JS加密算法简单分析

这次分析百度音乐的评论请求的加密，首先先看包

看到有两个地方1. param，2. sign，基本可以断定sign是用的MD5加密的

那么我们从html页面分析入手，恰巧看到html代码中有写到这么一段

右键点击open in Source panel

熟悉的配方，熟悉的味道，看起来就是MD5，在函数末尾下个断点(点击前面的行号就可以下断点)，换页即可运行，F10一直单步运行，发现最后会跳转到另一个js

看来这里就是加密的地方，param应该是AES加密

所以param和sign的计算应该是这样

# -*- coding:utf-8 -*-
#!/usr/bin/env python
# http://music.baidu.com/data/tingapi/v1/restserver/ting?method=baidu.ting.ugcmsg.getCommentListByType&timestamp=1528636009&param=NT6J1C5axIckxMHUH2k3Ph1pDNp7wWl6s0IoSsSQMcRi1YJKw0RdAfhQ0ULfOwjRNvoopUj6Ki6jMzXwBLatcQ==&sign=c16dd43318fc66aa6b2865b7ce25541b&from=webimport time
import base64
from Crypto.Cipher import AES
import hashlibdef md5Encrypt(text):m1 = hashlib.md5()m1.update(text)return m1.hexdigest()
def aesEncrypt(text, secKey):pad = 16 - len(text) % 16text = text   pad * chr(pad)encryptor = AES.new(secKey, 2,secKey)ciphertext = encryptor.encrypt(text)ciphertext = base64.b64encode(ciphertext)return ciphertext# timestamp = str(int(time.time()))
# offset = "20"
timestamp = "1528636009"
offset = "80"
size = "20"
musicid = "242078437"
text = "from=web&offset=" offset "&size=" size "&type=2&type_id=" musicid
key = md5Encrypt("baidu_taihe_music_secret_key" timestamp)[8:24]
param = aesEncrypt(text,key)
sign = md5Encrypt("baidu_taihe_music" param timestamp)