JS逆向实战-找到那个flag
This_is_Y Lv6

目标基本情况

(由于项目特殊性只能厚码)

打开网站,除了一些菜单页面后,发现左下角有注册和登录,那肯定第一时间是搞个账号进去挖

image-20241126203024320

点进去之后,逐字阅读完服务协议后,却发现弹出了 “请先插入xxx再进行注册”。

image-20241126203505371

猜测应该某种类似安全狗的u盘之类的东西

分析

先打开F12,根据alert弹出的警告信息定位下来,可以看到是传入了一个e变量,然后根据变量的值来决定该怎么处理,一共有三种情况,1和2都是会提示报错,只有3有些不一样,写到了一个接口basic/supplierRegister/checkSupplier。不过看上去不像是注册接口,而是检查当前注册信息的,

image-20241126233519096

里面的js也只能看个大概,只能知道接口的传参变量是n,而n应该是把t.ruleForm和t.userForm合并到一起,那现在就先去找t.ruleForm和t.userForm里面有些什么变量,再看上一行,可以看到一个t.ruleForm.registerPlace的引用,那可以推断,ruleForm这个对象里有一个registerPlace的key,那搜索起来就方便一些了,可以用.registerPlaceregisterPlace:"registerPlace"这样的组合缩小搜索范围,

image-20241126234422196

image-20241126234435905

image-20241126234450099

可以看到一共才17个,一个一个看一下,然后就找到了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
rules: {
unitName: [{
required: !0,
message: "未从xxxxx中读取到单位全称",
trigger: "blur"
}],
unitType: [{
required: !0,
message: "请选择企业类型",
trigger: "blur"
}],
unitScale: [{
required: !0,
message: "请选择企业规模",
trigger: "change"
}],
creditCode: [{
required: !0,
message: "未从xxxx中读取到统一社会信用代码",
trigger: "blur"
}],
legalPerson: [{
required: !0,
message: "请输入法定代表人",
trigger: "blur"
}],
legalPersonPhone: [{
required: !0,
message: "请输入法人联系电话",
trigger: "blur"
}, {
pattern: /^1[3456789]\d{9}$/,
message: "手机号码格式不正确",
trigger: "blur"
}],
registerAmount: [{
required: !0,
message: "请输入注册资金(万元)",
trigger: "blur"
}],
businessTermStart: [{
required: !0,
message: "请选营业期限",
trigger: "blur"
}],
businessTermEnd: [{
required: !0,
trigger: "blur",
validator: this.validatePass
}],
businessScope: [{
required: !0,
message: "请输入经营范围",
trigger: "blur"
}],
registerPlace: [{
required: !0,
message: "请输入所在地区",
trigger: "blur"
}],
detailPlace: [{
required: !0,
message: "请输入详细地址",
trigger: "blur"
}],
fixedPhone: [{
required: !0,
message: "请输入固定电话",
trigger: "blur"
}]
},
userRules: {
loginName: [{
required: !0,
message: "请输入用户名",
trigger: "blur"
}],
password: [{
required: !0,
message: "请输入密码",
trigger: "blur"
}, {
pattern: /(?=.*\d)(?=.*[a-zA-Z])(?=.*[^a-zA-Z0-9]).{8}/,
message: "密码需包含大小写字母、数字、特殊符号,并且不小于8位",
trigger: "blur"
}],
confirmPwd: [{
required: !0,
message: "请输入确认密码",
trigger: "blur"
}, {
pattern: /(?=.*\d)(?=.*[a-zA-Z])(?=.*[^a-zA-Z0-9]).{8}/,
message: "密码需包含大小写字母、数字、特殊符号,并且不小于8位",
trigger: "blur"
}, {
validator: t,
trigger: "blur"
}],
registerContacts: [{
required: !0,
message: "请输入注册联系人",
trigger: "blur"
}, {
pattern: /^[\u4e00-\u9fa5]+$/,
message: "请输入中文",
trigger: "blur"
}],
invoicingInfo: [{
required: !0,
message: "请选择服务费开票类型",
trigger: "change"
}],
openingBranch: [{
required: !0,
message: "请输入开户行全称",
trigger: "blur"
}],
openingBranchAddr: [{
required: !0,
message: "请输入开户行地址",
trigger: "blur"
}],
unionPay: [{
required: !0,
message: "请输入银联号",
trigger: "blur"
}, {
pattern: /^[a-zA-Z0-9]{12}$/,
message: "银联号格式不正确",
trigger: "blur"
}],
basicAccount: [{
required: !0,
message: "请输入基本户",
trigger: "blur"
}],
mailbox: [{
required: !0,
message: "请输入邮箱",
trigger: "blur"
}, {
pattern: /^([a-zA-Z0-9_-])+@([a-zA-Z0-9_-])+(.[a-zA-Z0-9_-])+/,
message: "邮箱格式不正确",
trigger: "blur"
}],
contactPhone: [{
required: !0,
message: "请输入联系人手机号",
trigger: "blur"
}, {
pattern: /^1[3456789]\d{9}$/,
message: "手机号码格式不正确",
trigger: "blur"
}]
},

image-20241126234612163

然后打开bp,构造一下请求看一下,可以看到响应还非常贴心的提示了相关信息,然后一步一步跟着提示把对应的字段补上,随后就能看到操作成功了,可以看到在数据包层面并没有用到一开始提示的那个u盘之类的东西。

image-20241127000228012

image-20241127000928126

在确定/basic/supplierRegister/checkSupplier接口可以正常使用后,下一步肯定是去找注册接口,可以猜到,注册接口肯定是在/basic/supplierRegister/下面。简单搜索一下就得到了,应该是这个saveSupplier,定位到相关js代码,也更加确定了结果,而且参数组成和上面checkSupplier一样,那就更简单了,直接在checkSupplier的基础上构造数据包。

image-20241127001317190

image-20241127001410684

和checkSupplier接口一样的操作,直接注册成功。

image-20241127001628628

随后回到主页面登录,直接登录成功

image-20241127001816592

突破口

GET!

 评论
评论插件加载失败
正在加载评论插件
由 Hexo 驱动 & 主题 Keep
访客数 访问量