朋友求助很早之前我给其搞的查询流最近无法查询到数据，返回服务器内部错误，经Chrome调试发现，该平台查询参数和返回数据均已从明文改成加密传输，需要重新处理数据。索性将此过程记录方便后期回顾，亦方便后来人。。。
因涉及到一些不便言明的问题，本文将重码相关微信公众号信息，下文直接上步骤和思路。
一、抓包
为了获得所需数据并调试，我们首先需要抓包，手机抓包就不赘述了，自己百度吧。。
抓到包后开始分析数据。 我就直接在抓包结果里写注释了
{
"startTime": 1601264250454,
"id": "1601264250452-103",
//尝试登陆
"url": "http://微信公众号的服务器地址/weixin/rs/weixin/getcode?state=标签参数",
"req": {
"method": "GET",
"httpVersion": "1.1",
"ip": "192.168.110.198",
"port": 61390,
"rawHeaderNames": {
"host": "Host",
"proxy-connection": "Proxy-Connection",
"upgrade-insecure-requests": "Upgrade-Insecure-Requests",
"accept": "Accept",
"user-agent": "User-Agent",
"accept-language": "Accept-Language",
"accept-encoding": "Accept-Encoding",
"connection": "Connection",
"proxy-authorization": "Proxy-Authorization"
},
"headers": {
"host": "微信公众号的服务器地址",
"upgrade-insecure-requests": "1",
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"user-agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/7.0.15(0x17000f31) NetType/WIFI Language/zh_CN",
"accept-language": "zh-cn",
"accept-encoding": "gzip",
"connection": "keep-alive"
},
"trailers": {},
"size": 0,
"body": false,
"rawHeaders": {
"Host": "微信公众号的服务器地址",
"Upgrade-Insecure-Requests": "1",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"User-Agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/7.0.15(0x17000f31) NetType/WIFI Language/zh_CN",
"Accept-Language": "zh-cn",
"Accept-Encoding": "gzip",
"Connection": "keep-alive"
}
},
"res": {
"ip": "IP地址",
"port": 80,
"rawHeaderNames": {
"x-frame-options": "X-Frame-Options",
"x-content-type-options": "X-Content-Type-Options",
"x-xss-protection": "X-XSS-Protection",
"location": "Location",
"content-length": "Content-Length",
"date": "Date",
"server": "Server"
},
"statusCode": 302,
"statusMessage": "Found",
"headers": {
"x-frame-options": "DENY",
"x-content-type-options": "nosniff",
"x-xss-protection": "1; mode=block",
//公众号返回302跳转微信登陆地址，利用微信oauth2认证
"location": "https://open.weixin.qq.com/connect/oauth2/authorize?appid=公众号APPID&redirect_uri=http%3A%2F%2F微信公众号的服务器地址%2Fweixin%2Frs%2Fweixin%2FgetOpenid&response_type=code&scope=snsapi_base&state=标签参数",
"content-length": "0",
"date": "Mon, 28 Sep 2020 03:37:25 GMT",
"server": ""
},
"trailers": {},
"size": 0,
"body": false,
"rawHeaders": {
"X-Frame-Options": "DENY",
"X-Content-Type-Options": "nosniff",
"X-XSS-Protection": "1; mode=block",
"Location": "https://open.weixin.qq.com/connect/oauth2/authorize?appid=公众号APPID&redirect_uri=http%3A%2F%2F微信公众号的服务器地址%2Fweixin%2Frs%2Fweixin%2FgetOpenid&response_type=code&scope=snsapi_base&state=标签参数",
"Content-Length": "0",
"Date": "Mon, 28 Sep 2020 03:37:25 GMT",
"Server": ""
}
},
"rules": {},
"pipe": null,
"rulesHeaders": {},
"dnsTime": 1601264250479,
"useH2": false,
"requestTime": 1601264250530,
"responseTime": 1601264250597,
"endTime": 1601264250597,
"method": "GET",
"hostIp": "IP地址",
"clientIp": "192.168.110.198",
"date": "2020/9/28 上午11:37:30",
"clientPort": 61390,
"serverPort": 80,
"body": 0,
"result": 302,
"type": "",
"time": "143ms",
"download": "0ms",
"response": "67ms",
"request": "51ms",
"dns": "25ms",
"protocol": "HTTP",
"hostname": "微信公众号的服务器地址",
"path": "/weixin/rs/weixin/getcode?state=标签参数",
"order": 85,
"hide": false,
"lost": true,
"selected": true,
"active": false,
"filename": "getcode"
},
{
"startTime": 1601264250958,
"id": "1601264250956-106",
//微信授权登陆后会重新跳转到公众号的回调地址
"url": "http://微信公众号的服务器地址/weixin/rs/weixin/getOpenid?code=微信授权登陆后返回的CODE&state=标签参数",
"req": {
"method": "GET",
"httpVersion": "1.1",
"ip": "192.168.110.198",
"port": 61389,
"rawHeaderNames": {
"host": "Host",
"proxy-connection": "Proxy-Connection",
"upgrade-insecure-requests": "Upgrade-Insecure-Requests",
"accept": "Accept",
"user-agent": "User-Agent",
"accept-language": "Accept-Language",
"accept-encoding": "Accept-Encoding",
"connection": "Connection",
"proxy-authorization": "Proxy-Authorization"
},
"headers": {
"host": "微信公众号的服务器地址",
"upgrade-insecure-requests": "1",
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"user-agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/7.0.15(0x17000f31) NetType/WIFI Language/zh_CN",
"accept-language": "zh-cn",
"accept-encoding": "gzip",
"connection": "keep-alive"
},
"trailers": {},
"size": 0,
"body": false,
"rawHeaders": {
"Host": "微信公众号的服务器地址",
"Upgrade-Insecure-Requests": "1",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"User-Agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/7.0.15(0x17000f31) NetType/WIFI Language/zh_CN",
"Accept-Language": "zh-cn",
"Accept-Encoding": "gzip",
"Connection": "keep-alive"
}
},
"res": {
"ip": "IP地址",
"port": 80,
"rawHeaderNames": {
"x-frame-options": "X-Frame-Options",
"x-content-type-options": "X-Content-Type-Options",
"x-xss-protection": "X-XSS-Protection",
"location": "Location",
"content-length": "Content-Length",
"date": "Date",
"server": "Server"
},
"statusCode": 302,
"statusMessage": "Found",
"headers": {
"x-frame-options": "DENY",
"x-content-type-options": "nosniff",
"x-xss-protection": "1; mode=block",
//公众号服务器后台验证前面返回的code并和用户信息匹配并返回了用户身份标签，之后所有的操作都通过这个openid来识别用户
"location": "http://微信公众号的服务器地址/weixin/index.html?openid=用户身份标签&filiale=标签参数",
"content-length": "0",
"date": "Mon, 28 Sep 2020 03:37:25 GMT",
"server": ""
},
"trailers": {},
"size": 0,
"body": false,
"rawHeaders": {
"X-Frame-Options": "DENY",
"X-Content-Type-Options": "nosniff",
"X-XSS-Protection": "1; mode=block",
"Location": "http://微信公众号的服务器地址/weixin/index.html?openid=用户身份标签&filiale=标签参数",
"Content-Length": "0",
"Date": "Mon, 28 Sep 2020 03:37:25 GMT",
"Server": ""
}
},
"rules": {},
"pipe": null,
"rulesHeaders": {},
"dnsTime": 1601264250958,
"useH2": false,
"requestTime": 1601264250960,
"responseTime": 1601264251268,
"endTime": 1601264251269,
"method": "GET",
"hostIp": "IP地址",
"clientIp": "192.168.110.198",
"date": "2020/9/28 上午11:37:30",
"clientPort": 61389,
"serverPort": 80,
"body": 0,
"result": 302,
"type": "",
"time": "311ms",
"download": "1ms",
"response": "308ms",
"request": "2ms",
"dns": "0ms",
"protocol": "HTTP",
"hostname": "微信公众号的服务器地址",
"path": "/weixin/rs/weixin/getOpenid?code=微信授权登陆后返回的CODE&state=标签参数",
"order": 88,
"hide": false,
"lost": true,
"selected": true,
"active": false
},
{
"startTime": 1601264251288,
"id": "1601264251287-107",
"url": "http://微信公众号的服务器地址/weixin/index.html?openid=用户身份标签&filiale=标签参数",
"req": {
"method": "GET",
"httpVersion": "1.1",
"ip": "192.168.110.198",
"port": 61389,
"rawHeaderNames": {
"host": "Host",
"proxy-connection": "Proxy-Connection",
"upgrade-insecure-requests": "Upgrade-Insecure-Requests",
"accept": "Accept",
"user-agent": "User-Agent",
"accept-language": "Accept-Language",
"accept-encoding": "Accept-Encoding",
"connection": "Connection",
"proxy-authorization": "Proxy-Authorization"
},
"headers": {
"host": "微信公众号的服务器地址",
"upgrade-insecure-requests": "1",
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"user-agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/7.0.15(0x17000f31) NetType/WIFI Language/zh_CN",
"accept-language": "zh-cn",
"accept-encoding": "gzip",
"connection": "keep-alive"
},
"trailers": {},
"size": 0,
"body": false,
"rawHeaders": {
"Host": "微信公众号的服务器地址",
"Upgrade-Insecure-Requests": "1",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"User-Agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/7.0.15(0x17000f31) NetType/WIFI Language/zh_CN",
"Accept-Language": "zh-cn",
"Accept-Encoding": "gzip",
"Connection": "keep-alive"
}
},
"res": {
"ip": "IP地址",
"port": 80,
"rawHeaderNames": {
"x-frame-options": "X-Frame-Options",
"x-content-type-options": "X-Content-Type-Options",
"x-xss-protection": "X-XSS-Protection",
"accept-ranges": "Accept-Ranges",
"etag": "ETag",
"last-modified": "Last-Modified",
"content-type": "Content-Type",
"content-length": "Content-Length",
"date": "Date",
"server": "Server"
},
"statusCode": 200,
"statusMessage": "OK",
"headers": {
"x-frame-options": "DENY",
"x-content-type-options": "nosniff",
"x-xss-protection": "1; mode=block",
"accept-ranges": "bytes",
"etag": "W/\"1804-1599700714957\"",
"last-modified": "Thu, 10 Sep 2020 01:18:34 GMT",
"content-type": "text/html",
"content-length": "1804",
"date": "Mon, 28 Sep 2020 03:37:25 GMT",
"server": ""
},
"trailers": {},
"size": 1804,
"body": "",
"base64": "数据",
"rawHeaders": {
"X-Frame-Options": "DENY",
"X-Content-Type-Options": "nosniff",
"X-XSS-Protection": "1; mode=block",
"Accept-Ranges": "bytes",
"ETag": "W/\"1804-1599700714957\"",
"Last-Modified": "Thu, 10 Sep 2020 01:18:34 GMT",
"Content-Type": "text/html",
"Content-Length": "1804",
"Date": "Mon, 28 Sep 2020 03:37:25 GMT",
"Server": ""
}
},
"rules": {},
"pipe": null,
"rulesHeaders": {},
"dnsTime": 1601264251289,
"useH2": false,
"requestTime": 1601264251290,
"responseTime": 1601264251339,
"endTime": 1601264251340,
"method": "GET",
"hostIp": "IP地址",
"clientIp": "192.168.110.198",
"date": "2020/9/28 上午11:37:31",
"clientPort": 61389,
"serverPort": 80,
"body": 1804,
"result": 200,
"type": "text/html",
"time": "52ms",
"download": "1ms",
"response": "49ms",
"request": "1ms",
"dns": "1ms",
"protocol": "HTTP",
"hostname": "微信公众号的服务器地址",
"path": "/weixin/index.html?openid=用户身份标签&filiale=标签参数",
"order": 89,
"hide": false,
"lost": true,
"selected": true,
"active": false,
"filename": "index.html"
},
分析完后，我们用浏览器打开地址：
http://微信公众号的服务器地址/weixin/index.html?openid=用户身份标签&filiale=标签参数
这时我们看到了熟悉的界面，没错，就是微信上面的界面。。
二、Chrome调试
接下来打开Chrome浏览器，输入刚刚的地址，打开页面，打开调试窗口切换到network标签页，点击我们需要查询的按钮，这时结果如下
此时我们可以知道查询的链接，查询的参数，但是查询参数是经过AES加密的，再看返回结果也是加密后的数据。
接下来我们找一下是否有相关解密的方法。
我们在刚刚返回的js里搜索查询参数里面的aoteEncrypt关键词，找到如下结果
这时我们发现了新的关键词：encryKey: this._scan
猜测this._scan应该就是AES的加密key，但是我们在返回的这些js里都没找到这个key。
我们返回到前页，清除调试窗口内容后刷新页面，在所有文件里已_scan为关键词进行搜索
发现有3个文件里有这个关键词，接着我们在单独的文件里再次搜索，这时我们找到了我们需要的加密KEY
为了验证我们的猜测是否正确，打开一个在线解密http://tool.chacuo.net/cryptaes/
输入加密内容和秘钥，解密成功，再看f_open_id的内容是不是很熟悉？没错就是前面打开的链接里的openid
我们再试试返回结果是否能解密，里面的数据和我们在网页上面看到的一样，这个就是我们需要的数据了。
下面就要进行下一步操作了，把我们手工完成的步骤转成NR自动完成，由于篇幅太长，内容太多放不下了。。。接下来的内容请看下一楼
