JS逆向---小程序逆向

微信小程序逆向

学习目标:

熟悉微信小程序逆向
熟悉 webpack模块导出
熟悉开发者工具检测

1	本教程仅供学习交流使用，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关，请各学员自觉遵守相关法律法规。

一. 小程序逆向

1. 准备工具

注: 会有封号微信,用小号调试
WeChatOpenDevTools 工具包(git地址:https://github.com/JaveleyQAQ/WeChatOpenDevTools-Python)
微信pc端安装(注:由于版本的问题要是不能用使用课堂上提供的工具)
安装好WeChatOpenDevTools 工具需要用的py库
进入到文件解压地址

1	pip3 install -r requirements.txt

开启工具启动注入端(自动打开微信进行登录,要是关闭的话用课堂提供的配套安装包)

1	python main.py -all

2. 逆向案例

小程序:六六找房
需求:解析请求头关键字:Authorization

3. 逆向代码

python代码

import requests
import execjs

js = execjs.compile(open('demo.js', encoding='utf-8').read())

Authorization = js.call('generate', "/v5/search/bed", "GET")
print(Authorization)
headers = {
    "Authorization": Authorization,
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 MicroMessenger/7.0.20.1781(0x6700143B) NetType/WIFI MiniProgramEnv/Windows WindowsWechat/WMPF WindowsWechat(0x63090a13) XWEB/8555",
    "xweb_xhr": "1"
}
url = "https://apiservices.zuber.im/client/v5/search/bed"
params = {"city": "长沙", "sequence": "WyI5NDI2LjUwMDE1NDgxNjEwNCIsIjE2ODY0Njg4MzUiLCJ6dWJlcl82NTI3NTIiXQ==", "sex": "",
          "cost1": "", "cost2": "", "longitude": "112.861160", "latitude": "28.198201", "region": "", "distance": "",
          "stations": "", "room_type_affirm": "", "has_video": "", "layout_single_private_bathroom": "", "elevator": "",
          "separate": "", "tenancy": "", "free": "", "pay_type": "", "has_photo": 1, "entireTenancy1": "",
          "entireTenancy2": "", "entireTenancy3": "", "jointRent0": "", "try_rent": "", "pet_limit": "",
          "isShowFilterShield": 0}
response = requests.get(url, headers=headers, params=params)

print(response.text)
print(response)

node代码


// 引用 crypto-js 加密模块
var CryptoJS = require('crypto-js')

function MD5Test(text) {
    return CryptoJS.MD5(text).toString()
}

var timeStamp = function timeStamp() {
  return Math.round(new Date().getTime() / 1000);
};

function generate(route, method, params) {
    var _timestamp = timeStamp();
    // var _timestamp = '1713771957';

    var _secret = '';

    var _oauth = MD5Test(_timestamp);
    console.log(_oauth)
    var _method = method ? method.toLowerCase() : 'get';

    var _params = '{}';

    var _url = "client" + route;

    var _source = "request_url=".concat(_url, "&content=").concat(_params, "&request_method=").concat(_method, "&timestamp=").concat(_timestamp, "&secret=").concat(_secret ? _secret : '');
    console.log(_source)
    var _signature = MD5Test(_source);

    return "timestamp=".concat(_timestamp, ";oauth2=").concat(_oauth, ";signature=").concat(_signature, ";scene=").concat('2567a5ec9705eb7ac2c984033e06189d', ";deployKey=").concat('');
}

aa = {
    "city": "长沙",
    "sequence": "WyI5NDI2LjUwMDE1NDgxNjEwNCIsIjE2ODY0Njg4MzUiLCJ6dWJlcl82NTI3NTIiXQ==",
    "sex": "",
    "cost1": "",
    "cost2": "",
    "longitude": "112.861160",
    "latitude": "28.198201",
    "region": "",
    "distance": "",
    "stations": "",
    "room_type_affirm": "",
    "has_video": "",
    "layout_single_private_bathroom": "",
    "elevator": "",
    "separate": "",
    "tenancy": "",
    "free": "",
    "pay_type": "",
    "has_photo": 1,
    "entireTenancy1": "",
    "entireTenancy2": "",
    "entireTenancy3": "",
    "jointRent0": "",
    "try_rent": "",
    "pet_limit": "",
    "isShowFilterShield": 0
}

console.log(generate("/v5/search/bed", "GET"));

// timestamp=1713771957;oauth2=124238c16aae99245e53f8c62f38d08a;signature=48e2bb445b344e78d30a5ece6a3e9862;scene=2567a5ec9705eb7ac2c984033e06189d;deployKey=
// timestamp=1713771957;oauth2=124238c16aae99245e53f8c62f38d08a;signature=48e2bb445b344e78d30a5ece6a3e9862;scene=2567a5ec9705eb7ac2c984033e06189d;deployKey=