基于JS_HOOK的Web流量加解密框架教学文档<\/h1>

一、框架概述<\/h2>

1.1 核心概念<\/h3>
本框架是一个基于JavaScript Hook技术的Web流量加解密解决方案，主要用于处理前端加密的Web应用流量分析。该方案通过中间人替换和RPC通信机制，实现对加密流量的透明加解密。<\/p>

1.2 应用场景<\/h3>

金融类网站的前端加密流量分析<\/li>
Web应用安全测试中的加密流量处理<\/li>

逆向工程中的加解密函数追踪<\/li> <\/ul>

1.3 核心优势<\/h3>
无需深入分析加密算法<\/strong>：只需定位到加解密函数即可实现流量处理
通用性强<\/strong>：适用于各种JavaScript加密场景
实时处理<\/strong>：支持请求和响应的实时加解密<\/p>

二、技术架构<\/h2>
2.1 系统组成<\/h3>
1. 浏览器端JS Hook模块 2. Burp Suite中间人代理 3. 本地RPC服务（端口9999） 4. Burp插件扩展 <\/code><\/pre> 2.2 工作流程<\/h3> 明文请求 → JS Hook拦截 → 加密上报 → RPC服务 → 加密请求发送加密响应 → JS Hook拦截 → 解密上报 → RPC服务 → 明文显示 <\/code><\/pre> 三、详细实现步骤<\/h2> 3.1 加密函数参数和返回值记录<\/h3> 3.1.1 原始函数识别<\/h4> 假设原始加密函数为：<\/p> function<\/span> a<\/span>(x<\/span>) { <\/span><\/span> \/\/ 加密逻辑 <\/span><\/span><\/span><\/span> return<\/span> encryptedData<\/span>; <\/span><\/span>} <\/span><\/span><\/code><\/pre>3.1.2 Hook替换实现<\/h4> window.raw_a<\/span> =<\/span> a<\/span>; <\/span><\/span>a<\/span> =<\/span> function<\/span> (x<\/span>) { <\/span><\/span> const<\/span> BASE_URL<\/span> =<\/span> 'http:\/\/127.0.0.1:9999'<\/span>; <\/span><\/span> <\/span><\/span> async<\/span> function<\/span> reportData<\/span>(plain<\/span>, cipher<\/span>) { <\/span><\/span> await<\/span> fetch<\/span>(`<\/span>${<\/span>BASE_URL<\/span>}<\/span>\/report`<\/span>, { <\/span><\/span> method<\/span>:<\/span> 'POST'<\/span>, <\/span><\/span> headers<\/span>:<\/span> { 'Content-Type'<\/span>:<\/span> 'application\/json'<\/span> }, <\/span><\/span> body<\/span>:<\/span> JSON<\/span>.stringify<\/span>({ plaintext<\/span>:<\/span> plain<\/span>, ciphertext<\/span>:<\/span> cipher<\/span> }) <\/span><\/span> }); <\/span><\/span> }; <\/span><\/span> <\/span><\/span> \/\/ 记录加密前的明文 <\/span><\/span><\/span><\/span> plaintext<\/span> =<\/span> x<\/span>.jsonData<\/span>; <\/span><\/span> <\/span><\/span> \/\/ 执行原始加密函数 <\/span><\/span><\/span><\/span> window.raw_encryptJSONSM<\/span>(x<\/span>); <\/span><\/span> <\/span><\/span> \/\/ 记录加密后的密文 <\/span><\/span><\/span><\/span> ciphertext<\/span> =<\/span> x<\/span>.jsonData<\/span>; <\/span><\/span> <\/span><\/span> \/\/ 上报加解密数据对 <\/span><\/span><\/span><\/span> reportData<\/span>(plaintext<\/span>, ciphertext<\/span>); <\/span><\/span>}; <\/span><\/span><\/code><\/pre>3.2 解密函数参数和返回值记录<\/h3> 3.2.1 解密函数Hook<\/h4> const<\/span> BASE_URL<\/span> =<\/span> 'http:\/\/127.0.0.1:9999'<\/span>; <\/span><\/span> <\/span><\/span>async<\/span> function<\/span> reportData<\/span>(plain<\/span>, cipher<\/span>) { <\/span><\/span> await<\/span> fetch<\/span>(`<\/span>${<\/span>BASE_URL<\/span>}<\/span>\/report`<\/span>, { <\/span><\/span> method<\/span>:<\/span> 'POST'<\/span>, <\/span><\/span> headers<\/span>:<\/span> { 'Content-Type'<\/span>:<\/span> 'application\/json'<\/span> }, <\/span><\/span> body<\/span>:<\/span> JSON<\/span>.stringify<\/span>({ plaintext<\/span>:<\/span> plain<\/span>, ciphertext<\/span>:<\/span> cipher<\/span> }) <\/span><\/span> }); <\/span><\/span>}; <\/span><\/span> <\/span><\/span>window.raw_c<\/span> =<\/span> c<\/span>; <\/span><\/span>decodeJSON<\/span> =<\/span> function<\/span>(a<\/span>, b<\/span>){ <\/span><\/span> ret<\/span> =<\/span> window.raw_decodeJSON<\/span>(a<\/span>, b<\/span>); <\/span><\/span> reportData<\/span>(JSON<\/span>.stringify<\/span>(ret<\/span>), a<\/span>); <\/span><\/span> return<\/span> ret<\/span>; <\/span><\/span>}; <\/span><\/span><\/code><\/pre>3.3 RPC通信机制实现<\/h3> 3.3.1 客户端轮询脚本<\/h4> (function<\/span> () { <\/span><\/span> const<\/span> BRIDGE_URL<\/span> =<\/span> "http:\/\/127.0.0.1:9999"<\/span>; <\/span><\/span> <\/span><\/span> \/** <\/span><\/span><\/span> * 站点特定的加密逻辑 <\/span><\/span><\/span> *\/<\/span> <\/span><\/span> function<\/span> Encryption<\/span>(plainText<\/span>) { <\/span><\/span> window.raw_a<\/span>(plainText<\/span>); <\/span><\/span> return<\/span> x<\/span>; <\/span><\/span> } <\/span><\/span> <\/span><\/span> \/** <\/span><\/span><\/span> * 站点特定的解密逻辑 <\/span><\/span><\/span> *\/<\/span> <\/span><\/span> function<\/span> Decryption<\/span>(cipherText<\/span>) { <\/span><\/span> return<\/span> window.raw_c<\/span>(cipherText<\/span>) <\/span><\/span> } <\/span><\/span> <\/span><\/span> \/** <\/span><\/span><\/span> * 将结果返回给Burp Bridge <\/span><\/span><\/span> *\/<\/span> <\/span><\/span> async<\/span> function<\/span> reportResult<\/span>(taskId<\/span>, result<\/span>) { <\/span><\/span> try<\/span> { <\/span><\/span> await<\/span> fetch<\/span>(`<\/span>${<\/span>BRIDGE_URL<\/span>}<\/span>\/task`<\/span>, { <\/span><\/span> method<\/span>:<\/span> 'POST'<\/span>, <\/span><\/span> headers<\/span>:<\/span> { 'Content-Type'<\/span>:<\/span> 'application\/json'<\/span> }, <\/span><\/span> body<\/span>:<\/span> JSON<\/span>.stringify<\/span>({ <\/span><\/span> id<\/span>:<\/span> taskId<\/span>, <\/span><\/span> result<\/span>:<\/span> result<\/span> <\/span><\/span> }) <\/span><\/span> }); <\/span><\/span> } catch<\/span> (e<\/span>) { <\/span><\/span> console<\/span>.error<\/span>("Failed to report result:"<\/span>, e<\/span>); <\/span><\/span> } <\/span><\/span> } <\/span><\/span> <\/span><\/span> async<\/span> function<\/span> pollTask<\/span>() { <\/span><\/span> try<\/span> { <\/span><\/span> const<\/span> resp<\/span> =<\/span> await<\/span> fetch<\/span>(`<\/span>${<\/span>BRIDGE_URL<\/span>}<\/span>\/task`<\/span>); <\/span><\/span> const<\/span> task<\/span> =<\/span> await<\/span> resp<\/span>.json<\/span>(); <\/span><\/span> <\/span><\/span> \/\/ 忽略IDLE状态以减少控制台输出 <\/span><\/span><\/span><\/span> if<\/span> (task<\/span>.type<\/span> ===<\/span> "IDLE"<\/span>) { <\/span><\/span> return<\/span>; <\/span><\/span> } <\/span><\/span> <\/span><\/span> console<\/span>.log<\/span>("New Task Received:"<\/span>, task<\/span>.type<\/span>, task<\/span>.id<\/span>); <\/span><\/span> <\/span><\/span> let<\/span> result<\/span> =<\/span> null<\/span>; <\/span><\/span> if<\/span> (task<\/span>.type<\/span> ===<\/span> "ENCRYPT"<\/span>) { <\/span><\/span> result<\/span> =<\/span> await<\/span> Encryption<\/span>(task<\/span>.payload<\/span>); <\/span><\/span> } else<\/span> if<\/span> (task<\/span>.type<\/span> ===<\/span> "DECRYPT"<\/span>) { <\/span><\/span> console<\/span>.log<\/span>("DECRYPT"<\/span>, task<\/span>.payload<\/span>) <\/span><\/span> result<\/span> =<\/span> await<\/span> Decryption<\/span>(task<\/span>.payload<\/span>); <\/span><\/span> } <\/span><\/span> <\/span><\/span> if<\/span> (result<\/span> !==<\/span> null<\/span>) { <\/span><\/span> await<\/span> reportResult<\/span>(task<\/span>.id<\/span>, result<\/span>); <\/span><\/span> console<\/span>.log<\/span>("Task Completed:"<\/span>, task<\/span>.id<\/span>); <\/span><\/span> } <\/span><\/span> } catch<\/span> (e<\/span>) { <\/span><\/span> \/\/ 错误处理 <\/span><\/span><\/span><\/span> } finally<\/span> { <\/span><\/span> \/\/ 使用200ms-500ms轮询以获得更好的响应性 <\/span><\/span><\/span><\/span> setTimeout<\/span>(pollTask<\/span>, 300<\/span>); <\/span><\/span> } <\/span><\/span> } <\/span><\/span> <\/span><\/span> console<\/span>.log<\/span>("JS Bridge Client Started... Waiting for tasks."<\/span>); <\/span><\/span> pollTask<\/span>(); <\/span><\/span>})(); <\/span><\/span><\/code><\/pre>四、Burp Suite集成配置<\/h2> 4.1 中间人替换配置<\/h3> 配置Burp代理监听端口<\/li> 设置JS文件替换规则<\/li> 配置目标域名匹配规则<\/li> <\/ol> 4.2 插件安装和使用<\/h3> 下载并安装Burp扩展插件<\/li> 配置本地RPC服务端口（默认9999）<\/li> 启用JS Hook功能<\/li> <\/ol> 五、操作流程详解<\/h2> 5.1 请求加密流程<\/h3> 在Burp中捕获明文请求<\/li> 右键选择加密选项<\/li> JS Hook拦截并执行加密<\/li> 加密后的请求自动发送<\/li> <\/ol> 5.2 响应解密流程<\/h3> 捕获加密响应<\/li> 点击Decrypted标签触发RPC调用<\/li> JS Hook执行解密操作<\/li> 返回明文结果显示<\/li> <\/ol> 六、关键技术点<\/h2> 6.1 函数Hook技术<\/h3> 保存原始函数引用（window.raw_*）<\/li> 重写目标函数<\/li> 在Hook函数中插入监控逻辑<\/li> 调用原始函数完成实际功能<\/li> <\/ul> 6.2 数据上报机制<\/h3> 使用fetch API进行HTTP通信<\/li> JSON格式数据传输<\/li> 错误处理和重试机制<\/li> <\/ul> 6.3 任务调度系统<\/h3> 基于轮询的任务获取<\/li> 任务类型识别（ENCRYPT\/DECRYPT）<\/li> 异步结果上报<\/li> <\/ul> 七、部署注意事项<\/h2> 7.1 环境要求<\/h3> 现代浏览器支持ES6+<\/li> Burp Suite专业版<\/li> 本地网络环境（127.0.0.1:9999）<\/li> <\/ul> 7.2 安全考虑<\/h3> 仅在测试环境使用<\/li> 注意CORS策略配置<\/li> 避免生产环境误用<\/li> <\/ul> 八、故障排除<\/h2> 8.1 常见问题<\/h3> Hook不生效<\/strong>：检查JS文件替换是否正确<\/li> RPC连接失败<\/strong>：确认端口9999未被占用<\/li> 加解密异常<\/strong>：验证目标函数名称是否正确<\/li> <\/ol> 8.2 调试技巧<\/h3> 使用浏览器开发者工具查看控制台输出<\/li> 检查Network面板中的RPC通信<\/li> 验证Hook函数是否正确替换<\/li> <\/ul> 九、扩展开发<\/h2> 9.1 自定义加解密逻辑<\/h3> 修改Encryption和Decryption函数以适应不同的加密方案<\/p> 9.2 多站点支持<\/h3> 通过URL匹配实现不同站点的差异化处理<\/p> 十、资源参考<\/h2> 示例代码仓库：https:\/\/github.com\/lanyi1998\/js_hook_decrype<\/li> 先知社区原文链接提供完整实现细节<\/li> <\/ul> 本教学文档详细介绍了基于JS_HOOK的Web流量加解密框架的实现原理和使用方法，涵盖了从基础概念到具体实施的各个环节，为安全研究人员提供了完整的技术解决方案。<\/p>

基于JS_HOOK的Web流量加解密框架教学文档<\/h1>

一、框架概述<\/h2>

1.1 核心概念<\/h3> 本框架是一个基于JavaScript Hook技术的Web流量加解密解决方案，主要用于处理前端加密的Web应用流量分析。该方案通过中间人替换和RPC通信机制，实现对加密流量的透明加解密。<\/p>

1.3 核心优势<\/h3> 无需深入分析加密算法<\/strong>：只需定位到加解密函数即可实现流量处理 通用性强<\/strong>：适用于各种JavaScript加密场景 实时处理<\/strong>：支持请求和响应的实时加解密<\/p>

三、详细实现步骤<\/h2>

3.1 加密函数参数和返回值记录<\/h3>

3.2 解密函数参数和返回值记录<\/h3>

3.3 RPC通信机制实现<\/h3>

四、Burp Suite集成配置<\/h2>

五、操作流程详解<\/h2>

六、关键技术点<\/h2>

七、部署注意事项<\/h2>

八、故障排除<\/h2>

九、扩展开发<\/h2>

9.1 自定义加解密逻辑<\/h3> 修改Encryption和Decryption函数以适应不同的加密方案<\/p>

9.2 多站点支持<\/h3> 通过URL匹配实现不同站点的差异化处理<\/p>

1.1 核心概念<\/h3>
本框架是一个基于JavaScript Hook技术的Web流量加解密解决方案，主要用于处理前端加密的Web应用流量分析。该方案通过中间人替换和RPC通信机制，实现对加密流量的透明加解密。<\/p>

1.3 核心优势<\/h3>
无需深入分析加密算法<\/strong>：只需定位到加解密函数即可实现流量处理
通用性强<\/strong>：适用于各种JavaScript加密场景
实时处理<\/strong>：支持请求和响应的实时加解密<\/p>

9.1 自定义加解密逻辑<\/h3>
修改Encryption和Decryption函数以适应不同的加密方案<\/p>

9.2 多站点支持<\/h3>
通过URL匹配实现不同站点的差异化处理<\/p>