{DSW} 網站Cookie參數分析

滲透逆向 · 2024-12-08 · 13 人浏览
{DSW} 網站Cookie參數分析

測試過了,headers并沒有加密的東西,必須携帶Cookie才能獲取響應内容,經過篩選,找到如下三個必備參數.
2024-12-07T15:18:07.png
2024-12-07T15:17:34.png

bm_sz 參數是第一次訪問這個網頁,網站返回的,JSESSIONID 在不同網頁訪問返回的,第三個是固定值。
2024-12-07T15:23:17.png


那麽主要就是獲取 JSESSIONID,發現請求頭有加密,測試了,只要解決這個參數就順水推舟了。
2024-12-07T15:32:45.png

找到 this.calculateDigest(V + z + K + W["x-dbi-app-id"] + W["x-dbi-app-version"] + W["x-dbi-build-number"]);

2024-12-07T15:34:11.png
webpack,扣解釋器后傳入模塊就好了,這裏遇到一個問題,解釋器上面的好像有些問題,改成以下就行了。
2024-12-07T16:08:30.png
2024-12-07T16:12:49.png
2024-12-07T16:10:37.png
2024-12-07T16:11:16.png
那麽下面是全部代碼:

var encryption_obj;
var window = global;



!function(g){
    // var e, g = {}, v = {};
    v = {}
    function t(e) {
        var f = v[e];
        if (void 0 !== f)
            return f.exports;
        var a = v[e] = {
            id: e,
            loaded: !1,
            exports: {}
        };
        console.log(e)

        return g[e].call(a.exports, a, a.exports, t),
        a.loaded = !0,
        a.exports
    }
    t.m = g,
    t.amdO = {},
    e = [],
    t.O = (f, a, d, n) => {
        if (!a) {
            var r = 1 / 0;
            for (c = 0; c < e.length; c++) {
                for (var [a,d,n] = e[c], s = !0, b = 0; b < a.length; b++)
                    (!1 & n || r >= n) && Object.keys(t.O).every(p => t.O[p](a[b])) ? a.splice(b--, 1) : (s = !1,
                    n < r && (r = n));
                if (s) {
                    e.splice(c--, 1);
                    var o = d();
                    void 0 !== o && (f = o)
                }
            }
            return f
        }
        n = n || 0;
        for (var c = e.length; c > 0 && e[c - 1][2] > n; c--)
            e[c] = e[c - 1];
        e[c] = [a, d, n]
    }
    ,
    t.n = e => {
        var f = e && e.__esModule ? () => e.default : () => e;
        return t.d(f, {
            a: f
        }),
        f
    }
    ,
    ( () => {
        var f, e = Object.getPrototypeOf ? a => Object.getPrototypeOf(a) : a => a.__proto__;
        t.t = function(a, d) {
            if (1 & d && (a = this(a)),
            8 & d || "object" == typeof a && a && (4 & d && a.__esModule || 16 & d && "function" == typeof a.then))
                return a;
            var n = Object.create(null);
            t.r(n);
            var c = {};
            f = f || [null, e({}), e([]), e(e)];
            for (var r = 2 & d && a; "object" == typeof r && !~f.indexOf(r); r = e(r))
                Object.getOwnPropertyNames(r).forEach(s => c[s] = () => a[s]);
            return c.default = () => a,
            t.d(n, c),
            n
        }
    }
    )(),
    t.d = (e, f) => {
        for (var a in f)
            t.o(f, a) && !t.o(e, a) && Object.defineProperty(e, a, {
                enumerable: !0,
                get: f[a]
            })
    }
    ,
    t.f = {},
    t.e = e => Promise.all(Object.keys(t.f).reduce( (f, a) => (t.f[a](e, f),
    f), [])),
    t.u = e => e + "." + {
        77: "30aa4f69d6e5efdb",
        173: "a75bac074a8df3d4",
        281: "bd993e2ac9e3a9ab",
        338: "5cde774c36901190",
        485: "7be294ff7497d382",
        519: "5c1ad871046597b2",
        748: "6973f4de75dac8ba",
        912: "3a8244b16c3603a3",
        973: "340d1f679ab4d371",
        1150: "55f3c6adf31df27b",
        1283: "c9bae007824cf28b",
        1841: "749c73721728e81a",
        1916: "41f7d8ffb6acbef2",
        2023: "8cbc4f9d654b4713",
        2110: "d760d6a142c48112",
        2736: "37eb132dae107758",
        2777: "01d10f0f6eeb7a39",
        2901: "29ea742f18ab3550",
        3079: "948ced0647090a2b",
        3146: "000e9e68e59d091a",
        3477: "f25fb719a7b26c0f",
        3614: "4a541b8e89eef071",
        4417: "12ec2e0f5be32e27",
        4515: "6f536c172969dc72",
        4666: "971841a7fed89da0",
        5082: "a8497ada603cfe5f",
        5166: "4016c416a58c822e",
        5167: "933c2e87dca46a48",
        5310: "b95f28fde5684da2",
        5592: "bf28ca61e43ef19d",
        5956: "85341bc81e49c14a",
        6053: "cac9735d72c278cf",
        6114: "2717a95b44dacbe0",
        6122: "8eb8e3f777cd6b34",
        6192: "b0c40bf52a04e696",
        6228: "1648984a4515a14b",
        6252: "e910befd24864721",
        6434: "ae102c9dca136e55",
        6536: "2f286d2e7cf0d675",
        6894: "ee87a53d811e79c4",
        6916: "3c4a66d3597eb53a",
        7074: "4ef58c3304eb8b7b",
        7149: "dc70c08cd8192df2",
        7266: "4650f504746c72ad",
        7487: "5a5eab22b0f59830",
        7550: "d3f94bf410fc0e5f",
        7554: "a45ad5799751e171",
        7660: "0a9d417e177858cc",
        7772: "47681c70dffb6a51",
        7843: "c61e9986ff829fec",
        8632: "226857bda92d5cf5",
        8802: "d405f40588cbeb17",
        8847: "54eb8046e8f5bcd2",
        8981: "12d1b1a2c681f99c",
        9027: "a849f95ade015170",
        9065: "5bbedf3aab72f381",
        9115: "08049757a325f981",
        9307: "5b47036abd0431f8",
        9310: "0bb6717320ac1022"
    }[e] + ".js",
    t.miniCssF = e => {}
    ,
    t.o = (e, f) => Object.prototype.hasOwnProperty.call(e, f),
    ( () => {
        var e = {}
          , f = "dsw-ng:";
        t.l = (a, d, n, c) => {
            if (e[a])
                e[a].push(d);
            else {
                var r, s;
                if (void 0 !== n)
                    for (var b = document.getElementsByTagName("script"), o = 0; o < b.length; o++) {
                        var i = b[o];
                        if (i.getAttribute("src") == a || i.getAttribute("data-webpack") == f + n) {
                            r = i;
                            break
                        }
                    }
                r || (s = !0,
                (r = document.createElement("script")).type = "module",
                r.charset = "utf-8",
                r.timeout = 120,
                t.nc && r.setAttribute("nonce", t.nc),
                r.setAttribute("data-webpack", f + n),
                r.src = t.tu(a)),
                e[a] = [d];
                var l = (_, p) => {
                    r.onerror = r.onload = null,
                    clearTimeout(u);
                    var h = e[a];
                    if (delete e[a],
                    r.parentNode && r.parentNode.removeChild(r),
                    h && h.forEach(y => y(p)),
                    _)
                        return _(p)
                }
                  , u = setTimeout(l.bind(null, void 0, {
                    type: "timeout",
                    target: r
                }), 12e4);
                r.onerror = l.bind(null, r.onerror),
                r.onload = l.bind(null, r.onload),
                s && document.head.appendChild(r)
            }
        }
    }
    )(),
    t.r = e => {
        typeof Symbol < "u" && Symbol.toStringTag && Object.defineProperty(e, Symbol.toStringTag, {
            value: "Module"
        }),
        Object.defineProperty(e, "__esModule", {
            value: !0
        })
    }
    ,
    t.nmd = e => (e.paths = [],
    e.children || (e.children = []),
    e),
    ( () => {
        var e;
        t.tt = () => (void 0 === e && (e = {
            createScriptURL: f => f
        },
        typeof trustedTypes < "u" && trustedTypes.createPolicy && (e = trustedTypes.createPolicy("angular#bundler", e))),
        e)
    }
    )(),
    t.tu = e => t.tt().createScriptURL(e),
    t.p = "/",
    ( () => {
        var e = {
            3666: 0
        };
        t.f.j = (d, n) => {
            var c = t.o(e, d) ? e[d] : void 0;
            if (0 !== c)
                if (c)
                    n.push(c[2]);
                else if (3666 != d) {
                    var r = new Promise( (i, l) => c = e[d] = [i, l]);
                    n.push(c[2] = r);
                    var s = t.p + t.u(d)
                      , b = new Error;
                    t.l(s, i => {
                        if (t.o(e, d) && (0 !== (c = e[d]) && (e[d] = void 0),
                        c)) {
                            var l = i && ("load" === i.type ? "missing" : i.type)
                              , u = i && i.target && i.target.src;
                            b.message = "Loading chunk " + d + " failed.\n(" + l + ": " + u + ")",
                            b.name = "ChunkLoadError",
                            b.type = l,
                            b.request = u,
                            c[1](b)
                        }
                    }
                    , "chunk-" + d, d)
                } else
                    e[d] = 0
        }
        ,
        t.O.j = d => 0 === e[d];
        var f = (d, n) => {
            var b, o, [c,r,s] = n, i = 0;
            if (c.some(u => 0 !== e[u])) {
                for (b in r)
                    t.o(r, b) && (t.m[b] = r[b]);
                if (s)
                    var l = s(t)
            }
            for (d && d(n); i < c.length; i++)
                t.o(e, o = c[i]) && e[o] && e[o][0](),
                e[o] = 0;
            return t.O(l)
        }
        //   , a = self.webpackChunkdsw_ng = self.webpackChunkdsw_ng || [];
        // a.forEach(f.bind(null, 0)),
        // a.push = f.bind(null, a.push.bind(a))
    }
    )()
    encryption_obj = t
}({
    23972: function(he, A, n) {
        var s;
        he.exports = (s = n(2454),
        function(e) {
            var b = s
              , x = b.lib
              , w = x.WordArray
              , C = x.Hasher
              , g = b.algo
              , f = []
              , v = [];
            !function() {
                function _(F) {
                    for (var k = e.sqrt(F), z = 2; z <= k; z++)
                        if (!(F % z))
                            return !1;
                    return !0
                }
                function P(F) {
                    return 4294967296 * (F - (0 | F)) | 0
                }
                for (var S = 2, N = 0; N < 64; )
                    _(S) && (N < 8 && (f[N] = P(e.pow(S, .5))),
                    v[N] = P(e.pow(S, 1 / 3)),
                    N++),
                    S++
            }();
            var c = []
              , p = g.SHA256 = C.extend({
                _doReset: function() {
                    this._hash = new w.init(f.slice(0))
                },
                _doProcessBlock: function(_, P) {
                    for (var S = this._hash.words, N = S[0], F = S[1], k = S[2], z = S[3], I = S[4], D = S[5], L = S[6], T = S[7], R = 0; R < 64; R++) {
                        if (R < 16)
                            c[R] = 0 | _[P + R];
                        else {
                            var W = c[R - 15]
                              , K = c[R - 2];
                            c[R] = ((W << 25 | W >>> 7) ^ (W << 14 | W >>> 18) ^ W >>> 3) + c[R - 7] + ((K << 15 | K >>> 17) ^ (K << 13 | K >>> 19) ^ K >>> 10) + c[R - 16]
                        }
                        var pe = N & F ^ N & k ^ F & k
                          , Ue = T + ((I << 26 | I >>> 6) ^ (I << 21 | I >>> 11) ^ (I << 7 | I >>> 25)) + (I & D ^ ~I & L) + v[R] + c[R];
                        T = L,
                        L = D,
                        D = I,
                        I = z + Ue | 0,
                        z = k,
                        k = F,
                        F = N,
                        N = Ue + (((N << 30 | N >>> 2) ^ (N << 19 | N >>> 13) ^ (N << 10 | N >>> 22)) + pe) | 0
                    }
                    S[0] = S[0] + N | 0,
                    S[1] = S[1] + F | 0,
                    S[2] = S[2] + k | 0,
                    S[3] = S[3] + z | 0,
                    S[4] = S[4] + I | 0,
                    S[5] = S[5] + D | 0,
                    S[6] = S[6] + L | 0,
                    S[7] = S[7] + T | 0
                },
                _doFinalize: function() {
                    var _ = this._data
                      , P = _.words
                      , S = 8 * this._nDataBytes
                      , N = 8 * _.sigBytes;
                    return P[N >>> 5] |= 128 << 24 - N % 32,
                    P[14 + (N + 64 >>> 9 << 4)] = e.floor(S / 4294967296),
                    P[15 + (N + 64 >>> 9 << 4)] = S,
                    _.sigBytes = 4 * P.length,
                    this._process(),
                    this._hash
                },
                clone: function() {
                    var _ = C.clone.call(this);
                    return _._hash = this._hash.clone(),
                    _
                }
            });
            b.SHA256 = C._createHelper(p),
            b.HmacSHA256 = C._createHmacHelper(p)
        }(Math),
        s.SHA256)
    },

    2454: function(he, A, n) {
        var s;
        he.exports = (s = s || function(e, b) {
            var x;
            if (typeof window < "u" && window.crypto && (x = window.crypto),
            typeof self < "u" && self.crypto && (x = self.crypto),
            typeof globalThis < "u" && globalThis.crypto && (x = globalThis.crypto),
            !x && typeof window < "u" && window.msCrypto && (x = window.msCrypto),
            !x && typeof global < "u" && global.crypto && (x = global.crypto),
            !x)
                try {
                    x = n(42480)
                } catch {}
            var w = function() {
                if (x) {
                    if ("function" == typeof x.getRandomValues)
                        try {
                            return x.getRandomValues(new Uint32Array(1))[0]
                        } catch {}
                    if ("function" == typeof x.randomBytes)
                        try {
                            return x.randomBytes(4).readInt32LE()
                        } catch {}
                }
                throw new Error("Native crypto module could not be used to get secure random number.")
            }
              , C = Object.create || function() {
                function z() {}
                return function(I) {
                    var D;
                    return z.prototype = I,
                    D = new z,
                    z.prototype = null,
                    D
                }
            }()
              , g = {}
              , f = g.lib = {}
              , v = f.Base = function() {
                return {
                    extend: function(z) {
                        var I = C(this);
                        return z && I.mixIn(z),
                        (!I.hasOwnProperty("init") || this.init === I.init) && (I.init = function() {
                            I.$super.init.apply(this, arguments)
                        }
                        ),
                        I.init.prototype = I,
                        I.$super = this,
                        I
                    },
                    create: function() {
                        var z = this.extend();
                        return z.init.apply(z, arguments),
                        z
                    },
                    init: function() {},
                    mixIn: function(z) {
                        for (var I in z)
                            z.hasOwnProperty(I) && (this[I] = z[I]);
                        z.hasOwnProperty("toString") && (this.toString = z.toString)
                    },
                    clone: function() {
                        return this.init.prototype.extend(this)
                    }
                }
            }()
              , c = f.WordArray = v.extend({
                init: function(z, I) {
                    z = this.words = z || [],
                    this.sigBytes = null != I ? I : 4 * z.length
                },
                toString: function(z) {
                    return (z || _).stringify(this)
                },
                concat: function(z) {
                    var I = this.words
                      , D = z.words
                      , L = this.sigBytes
                      , T = z.sigBytes;
                    if (this.clamp(),
                    L % 4)
                        for (var R = 0; R < T; R++)
                            I[L + R >>> 2] |= (D[R >>> 2] >>> 24 - R % 4 * 8 & 255) << 24 - (L + R) % 4 * 8;
                    else
                        for (var V = 0; V < T; V += 4)
                            I[L + V >>> 2] = D[V >>> 2];
                    return this.sigBytes += T,
                    this
                },
                clamp: function() {
                    var z = this.words
                      , I = this.sigBytes;
                    z[I >>> 2] &= 4294967295 << 32 - I % 4 * 8,
                    z.length = e.ceil(I / 4)
                },
                clone: function() {
                    var z = v.clone.call(this);
                    return z.words = this.words.slice(0),
                    z
                },
                random: function(z) {
                    for (var I = [], D = 0; D < z; D += 4)
                        I.push(w());
                    return new c.init(I,z)
                }
            })
              , p = g.enc = {}
              , _ = p.Hex = {
                stringify: function(z) {
                    for (var I = z.words, D = z.sigBytes, L = [], T = 0; T < D; T++) {
                        var R = I[T >>> 2] >>> 24 - T % 4 * 8 & 255;
                        L.push((R >>> 4).toString(16)),
                        L.push((15 & R).toString(16))
                    }
                    return L.join("")
                },
                parse: function(z) {
                    for (var I = z.length, D = [], L = 0; L < I; L += 2)
                        D[L >>> 3] |= parseInt(z.substr(L, 2), 16) << 24 - L % 8 * 4;
                    return new c.init(D,I / 2)
                }
            }
              , P = p.Latin1 = {
                stringify: function(z) {
                    for (var I = z.words, D = z.sigBytes, L = [], T = 0; T < D; T++)
                        L.push(String.fromCharCode(I[T >>> 2] >>> 24 - T % 4 * 8 & 255));
                    return L.join("")
                },
                parse: function(z) {
                    for (var I = z.length, D = [], L = 0; L < I; L++)
                        D[L >>> 2] |= (255 & z.charCodeAt(L)) << 24 - L % 4 * 8;
                    return new c.init(D,I)
                }
            }
              , S = p.Utf8 = {
                stringify: function(z) {
                    try {
                        return decodeURIComponent(escape(P.stringify(z)))
                    } catch {
                        throw new Error("Malformed UTF-8 data")
                    }
                },
                parse: function(z) {
                    return P.parse(unescape(encodeURIComponent(z)))
                }
            }
              , N = f.BufferedBlockAlgorithm = v.extend({
                reset: function() {
                    this._data = new c.init,
                    this._nDataBytes = 0
                },
                _append: function(z) {
                    "string" == typeof z && (z = S.parse(z)),
                    this._data.concat(z),
                    this._nDataBytes += z.sigBytes
                },
                _process: function(z) {
                    var I, D = this._data, L = D.words, T = D.sigBytes, R = this.blockSize, V = T / (4 * R), K = (V = z ? e.ceil(V) : e.max((0 | V) - this._minBufferSize, 0)) * R, J = e.min(4 * K, T);
                    if (K) {
                        for (var Y = 0; Y < K; Y += R)
                            this._doProcessBlock(L, Y);
                        I = L.splice(0, K),
                        D.sigBytes -= J
                    }
                    return new c.init(I,J)
                },
                clone: function() {
                    var z = v.clone.call(this);
                    return z._data = this._data.clone(),
                    z
                },
                _minBufferSize: 0
            })
              , k = (f.Hasher = N.extend({
                cfg: v.extend(),
                init: function(z) {
                    this.cfg = this.cfg.extend(z),
                    this.reset()
                },
                reset: function() {
                    N.reset.call(this),
                    this._doReset()
                },
                update: function(z) {
                    return this._append(z),
                    this._process(),
                    this
                },
                finalize: function(z) {
                    return z && this._append(z),
                    this._doFinalize()
                },
                blockSize: 16,
                _createHelper: function(z) {
                    return function(I, D) {
                        return new z.init(D).finalize(I)
                    }
                },
                _createHmacHelper: function(z) {
                    return function(I, D) {
                        return new k.HMAC.init(z,D).finalize(I)
                    }
                }
            }),
            g.algo = {});
            return g
        }(Math),
        s)
    },
    36102: function(he, A, n) {
        var s, x;
        he.exports = (s = n(2454),
        x = s.lib.WordArray,
        s.enc.Base64 = {
            stringify: function(f) {
                var v = f.words
                  , c = f.sigBytes
                  , p = this._map;
                f.clamp();
                for (var _ = [], P = 0; P < c; P += 3)
                    for (var k = (v[P >>> 2] >>> 24 - P % 4 * 8 & 255) << 16 | (v[P + 1 >>> 2] >>> 24 - (P + 1) % 4 * 8 & 255) << 8 | v[P + 2 >>> 2] >>> 24 - (P + 2) % 4 * 8 & 255, z = 0; z < 4 && P + .75 * z < c; z++)
                        _.push(p.charAt(k >>> 6 * (3 - z) & 63));
                var I = p.charAt(64);
                if (I)
                    for (; _.length % 4; )
                        _.push(I);
                return _.join("")
            },
            parse: function(f) {
                var v = f.length
                  , c = this._map
                  , p = this._reverseMap;
                if (!p) {
                    p = this._reverseMap = [];
                    for (var _ = 0; _ < c.length; _++)
                        p[c.charCodeAt(_)] = _
                }
                var P = c.charAt(64);
                if (P) {
                    var S = f.indexOf(P);
                    -1 !== S && (v = S)
                }
                return function g(f, v, c) {
                    for (var p = [], _ = 0, P = 0; P < v; P++)
                        if (P % 4) {
                            var S = c[f.charCodeAt(P - 1)] << P % 4 * 2
                              , N = c[f.charCodeAt(P)] >>> 6 - P % 4 * 2;
                            p[_ >>> 2] |= (S | N) << 24 - _ % 4 * 8,
                            _++
                        }
                    return x.create(p, _)
                }(f, v, p)
            },
            _map: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
        },
        s.enc.Base64)
    },

    2858: function(he, A, n) {
        he.exports = n(2454).enc.Utf8
    },
})

e = encryption_obj(36102)
b = encryption_obj.n(e)

C = encryption_obj(23972)
g = encryption_obj.n(C)

x = encryption_obj(2858)
w = encryption_obj.n(x)

function generateRandomSalt(z) {
    return Array.from({
        length: z
    }, () => "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".charAt(Math.floor(62 * Math.random()))).join("")
}

function calculateDigest(z) {
    const D = g()(w().parse(z)).toString();
    return b().stringify(w().parse(D))
}

V = generateRandomSalt(8)
z = "/config/api/v1/value/ecomm_dsw_us/WEB/PROD"
K = Math.floor(Date.now() / 1e3).toString()

Y = calculateDigest(V + z + K + "ecomm-web" + "2.0.0" + "20241112.13");


console.log(Y)
本站立足于美利堅合衆國,請讀者自覺遵守當地法律!如有違規,本站不承擔任何法律責任! This site is based in the United States of America, readers are requested to abide by local laws! If there are any violations, this site does not bear any legal responsibility! Theme Jasmine by Kent Liao