websocket直接绕过JS加密示例及思路原理

第websocket直接绕过JS加密示例及思路原理目录websocket--hook服务端--WebSocketServer.js客户端注入JS代码python开端口get_data.py文件方式get_user_id.py文件方式get_data.py终端方式get_user_id.py终端方式爬虫调用者

websocket--hook

大致思路

原理：

浏览器（客户端）：在浏览器中注入一段JS代码，与服务端建立连接。调用浏览器中的js方法，把返回的数据发送给服务端

node启动js代码，监听某端口（客户端）：服务端把参数(python发过来的)发送给客户端处理，并接收处理结果，再次把接收的结果返回给python处理

python(调用者)：把参数发送给node,接收node传回来的数据

优点：

1.对于js混淆加密较深的，可以采用此方法。

2.不用扣js加密代码，直接调用浏览器环境

缺点：

1.如果有selenium监测，要想使用此方法，必须先绕过selenium监测，否则只能使用真机进行js注入

2.需要node环境，写一个websocket服务端和客户端

3.速度没有直接破解js快

服务端--WebSocketServer.js

leticonv=require('iconv-lite')

varws=require("nodejs-websocket");

console.log("开始建立连接...")

varserver=ws.createServer(function(conn){

letcached={};

conn.on("text",function(msg){

if(!msg)return;

//console.log("msg",msg);

varkey=conn.key;

if((msg==="Browser")||(msg==="Python")){

//browser或者python第一次连接

cached[msg]=key;

//console.log("cached",cached);

return;

if(Object.values(cached).includes(key)){

//console.log(server.connections.forEach(conn=conn.key));

vartargetConn=server.connections.filter(function(conn){

returnconn.key!==key;

//console.log("将要发送的实参:",msg);

targetConn.forEach(conn={

conn.send(msg);

conn.on("close",function(code,reason){

//console.log("关闭连接")

conn.on("error",function(code,reason){

console.log("异常关闭")

conn.on("connection",function(conn){

console.log(conn)

}).listen(10512)

console.log("WebSocket建立完毕")

客户端注入JS代码

createSocket();

functioncreateSocket(){

window.ws=newWebSocket('ws://:10512/');

window.ws.onopen=function(e){

console.log("连接服务器成功");

window.ws.send("Browser");

window.ws.onclose=function(e){

console.log("服务器关闭");

setTimeout(createSocket,60000);

window.ws.onerror=function(){

console.log("连接出错");

window.ws.onmessage=function(e){

varxmlhttp=newglb.XMLHttpRequest();

functionstate_Change(){

if(xmlhttp.readyState==4){

if(xmlhttp.status==200){

letresult=xmlhttp.responseText

result=JSON.parse(result)

result=JSON.stringify(result)

//result=String.fromCharCode(result)

//发送给Python

//console.log(result);

window.ws.send(result);

}else{

alert("ProblemretrievingXMLdata");

xmlhttp.onreadystatechange=state_Change;

xmlhttp.open('GET',e.data,true);

xmlhttp.send(null);

python开端口

#-*-coding:utf-8-*-

fromsanicimportSanic

fromsanic.responseimportjson

importos

importurllib3

fromtoutiao2_文件方式.get_dataimportget_data

fromtoutiao2_文件方式.get_user_idimportget_user

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

app=Sanic(__name__)

@app.route("/get_user_id",methods=["GET"])

defcaptcha_server(request):

try:

data=request.args

media_id=data['media_id'][0]

returnget_user_id(media_id)

exceptExceptionase:

pass

@app.route("/get_data",methods=["GET"])

defcaptcha_server(request):

try:

data=request.args

user_id=data['user_id'][0]

offset=data['offset'][0]

returnget_res(user_id,offset)

exceptExceptionase:

pass

defget_user_id(media_id):

html=get_user(media_id)

returnhtml

defget_res(user_id,offset):

html=get_data(user_id,offset)

returnhtml

if__name__=="__main__":

app.run(host="",port=4007)

get_data.py文件方式

#-*-coding:utf-8-*-

importtime

fromws4py.client.threadedclientimportWebSocketClient

import_locale

_locale._getdefaultlocale=(lambda*args:['zh_CN','utf8'])

importurllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

classCG_Client(WebSocketClient):

defopened(self):

self.max_cursor=0

self.send("Python")

defclosed(self,code,reason=None):

#print("Closeddown:",code,reason)

pass

defreceived_message(self,resp):

data=resp.data.decode("utf-8")

write_data(data)

ws.close()

defwrite_data(data):

withopen('./data.txt','w',encoding='utf-8')asf:

f.write(data)

f.close()

defget_data(user_id,offset):

ws=CG_Client('ws://:10512/')

ws.connect()

try:

real_arg=f"/api/feed_backflow/profile_share/v1/category=profile_articlevisited_uid={user_id}stream_api_version=82request_source=1offset={offset}user_id={user_id}appId=1286appType=mobile_detail_webisAndroid=trueisIOS=falseisMobile=truecookie_enabled=truescreen_width=288screen_height=511browser_language=zh-CNbrowser_platform=MacIntelbrowser_name=firefoxbrowser_version=85.0.4183.83browser_online=truetimezone_name=Asia%2FShanghai"

time.sleep(0.1)

ws.send(real_arg)

ws.run_forever()

exceptKeyboardInterrupt:

print('异常关闭')

ws.close()

get_user_id.py文件方式

#-*-coding:utf-8-*-

importtime

fromws4py.client.threadedclientimportWebSocketClient

import_locale

_locale._getdefaultlocale=(lambda*args:['zh_CN','utf8'])

importio

importsys

importurllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

#sys.stdout=io.TextIOWrapper(sys.stdout.buffer,encoding='utf8')

#media_id=sys.argv[1].split(',',1)[0]#sys.argv--[get_attention.py,user_id,cursor]

classCG_Client(WebSocketClient):

defopened(self):

self.max_cursor=0

self.send("Python")

defclosed(self,code,reason=None):

#print("Closeddown:",code,reason)

pass

defreceived_message(self,resp):

data=resp.data.decode("utf-8")

write_user(data)

ws.close()

defwrite_user(data):

withopen('./user.txt','w',encoding='utf-8')asf:

f.write(data)

f.close()

defget_user(media_id):

ws=CG_Client('ws://:10512/')

ws.connect()

try:

real_arg=f"/user/profile/homepage/share/v7/media_id={media_id}request_source=1appId=1286appType=mobile_detail_webisAndroid=trueisIOS=falseisMobile=truecookie_enabled=truescreen_width=393screen_height=882browser_language=zh-CNbrowser_platform=MacIntelbrowser_name=Chromebrowser_version=85.0.4183.83browser_online=truetimezone_name=Asia%2FShanghai"

time.sleep(0.1)

ws.send(real_arg)

ws.run_forever()

exceptKeyboardInterrupt:

print('异常关闭')

ws.close()

get_data.py终端方式

#-*-coding:utf-8-*-

importtime

fromws4py.client.threadedclientimportWebSocketClient

import_locale

_locale._getdefaultlocale=(lambda*args:['zh_CN','utf8'])

importio

importsys

importurllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

sys.stdout=io.TextIOWrapper(sys.stdout.buffer,encoding='utf8')

user_id=sys.argv[1].split(',',1)[0]#sys.argv--[get_attention.py,user_id,cursor]

offset=str(sys.argv[2])

classCG_Client(WebSocketClient):

defopened(self):

print("连接成功")

self.max_cursor=0

self.send("Python")

defclosed(self,code,reason=None):

print("Closeddown:",code,reason)

defreceived_message(self,resp):

data=resp.data.decode("utf-8")

print(data)

ws.close()

ws=CG_Client('ws://:10512/')

ws.connect()

real_arg=f"/api/feed_backflow/profile_share/v1/category=profile_articlevisited_uid={user_id}stream_api_version=82request_source=1offset={offset}user_id={user_id}appId=1286appType=mobile_detail_webisAndroid=trueisIOS=falseisMobile=truecookie_enabled=truescreen_width=288screen_height=511browser_language=zh-CNbrowser_platform=MacIntelbrowser_name=firefoxbrowser_version=85.0.4183.83browser_online=truetimezone_name=Asia%2FShanghai"

time.sleep(0.1)

ws.send(real_arg)

ws.run_forever()

exceptKeyboardInterrupt:

ws.close()

get_user_id.py终端方式

#-*-coding:utf-8-*-

importtime

fromws4py.client.threadedclientimportWebSocketClient

import_locale

_locale._getdefaultlocale=(lambda*args:['zh_CN','utf8'])

importio

importsys

importurllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

sys.stdout=io.TextIOWrapper(sys.stdout.buffer,encoding='utf8')

media_id=sys.argv[1].split(',',1)[0]#sys.argv--[get_attention.py,user_id,cursor]

classCG_Client(WebSocketClient):

defopened(self):

print("连接成功")

self.max_cursor=0

self.send("Python")

defclosed(self,code,reason=None):

print("Closeddown:",code,reason)

defreceived_message(self,resp):

data=resp.data.decode("utf-8")

#data=resp.data.decode("gbk")

print(data)

ws.close()

ws=CG_Client('ws://:10512/')

ws.connect()

real_arg=f"/user/profile/homepage/share/v7/media_id={media_id}request_source=1appId=1286appType=mobile_detail_webisAndroid=trueisIOS=falseisMobile=truecookie_enabled=truescreen_width=393screen_height=882browser_language=zh-CNbrowser_platform=MacIntelbrowser_name=Chromebrowser_version=85.0.4183.83browser_online=truetimezone_name=Asia%2FShanghai"

time.sleep(0.1)

ws.send(real_arg)

ws.run_forever()

exceptKeyboardInterrupt:

ws.close()

爬虫调用者

importtime

importrequests

importjson

importurllib3

fromtoutiao2_文件方式.get_user_idimportget_user,CG_Client

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

defopen_user():

withopen('./user.txt','r',encoding='utf-8')asf:

user=json.loads(f.read())

f.close()

returnuser

defopen_data():

withopen('./data.txt','r',encoding='utf-8')asf:

data=json.loads(f.read())

f.close()

returndata

#media_id换user_id

defstart_ocean_toutiao_user_id(media_id):

data={

'media_id':media_id,

requests.get(':4007/get_user_id',params=data,timeout=3)

time.sleep(2)

response=open_user()

res_media_id=response.get('data').ge