[JS reverse] MD5 encryption parameter cracking

MD5

md5: Message digest algorithm （ english ：MD5 Message-Digest Algorithm ）, A widely used cryptographic hash function , Can produce a 128 position （16 byte ） Hash value . The encryption algorithm is irreversible , Crack through violent exhaustion , And website interface to realize decryption .
js In reverse , You can search for MD5 Keyword to find the encrypted location .

md5 Of js Encryption method ：

const CryptoJs = require ('crypto-js');  // Import encryption library 
let password = 'philosophy'; // Encrypted string 
let enPwd = CryptoJs.MD5(password).toString();
console.log(enPwd);  // Output results 

python Realization MD5 encryption :

Method 1 ：

import hashlib
str = 'philosophy'  # Encrypted string 
m = hashlib.md5()
m.update(str.encode('utf-8'))
print(m.hexdigest())

Method 2 ：

from lxpy.encrypt import md5  # Third party libraries need to be installed 
print(md5.get_md5(str))

The output is ：

225ab6cdf797eae79495ff584a46dfd2

Reverse case

Enter the login window , open Developer tools , Enter the account and password , Click login to capture packets ：
Web site address ：https://www.zhaoxi.net/

In developer tools Network The panel can see that there are three data submitted by login , The first two parameters are fixed , Parameters txtpassword Obviously generated by encryption , As shown in the figure ：

Through the global search for parameter names, you can see that there are multiple results , Use Initiator Quick view of stack calls , Get into send Set breakpoint in call , Re trigger the login request ：


After the breakpoint is triggered by login again , Make a backtrace stack call , Click the right side. Call Stack( call Stack ）, Click one by one to view , You can find CheckForm Inside Ajax There is a before the request #txtpassword , It can be seen that hex_md5 It is obviously a cryptographic function , In the console console Enter it in , Double click the method to view ：


Can be confirmed as md5 encryption , adopt python Implement encryption , It can be found that the encryption result is consistent with the submitted parameter value .