篇幅有限

完整内容及源码关注公众号：ReverseCode，发送冲

https://passport.fang.com/?backurl=https%3A%2F%2Fsuzhou.fang.com%2F

目标

POST https://passport.fang.com/login.api

uid: 15806204095@163.com
pwd: 3854d2ef8cc2455ed263a3a697414c6f59043010efba9b24da93c6596123fee5fded0d948bc9148beaa5f58756817725617bb3c09ade11e5586e6430392a27db28005ebcfc442d8cf64c0369d439b17011c88e89a57914d78f45a7bba9a7c9e95b75e9fcb4cccbc4c6d65b3e0d3257d183ff2ba35bf3eb70e6bf0b50d4ffdaa1
Service: soufun-passport-web
AutoLogin: 1

分析

搜索login.api，并打上断点，重新登录时可以知道pwd是由key_to_encode和我们输入的密码123456经过encryptedString函数生成

搜索key_to_encode，通过RSAKeyPair构造函数返回key_to_encode

进入RSAKeyPair的构造函数中，正好encryptedString方法也在其中，我们将整个RSA.min.js:formatted拷贝下来命名fang.js，添加新方法getpwd，实现通过传入的123456加密生成pwd。

function getpwd(pwd) {
    var key_to_encode = new RSAKeyPair("010001", "", "978C0A92D2173439707498F0944AA476B1B62595877DD6FA87F6E2AC6DCB3D0BF0B82857439C99B5091192BC134889DFF60C562EC54EFBA4FF2F9D55ADBCCEA4A2FBA80CB398ED501280A007C83AF30C3D1A142D6133C63012B90AB26AC60C898FB66EDC3192C3EC4FF66925A64003B72496099F4F09A9FB72A2CF9E4D770C41");
    return encryptedString(key_to_encode, pwd)
}

爬虫实现

拷贝参数到sublime中，使用ctrl+H正则替换功能将(.*?):\s(.*?)\n 改成'$1':'$2',\n,或者通过请求头加参数.py修改格式。

uid: 15806204095@163.com
pwd: 3854d2ef8cc2455ed263a3a697414c6f59043010efba9b24da93c6596123fee5fded0d948bc9148beaa5f58756817725617bb3c09ade11e5586e6430392a27db28005ebcfc442d8cf64c0369d439b17011c88e89a57914d78f45a7bba9a7c9e95b75e9fcb4cccbc4c6d65b3e0d3257d183ff2ba35bf3eb70e6bf0b50d4ffdaa1
Service: soufun-passport-web
AutoLogin: 1

接下来再通过exec执行扣下的js并利用requests库实现post请求完成登录。

def get_pwd():
    with open("fang.js", "r") as f:
        js_code = f.read()
    results = execjs.compile(js_code).call("getpwd", password)
    return results


def login():
    url = 'https://passport.fang.com/login.api'
    pwd = get_pwd()
    data = {
        'uid': account,
        'pwd': pwd,
        'Service': 'soufun-passport-web',
        'AutoLogin': '1',
    }
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36',
        'X-Requested-With': 'XMLHttpRequest',
        'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
        'Host': 'passport.fang.com',
        'Origin': 'https://passport.fang.com',
        'Pragma': 'no-cache',
        'Referer': 'https://passport.fang.com/?backurl=https%3A%2F%2Fsuzhou.fang.com%2F',
        'Sec-Fetch-Dest': 'empty',
        'Sec-Fetch-Mode': 'cors',
        'Sec-Fetch-Site': 'same-origin',
    }
    response = requests.post(url, data, headers=headers)
    print(response.text)


if __name__ == '__main__':
    login()

完整源码请关注微信公众号：ReverseCode，回复：JS逆向