99B5091192BC134889DFF60C562EC54EFBA4FF2F9D55ADBCCEA4A2FBA80CB398ED501280A007C83AF30C3D1A142D6133C63012B90AB26AC60C898FB66EDC3192C3EC4FF66925A64003B72496099F4F09A9FB72A2CF9E4D770C41"))fang_login.py#!/usr/bin/envpython3#-*-编码：utf-8-*-importreimportexecjsimportrequestsindex_url='https://passport.fang.com/'login_url='https://passport.fang.com/login.api'user_agent='Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/91.0.4472.114Safari/537.36'session=requests.session()defget_key_to_encode():headers={'User-Agent':user_agent}response=session.get(url=index_url,headers=headers)key_to_encode=re.findall(r'RSAKeyPair\((.*)\);',response.text)[0].replace('"','').split(',')返回key_to_encodedefget_encrypted_pa??ssword(key_to_encode,pwd):n,i,t=key_to_encode[0],key_to_encode[1],key_to_encode[2]withopen('fang_encrypt.js','r',encoding='utf-8')作为f:fang_js=f.read()encrypted_pwd=execjs.compile(fang_js).call('getEncryptedPassword',pwd,n,i,t)returnencrypted_pwddeflogin(encrypted_pa??ssword,uid):headers={'User-Agent':user_agent,'X-Requested-With':'XMLHttpRequest','Host':'护照.fang.com','来源':'https://passport.fang.com','Referer':'https://passport.fang.com/?backurl=http%3a%2f%2fmy.fang.com%2f','sec-ch-ua':'"Not;ABrand";v="99","GoogleChrome";v="91","Chromium";v="91"','Content-Type':'application/x-www-form-urlencoded;charset=UTF-8'}data={'uid':uid,'pwd':encrypted_pa??ssword,'Service':'soufun-passport-web','AutoLogin':1}response=session.post(url=login_url,data=data,headers=headers)print(response.json())defmain():#16521689404uid=input('请输入登录账号：')pwd=input('请输入登录密码：')rsa_key=get_key_to_encode()encrypted_pwd=get_encrypted_pa??ssword(rsa_key,pwd)login(encrypted_pwd,uid)如果__name__=='__main__':main()
