雷池waf 逆向

声明

本文章中所有内容仅供学习交流使用，不用于其他任何目的，抓包内容、敏感网址、数据接口等均已做脱敏处理，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关！
逆向分析

部分python代码

cp = execjs.compile(open('waf.js','r',encoding='utf-8').read())
result = cp.call('getResult', data)
print(result)
url = "/challenge/v2/api/verify"
data = {
    "issue_id": issue_id,
    "result": result,
    "serials": [],
    "client": {
        "visitorId": "",
    }
}
headers = {
    "Accept": "*/*",
    "Accept-Language": "zh-CN,zh;q=0.9",
    "Cache-Control": "no-cache",
    "Connection": "keep-alive",
    "Sec-Fetch-Dest": "empty",
    "Sec-Fetch-Mode": "cors",
    "Sec-Fetch-Site": "cross-site",
}
data = json.dumps(data, separators=(',', ':'))
response = session.post(url, headers=headers, data=data)

jwt = response.json()['data']['jwt']
session.cookies.set("sl-challenge-jwt", jwt)
url = "/notice/"
response = session.get(url, headers=headers)

print(response.text)
print(response.cookies)
print(response.status_code)

cp = execjs.compile(open('waf.js','r',encoding='utf-8').read())
result = cp.call('getResult', data)
print(result)
url = "/challenge/v2/api/verify"
data = {
    "issue_id": issue_id,
    "result": result,
    "serials": [],
    "client": {
        "visitorId": "",
    }
}
headers = {
    "Accept": "*/*",
    "Accept-Language": "zh-CN,zh;q=0.9",
    "Cache-Control": "no-cache",
    "Connection": "keep-alive",
    "Sec-Fetch-Dest": "empty",
    "Sec-Fetch-Mode": "cors",
    "Sec-Fetch-Site": "cross-site",
}
data = json.dumps(data, separators=(',', ':'))
response = session.post(url, headers=headers, data=data)

jwt = response.json()['data']['jwt']
session.cookies.set("sl-challenge-jwt", jwt)
url = "/notice/"
response = session.get(url, headers=headers)

print(response.text)
print(response.cookies)
print(response.status_code)

结果

总结

1.出于安全考虑,本章未提供完整流程,调试环节省略较多,只提供大致思路,具体细节要你自己还原,相信你也能调试出来。