马上爬试题练习第15题

抓包

题目说的是cookie加密，暂时先认为是只有v一个加密，hook cookie

根据堆栈找到加密点

可以看到实际上的加密函数为D()函数，仔细分析O函数发现很多的函数不知道的，用全局的思想将他暴漏出来

直接window.D = D

将全部的代码抠出来后补环境,补环境框架

//观察框架
!(function () {
  var console_log = console.log
  watch = function (obj, name) {
    return new Proxy(obj, {
      get(target, p, receiver) {
        // 过滤没用的信息，不进行打印
        if (name !== 'contentWindow' && p === "Math" || p === "JSON" || p === "RegExp" || p === "atob" || p === "parseInt" || p === "String" || p === "Symbol" || p === "Proxy" || p === "Promise" || p === "Array" || p === "isNaN" || p === "encodeURI" || p === "Uint8Array" || p.toString().indexOf("Symbol(Symbol.") != -1 || p.toString().indexOf("Symbol(nodejs") != -1) {
          var val = Reflect.get(...arguments);
          return val
        }
        else {
          var val = Reflect.get(...arguments);
          if (typeof val === 'function') {
            console_log(`取值: ${name}.${p} => function`);
          } else {
            console_log(`取值: ${name}.${p} => ${val}`);
          }
          return val
        }
      },
      set(target, p, value, receiver) {
        var val = Reflect.set(...arguments)
        if (typeof value === 'function') {
          console_log(`设置值: ${name}.${p} => function`,);
        } else {
          console_log(`设置值: ${name}.${p} => ${value}`);
        }
        return val
      },
      has(target, key) {
        // 在检查属性存在性时输出一条消息
        console_log(`检查属性存在性: ${name}.${key.toString()}`);
        return key in target;
      },
      ownKeys(target) {
        console_log(`获取自有属性:${name}`)
        if (name === 'contentWindow_navigator') {
          return watch([], 'contentWindow_navigator自有属性')
        }
        return Reflect.ownKeys(target)
      }
    })
  }
})();

// 补环境框架
function getEnvs(proxyObjs) {
    for (let i = 0; i < proxyObjs.length; i++) {
        const handler = '{\n' +
            '    get: function(target, property, receiver) {\n' +
            '        console.log("方法:", "get  ", "对象:", ' +
            '"' + proxyObjs[i] + '" ,' +
            '"  属性:", property, ' +
            '"  属性类型:", ' + 'typeof property, ' +
            // '"  属性值:", ' + 'target[property], ' +
            '"  属性值类型:", typeof target[property]);\n' +
            // 'if (typeof target[property] == "undefined"){debugger}' +
            '        return target[property];\n' +
            '    },\n' +
            '    set: function(target, property, value, receiver) {\n' +
            '        console.log("方法:", "set  ", "对象:", ' +
            '"' + proxyObjs[i] + '" ,' +
            '"  属性:", property, ' +
            '"  属性类型:", ' + 'typeof property, ' +
            // '"  属性值:", ' + 'target[property], ' +
            '"  属性值类型:", typeof target[property]);\n' +
            '        return Reflect.set(...arguments);\n' +
            '    }\n' +
            '}';
        eval(`try {
            ${proxyObjs[i]};
            ${proxyObjs[i]} = new Proxy(${proxyObjs[i]}, ${handler});
        } catch (e) {
            ${proxyObjs[i]} = {};
            ${proxyObjs[i]} = new Proxy(${proxyObjs[i]}, ${handler});
        }`);
    }
}

proxyObjs = ['window', 'document', 'location', 'navigator', 'history', 'screen', 'localStorage']
getEnvs(proxyObjs);

补完的环境代码

window = global
window.addEventListener = function (arg) {
    console.log("对象：window =====>方法：addEventListener ===>参数：", arg)
}
document = {
    getElementsByTagName: function(arg){
        console.log("对象：document =====>方法：getElementsByTagName ===>参数：", arg)
        return watch({}, 'getElementsByTagName')
    },
    createElement: function(arg){
        console.log("对象：document =====>方法：createElement ===>参数：", arg)
        if (arg === "div"){
            return {
                onwheel: null
            }
        }

        return watch({}, 'createElement')
    },
    addEventListener: function (arg) {
        console.log("对象：document =====>方法：addEventListener ===>参数：", arg)
        if (arg === "wheel"){
            return {}
        }
        if (arg === "mousemove"){
            return {}
        }
        if (arg === "touchmove"){
            return {}
        }
        if (arg === "click"){
            return {}
        }
        if (arg === "keydown"){
            return {}
        }
        return watch({}, 'addEventListener')
    },
}

navigator = {
    userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36"
}

localStorage = {
    getItem: function (arg){
        console.log("对象：localStorage =====>方法：getItem ===>参数：", arg)
        if (arg === "hexin-v"){
            return {length : 0}
        }
        return watch({}, 'getItem')
    }

}