当前位置:网站首页>The solution of polar experience insensitive verification

The solution of polar experience insensitive verification

2020-11-10 00:28:17 Docker

Everyone is responsible for maintaining network security , This article only does technical research , Please do not use it in any business scenario .

background

When we studied polar parity check codes ,validate Parameters are generally issued by the polar test server . However, it was found that the polar verification code of the first flight only interacts with the polar inspection service only once, just pulling fullpage.js file , The inspection service has not been issued validate Parameters . Why are there so many subsequent verification links validate Parameters ?

This has aroused my curiosity , So I decided to find out .

characteristic

(1)fullpage Version is 0.0.0

(2) There is no subsequent interaction with polar experience

(3) When the first flight requests validate, But we can't find it on the Internet validate value

practice

Take Capital Airlines as an example :https://m.jdair.net/h5/views/onlinecheckin/handleCheckin.jsp

1、 see geetest Relevant request information

The discovery only got fullpage.0.0.0.js, There is no interaction between the subsequent and polar Services . It can be concluded that validate Generate... For the local .

 First voyage polar survey fullpage

2、 Key code

stay fullpage.0.0.0.js In file , Through static analysis + dynamic analysis , Locate local computing code .

The specific process is : Pass in challenge After function generation validate.

function $_CDm(e) {
            function c(e, t) {
                return e << t | e >>> 32 - t;
            }
            function u(e, t) {
                var n, r, o, i, a;
                return o = 2147483648 & e,
                i = 2147483648 & t,
                a = (1073741823 & e) + (1073741823 & t),
                (n = 1073741824 & e) & (r = 1073741824 & t) ? 2147483648 ^ a ^ o ^ i : n | r ? 1073741824 & a ? 3221225472 ^ a ^ o ^ i : 1073741824 ^ a ^ o ^ i : a ^ o ^ i;
            }
            function t(e, t, n, r, o, i, a) {
                return u(c(e = u(e, u(u(function s(e, t, n) {
                    var $_DJFy = $_AY.$_Dn
                      , $_DJED = ['$_DJIw'].concat($_DJFy)
                      , $_DJGi = $_DJED[1];
                    $_DJED.shift();
                    var $_DJHk = $_DJED[0];
                    return e & t | ~e & n;
                }(t, n, r), o), a)), i), t);
            }
            function n(e, t, n, r, o, i, a) {
                return u(c(e = u(e, u(u(function s(e, t, n) {
                    var $_EAAP = $_AY.$_Dn
                      , $_DJJG = ['$_EADQ'].concat($_EAAP)
                      , $_EABQ = $_DJJG[1];
                    $_DJJG.shift();
                    var $_EACU = $_DJJG[0];
                    return e & n | t & ~n;
                }(t, n, r), o), a)), i), t);
            }
            function r(e, t, n, r, o, i, a) {
                return u(c(e = u(e, u(u(function s(e, t, n) {
                    var $_EAFu = $_AY.$_Dn
                      , $_EAEo = ['$_EAIs'].concat($_EAFu)
                      , $_EAGH = $_EAEo[1];
                    $_EAEo.shift();
                    var $_EAHb = $_EAEo[0];
                    return e ^ t ^ n;
                }(t, n, r), o), a)), i), t);
            }
            function o(e, t, n, r, o, i, a) {
                return u(c(e = u(e, u(u(function s(e, t, n) {
                    var $_EBAC = $_AY.$_Dn
                      , $_EAJm = ['$_EBDv'].concat($_EBAC)
                      , $_EBBJ = $_EAJm[1];
                    $_EAJm.shift();
                    var $_EBCI = $_EAJm[0];
                    return t ^ (e | ~n);
                }(t, n, r), o), a)), i), t);
            }
            function i(e) {
                var t, n = $_DFBA(169), r = $_DFAo(169);
                for (t = 0; t <= 3; t++)
                    n += (r = $_DFAo(127) + (e >>> 8 * t & 255)[$_DFAo(209)](16))[$_DFAo(138)](r[$_DFBA(130)] - 2, 2);
                return n;
            }
            var a, s, _, l, h, f, d, p, g, v;
            for (a = function m(e) {
                var $_EBFg = $_AY.$_Dn
                  , $_EBEW = ['$_EBIG'].concat($_EBFg)
                  , $_EBGm = $_EBEW[1];
                $_EBEW.shift();
                var $_EBHd = $_EBEW[0];
                var t, n = e[$_EBFg(130)], r = n + 8, o = 16 * (1 + (r - r % 64) / 64), i = Array(o - 1), a = 0, s = 0;
                while (s < n)
                    a = s % 4 * 8,
                    i[t = (s - s % 4) / 4] = i[t] | e[$_EBFg(251)](s) << a,
                    s++;
                return a = s % 4 * 8,
                i[t = (s - s % 4) / 4] = i[t] | 128 << a,
                i[o - 2] = n << 3,
                i[o - 1] = n >>> 29,
                i;
            }(e = function E(e) {
                var $_ECAV = $_AY.$_Dn
                  , $_EBJW = ['$_ECDz'].concat($_ECAV)
                  , $_ECBc = $_EBJW[1];
                $_EBJW.shift();
                var $_ECCN = $_EBJW[0];
                e = e[$_ECBc(174)](/\r\n/g, $_ECAV(223));
                for (var t = $_ECBc(169), n = 0; n < e[$_ECAV(130)]; n++) {
                    var r = e[$_ECAV(251)](n);
                    r < 128 ? t += String[$_ECBc(155)](r) : (127 < r && r < 2048 ? t += String[$_ECAV(155)](r >> 6 | 192) : (t += String[$_ECBc(155)](r >> 12 | 224),
                    t += String[$_ECBc(155)](r >> 6 & 63 | 128)),
                    t += String[$_ECBc(155)](63 & r | 128));
                }
                return t;
            }(e)),
            d = 1732584193,
            p = 4023233417,
            g = 2562383102,
            v = 271733878,
            s = 0; s < a[$_DFBA(130)]; s += 16)
                p = o(p = o(p = o(p = o(p = r(p = r(p = r(p = r(p = n(p = n(p = n(p = n(p = t(p = t(p = t(p = t(l = p, g = t(h = g, v = t(f = v, d = t(_ = d, p, g, v, a[s + 0], 7, 3614090360), p, g, a[s + 1], 12, 3905402710), d, p, a[s + 2], 17, 606105819), v, d, a[s + 3], 22, 3250441966), g = t(g, v = t(v, d = t(d, p, g, v, a[s + 4], 7, 4118548399), p, g, a[s + 5], 12, 1200080426), d, p, a[s + 6], 17, 2821735955), v, d, a[s + 7], 22, 4249261313), g = t(g, v = t(v, d = t(d, p, g, v, a[s + 8], 7, 1770035416), p, g, a[s + 9], 12, 2336552879), d, p, a[s + 10], 17, 4294925233), v, d, a[s + 11], 22, 2304563134), g = t(g, v = t(v, d = t(d, p, g, v, a[s + 12], 7, 1804603682), p, g, a[s + 13], 12, 4254626195), d, p, a[s + 14], 17, 2792965006), v, d, a[s + 15], 22, 1236535329), g = n(g, v = n(v, d = n(d, p, g, v, a[s + 1], 5, 4129170786), p, g, a[s + 6], 9, 3225465664), d, p, a[s + 11], 14, 643717713), v, d, a[s + 0], 20, 3921069994), g = n(g, v = n(v, d = n(d, p, g, v, a[s + 5], 5, 3593408605), p, g, a[s + 10], 9, 38016083), d, p, a[s + 15], 14, 3634488961), v, d, a[s + 4], 20, 3889429448), g = n(g, v = n(v, d = n(d, p, g, v, a[s + 9], 5, 568446438), p, g, a[s + 14], 9, 3275163606), d, p, a[s + 3], 14, 4107603335), v, d, a[s + 8], 20, 1163531501), g = n(g, v = n(v, d = n(d, p, g, v, a[s + 13], 5, 2850285829), p, g, a[s + 2], 9, 4243563512), d, p, a[s + 7], 14, 1735328473), v, d, a[s + 12], 20, 2368359562), g = r(g, v = r(v, d = r(d, p, g, v, a[s + 5], 4, 4294588738), p, g, a[s + 8], 11, 2272392833), d, p, a[s + 11], 16, 1839030562), v, d, a[s + 14], 23, 4259657740), g = r(g, v = r(v, d = r(d, p, g, v, a[s + 1], 4, 2763975236), p, g, a[s + 4], 11, 1272893353), d, p, a[s + 7], 16, 4139469664), v, d, a[s + 10], 23, 3200236656), g = r(g, v = r(v, d = r(d, p, g, v, a[s + 13], 4, 681279174), p, g, a[s + 0], 11, 3936430074), d, p, a[s + 3], 16, 3572445317), v, d, a[s + 6], 23, 76029189), g = r(g, v = r(v, d = r(d, p, g, v, a[s + 9], 4, 3654602809), p, g, a[s + 12], 11, 3873151461), d, p, a[s + 15], 16, 530742520), v, d, a[s + 2], 23, 3299628645), g = o(g, v = o(v, d = o(d, p, g, v, a[s + 0], 6, 4096336452), p, g, a[s + 7], 10, 1126891415), d, p, a[s + 14], 15, 2878612391), v, d, a[s + 5], 21, 4237533241), g = o(g, v = o(v, d = o(d, p, g, v, a[s + 12], 6, 1700485571), p, g, a[s + 3], 10, 2399980690), d, p, a[s + 10], 15, 4293915773), v, d, a[s + 1], 21, 2240044497), g = o(g, v = o(v, d = o(d, p, g, v, a[s + 8], 6, 1873313359), p, g, a[s + 15], 10, 4264355552), d, p, a[s + 6], 15, 2734768916), v, d, a[s + 13], 21, 1309151649), g = o(g, v = o(v, d = o(d, p, g, v, a[s + 4], 6, 4149444226), p, g, a[s + 11], 10, 3174756917), d, p, a[s + 2], 15, 718787259), v, d, a[s + 9], 21, 3951481745),
                d = u(d, _),
                p = u(p, l),
                g = u(g, h),
                v = u(v, f);
            return (i(d) + i(p) + i(g) + i(v))[$_DFAo(192)]();
        }

3、 Last call result

 The result of the transcendental insensibility is obtained

The specific service code is not open source .

Last

I don't understand when it will trigger fullpage.0.0.0.js, Let's take it for a while as a kind of strategy .

In extreme cases , The EPI service cannot respond , Use pass js Confusing the underlying logic , Enable local algorithms for token Computing is also a good way to design .

Last and last , Everyone is responsible for maintaining network security , This article only does technical research , Please do not use it in any business scenario .

版权声明
本文为[Docker]所创,转载请带上原文链接,感谢