渗透测试-前端加密分析之AES
媒介本文是高级前端加解密与验签实战的第3篇文章，本系列文章实验靶场为Yakit里自带的Vulinbox靶场，本文讲述的是绕过前端 AES(CBC) 和 AES(ECB) 加密。
由于编写Yakit热加载代码后就可以正常爆破密码，所以不需要每次都演示。以后的文章会省略掉爆破密码这一步，直接输入精确密码查看效果。
前端加密登录表单-AES(CBC)
分析
https://img2024.cnblogs.com/blog/2855436/202412/2855436-20241215014336824-2051997129.png
查看源代码，可以看到加密方式为AES，查询网上资料得知，此encrypt方法默以为CBC模式。
https://img2024.cnblogs.com/blog/2855436/202412/2855436-20241215014338787-608965049.png
key为：1234123412341234
https://img2024.cnblogs.com/blog/2855436/202412/2855436-20241215014341166-1037827622.png
iv为随机生成的：
https://img2024.cnblogs.com/blog/2855436/202412/2855436-20241215014343585-751910180.png
将用户名和密码以json的格式进行AES加密
https://img2024.cnblogs.com/blog/2855436/202412/2855436-20241215014345953-75173403.png
https://img2024.cnblogs.com/blog/2855436/202412/2855436-20241215014349031-301610679.png
利用CyberChef加密
https://img2024.cnblogs.com/blog/2855436/202412/2855436-20241215014351862-2105453092.png
替换请求data内容，验证成功。
POST /crypto/js/lib/aes/cbc/handler HTTP/1.1
Host: 127.0.0.1:8787
Content-Type: application/json
Content-Length: 169
{
"data": "2/eylw258wQNJQznPd5zr7xpNWzPR3vcgCmY3zwuTdW0WjSwbNzAhTraiebLdPRK",
"key": "31323334313233343132333431323334",
"iv": "67ba30beaabf8ccfebeca655d487805a"
}https://img2024.cnblogs.com/blog/2855436/202412/2855436-20241215014355830-557569038.png
热加载
这是本人写的Yakit热加载代码，通过beforeRequest劫持请求包，利用encryptData函数进行加密，终极实现热加载主动加密功能。
encryptData = (packet) => {
body = poc.GetHTTPPacketBody(packet)
hexKey = "31323334313233343132333431323334"
hexIV = "67ba30beaabf8ccfebeca655d487805a"
key = codec.DecodeHex(hexKey)~
iv = codec.DecodeHex(hexIV)~
data = codec.AESCBCEncrypt(key /*type: []byte*/, body, iv /*type: []byte*/)~
data = codec.EncodeBase64(data)
body = f`{"data": "${data}","key": "${hexKey}","iv": "${hexIV}"}`
return string(poc.ReplaceBody(packet, body, false))
}
//发送到服务端修改数据包
beforeRequest = func(req){
return encryptData(req)
}https://img2024.cnblogs.com/blog/2855436/202412/2855436-20241215014359762-1854724716.png
效果：
https://img2024.cnblogs.com/blog/2855436/202412/2855436-20241215014406498-1138827595.png
前端加密登录表单-AES(ECB)
分析
模式变为AES的ECB模式，其他的与CBC模式根本一样。
https://img2024.cnblogs.com/blog/2855436/202412/2855436-20241215014413034-122924669.png
zqBATwKGlf9ObCg8Deimijp+OH1VePy6KkhV1Z4xjiDwOuboF7GPuQBCJKx6o9c7https://img2024.cnblogs.com/blog/2855436/202412/2855436-20241215014414823-1198823420.png
热加载
功能跟上面大致一样。ECB模式不需要iv，修改成ECB加密，然后删撤除iv相干代码即可。
encryptData = (packet) => { body = poc.GetHTTPPacketBody(packet) hexKey = "31323334313233343132333431323334" key = codec.DecodeHex(hexKey)~ //ECB模式加密 data = codec.AESECBEncrypt(key /*type: []byte*/, body, nil /*type: []byte*/)~ data = codec.EncodeBase64(data) body = f`{"data": "${data}","key": "${hexKey}"}` return string(poc.ReplaceBody(packet, body, false))}//发送到服务端修改数据包// beforeRequest = func(req){// return encryptData(req)// }//调试用packet =
页:
[1]