破解加速乐-java

记录一哈自己遇到的简单站点的破解

Talk is cheap,show you the code!

import com.google.gson.Gson;
import com.google.gson.internal.LinkedTreeMap;
import org.jsoup.Connection;
import org.jsoup.Jsoup;

import javax.script.ScriptEngine;
import javax.script.ScriptEngineManager;
import javax.script.ScriptException;
import java.io.IOException;
import java.math.BigInteger;
import java.security.MessageDigest;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

/**
 * 获取加速乐cookie
 *
 * @author natpacket
 * @version 1.0
 * @date 2021-08-04 16:25
 */
public class JSLCookie {
    private static final Gson gson = new Gson();
    //请求时User-Agent必须保持一致
    private static final String userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0";

    public static String getUserAgent() {

        return userAgent;
    }

    /**
     * 暂时检测到支持三种加密，后续可自行添加
     *
     * @return
     */
    private static Map<String, String> getAlgorithm() {
        Map<String, String> algorithm = new HashMap();
        algorithm.put("sha1", "SHA-1");
        algorithm.put("sha256", "SHA-256");
        algorithm.put("md5", "MD5");
        return algorithm;
    }

    /**
     * 通过加密cookie字符串与网站后台传入的字符串进行对比，获取真实的cookie
     *
     * @param json
     * @return
     */
    private static String getRealCookie(LinkedTreeMap<String, Object> json) throws Exception {
        String chars = json.get("chars").toString();
        List<String> bts = (List<String>) json.get("bts");
        String ct = json.get("ct").toString();
        String algorName = json.get("ha").toString();
//        String cookie_key = json.get("tn").toString();
        String cookie = "";
        for (int i = 0; i < chars.length(); i++) {
            for (int j = 0; j < chars.length(); j++) {
                cookie = bts.get(0) + chars.charAt(i) + chars.charAt(j) + bts.get(1);
                String cipher = "";
                if (getAlgorithm().containsKey(algorName)) {
                    cipher = getCipherString(cookie, getAlgorithm().get(algorName));
                } else {
                    throw new Exception("暂不支持该加密方法！");
                }
                if (ct.equals(cipher)) {
//                    return cookie_key+"="+cookie;
                    return cookie;
                }
            }
        }
        return "";
    }

    /**
     * 获取cookie，这里的cookie与User-Agent有关必须，保持一致
     *
     * @param url
     * @return
     * @throws IOException
     * @throws ScriptException
     */
    public static String getCookie(String url) throws Exception {
        //初始化js执行引擎
        ScriptEngineManager scriptEngineManager = new ScriptEngineManager();
        ScriptEngine engine = scriptEngineManager.getEngineByName("javascript");
        //获取第一次js内容
        Map<String, Object> ret_map = getContent(url, null);
        //服务器返回的cookie
        String response_cookie = joinMap((Map<String, String>) ret_map.get("cookies"));
        //通过返回的js执行获取cookie
        String cookie_script = getStrByReg("<script>(.*;).*</script>", ret_map.get("body").toString());
        if("".equals(cookie_script)){
            return "";
        }
        engine.eval(cookie_script.replaceAll("document.", "var "));
        //第一次js生成的cookie
        String cookie_1 = engine.get("cookie").toString().split(";")[0];
        //
        String cookie = cookie_1 + "; " + response_cookie;
        //利用第一次请求获取的cookies 请求第二次的js
        //获取生成第二次cookie的参数
        //第二次js生成cookie可能为空，这里添加重试机制
        int retry = 5;
        for (int i = 1; i <= retry; i++) {
            //返回的js
            ret_map = getContent(url, cookie);
            //必要参数
            String jsonStr = getStrByReg("go\\((\\{.*\\})\\)", ret_map.get("body").toString());
//            System.out.println(jsonStr);
            LinkedTreeMap<String, Object> ltm = gson.fromJson(jsonStr, LinkedTreeMap.class);
            //第二次js生成的cookie
            String cookie_2 = getRealCookie(ltm);
//        System.out.println(cookie_2);
            if (!cookie_2.equals("")) {
                cookie = response_cookie + ltm.get("tn") + "=" + cookie_2;
                return cookie;
            }
        }
        return "";
    }

    /**
     * 获取http请求内容
     *
     * @param url
     * @param reqCookie
     * @return
     * @throws IOException
     */
    private static Map<String, Object> getContent(String url, String reqCookie) throws IOException {
        Map ret = new HashMap<String, String>();
        Connection conn = Jsoup.connect(url);
        if (reqCookie != null) {
            conn.header("Cookie", reqCookie);
        }
        conn.header("User-Agent", userAgent);
        conn.method(Connection.Method.GET).timeout(10000).ignoreHttpErrors(true).ignoreContentType(true);
        Connection.Response response = conn.execute().charset("utf-8");
        String body = response.body();
        Map<String, String> cookies = response.cookies();
        ret.put("body", body);
        ret.put("cookies", cookies);
        return ret;
    }

    /**
     * 正则提取字符串
     *
     * @param reg
     * @param source
     * @return
     */
    public static String getStrByReg(String reg, String source) {
        String ret = "";

        Pattern pattern = Pattern.compile(reg);
        Matcher matcher = pattern.matcher(source);
        while (matcher.find()) {
            ret = matcher.group(1);
        }
        return ret;
    }

    /**
     * map转字符串
     *
     * @param cookies
     * @return
     */
    public static String joinMap(Map<String, String> cookies) {
        String ret = "";
        for (String key : cookies.keySet()) {
            ret += key + "=" + cookies.get(key) + "; ";
        }
        return ret;
    }

    /**
     * 可选择加密方法加密: 如SHA-1、SHA-256、MD5等
     *
     * @param str
     * @param algorithm
     * @return
     */
    public static String getCipherString(String str, String algorithm) {
        try {
            // 生成一个加密计算摘要
            MessageDigest md = MessageDigest.getInstance(algorithm);
            // 计算md5函数
            md.update(str.getBytes());
            // digest()最后确定返回hash值
            // BigInteger函数则将8位的字符串转换成16位hex值，用字符串来表示；得到字符串形式的hash值
            //一个byte是八位二进制，也就是2位十六进制字符
            return new BigInteger(1, md.digest()).toString(16);
        } catch (Exception e) {
            e.printStackTrace();
            return null;
        }
    }

    public static void main(String[] args) throws Exception {
        String url = "http://www.tl.gov.cn/openness/xxgkContent/?branch_id=5c17685b6032b8388bbd5cf7&column_code=540401&page=1";
//        getContent(url);
        System.out.println(getCookie(url));
        System.out.println(getCookie("http://www.luan.gov.cn/site/label/8888?IsAjax=1&dataType=html&_=0.6373043868807342&labelName=publicInfoList&siteId=6789941&pageSize=15&pageIndex=2&action=list&isDate=true&dateFormat=yyyy-MM-dd&length=50&organId=6608181&type=4&catId=7026181&cId=&result=%E6%9A%82%E6%97%A0%E7%9B%B8%E5%85%B3%E4%BF%A1%E6%81%AF&file=%2Fc1%2Fluan%2FpublicInfoList_newest"));
        System.out.println(getCookie("http://drc.hefei.gov.cn/public/column/19121?catId=6720691&nav=3&action=list&type=4&pageIndex=2"));
        System.out.println(getCookie("http://www.luan.gov.cn/public/6608181/9591601.html"));
//        String reg = "\\S(\\d{2,})\\S";
//        String source = "afeafgeg23fsdge";
//        System.out.println(getStrByReg(reg, source));
//        System.out.println(getCipherString("123456", "SHA-256"));
    }
}