税务某局 webpack 登录接口逆向分析

持续创作文章，只是为了更好的思考

这里不多介绍了，我放一张图大家就明白是什么接口了。这里只介绍整体加密逻辑，有些细的地方大家自行调整。
在这里插入图片描述

本次逆向的网址是

aHR0cHM6Ly90cGFzcy5qaWxpbi5jaGluYXRheC5nb3YuY246ODQ0My8jL2xvZ2luP3JlZGlyZWN0X3VyaT1odHRwcyUzQSUyRiUyRmV0YXguamlsaW4uY2hpbmF0YXguZ292LmNuJTNBMTA4MTIlMkZzd29yZCUzRmN0cmwlM0REenN3akt4dHhDdHJsX2dldEt4dHhPYXV0aDJUb2tlbiZjbGllbnRfaWQ9ZTJlYjVjY2RjMTliMTFlZGI4OWE0MGE2YjcyYTNkNjgmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPXRlc3Q=

我们先看一下接口参数
在这里插入图片描述
主要的加密参数有两个，datagram和signature，我们全局找一下这两个参数，最后定位到加密代码在这个位置。

是由A这个变量来加密的，我们往上找A变量，发现是由n生成而来。

我们再观察一下整体代码，这就是典型的webpack，我们在这里打上断点后，跟上n，发现这个webpack加载器的位置在html里面
在这里插入图片描述
我们还是顺着逻辑将加载器扣下来，然后用一个变量去接收，有了加载器，我们直接把加密代码扣下来做下处理，把一些用到的参数整理下如下。（注意，pengyuyan这个变量就是我自己的加载器）

然后在用python去调用这个登录接口，然后直接报错了。

{'code': 1029, 'msg': '初始化秘钥失败', 'zipCode': '', 'encryptCode': '', 'datagram': '', 'signtype': '', 'signature': '', 'timestamp': ''}

我们再回到接口逻辑去看一下，发现每次请求前，还有两个接口，getpublickey和sendsm4，这里分析了一下调用逻辑，sm4这个接口用到一个参数是由publickey返回的一个参数而来，这个参数又经过内部加密处理，我们找到这个参数加密的地方，大概是在这个位置。

在这里插入图片描述
打上断点分析后，_utils_getuuid这个很长的变量也是加载器的一个函数，我们将这段代码也扣下来，如下。

然后再把接口一组装，任意模拟一个账号密码请求，最后成功返回报错。

整体代码如下，代码仅供参考：

import requests
import execjs
import json


cookies = {
    'oauth2_referer': 'etax.jiangsu.chinatax.gov.cn',
    'security-token-key': 'dzfp-ssotoken',
    'dzfp-ssotoken': '82932c9952f84f5c9bf5fc20898974d0',
    'SSO_SECURITY_CHECK_TOKEN': '99452946898642c6bc50f8882f43e257',
    'x_host_key': '18b5bcb415a-bd0071fa9b5ad19287a5d856809eab86e4fe2374',
}
headers = {
    'Accept': 'application/json, text/plain, */*',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    'Authorization': '',
    'Connection': 'keep-alive',
    'Content-Type': 'application/json',
    # 'Cookie': 'yfx_c_g_u_id_10003715=_ck23072014224115044979119343157; yfx_f_l_v_t_10003715=f_t_1689834161500__r_t_1689834161500__v_t_1689834161500__r_c_0; yfx_mr_10003715=%3A%3Amarket_type_free_search%3A%3A%3A%3Abaidu%3A%3A%3A%3A%3A%3A%3A%3Awww.baidu.com%3A%3A%3A%3Apmf_from_free_search; yfx_key_10003715=; yfx_c_g_u_id_10000056=_ck23072415384912995714886551340; yfx_c_g_u_id_10003721=_ck23072415390816113913311322717; yfx_f_l_v_t_10003721=f_t_1690184348605__r_t_1690184348605__v_t_1690184348605__r_c_0; yfx_c_g_u_id_10003711=_ck23072416492118138747372181577; yfx_c_g_u_id_10003712=_ck23072511401713751183420327449; yfx_c_g_u_id_10003746=_ck23072514571511736123106352325; yfx_f_l_v_t_10003746=f_t_1690268235153__r_t_1690268235153__v_t_1690268235153__r_c_0; yfx_f_l_v_t_10003711=f_t_1690188561813__r_t_1690250410509__v_t_1690277376153__r_c_1; yfx_f_l_v_t_10003712=f_t_1690256417358__r_t_1690256417358__v_t_1690277502152__r_c_0; yfx_c_g_u_id_10000001=_ck23073118235019736370725472545; yfx_c_g_u_id_10003677=_ck23073118235019949353041310354; yfx_f_l_v_t_10000001=f_t_1690799030965__r_t_1690857080990__v_t_1690868559828__r_c_1; yfx_f_l_v_t_10003677=f_t_1690799030989__r_t_1690857081007__v_t_1690868559848__r_c_1; yfx_c_g_u_id_10003705=_ck23083118470714820520378270935; yfx_f_l_v_t_10003705=f_t_1693478827483__r_t_1693536421994__v_t_1693536421994__r_c_1; yfx_c_g_u_id_10003718=_ck23091217472613436764689312930; yfx_mr_10003718=%3A%3Amarket_type_free_search%3A%3A%3A%3Abaidu%3A%3A%3A%3A%3A%3A%3A%3Awww.baidu.com%3A%3A%3A%3Apmf_from_free_search; yfx_key_10003718=; yfx_f_l_v_t_10003718=f_t_1694512046298__r_t_1694571365785__v_t_1694571365785__r_c_1; sensorsdata2015jssdkcross=%7B%22distinct_id%22%3A%2218aace7af0a36-03dbfce8e4ade5c-26031f51-3686400-18aace7af0b14d2%22%2C%22first_id%22%3A%22%22%2C%22props%22%3A%7B%7D%2C%22identities%22%3A%22eyIkaWRlbnRpdHlfY29va2llX2lkIjoiMThhYWNlN2FmMGEzNi0wM2RiZmNlOGU0YWRlNWMtMjYwMzFmNTEtMzY4NjQwMC0xOGFhY2U3YWYwYjE0ZDIifQ%3D%3D%22%2C%22history_login_id%22%3A%7B%22name%22%3A%22%22%2C%22value%22%3A%22%22%7D%2C%22%24device_id%22%3A%2218aace7af0a36-03dbfce8e4ade5c-26031f51-3686400-18aace7af0b14d2%22%7D; yfx_c_g_u_id_10003717=_ck23102311052910443593558387171; yfx_f_l_v_t_10003717=f_t_1698030329030__r_t_1698030329030__v_t_1698030329030__r_c_0; yfx_mr_10003717=%3A%3Amarket_type_free_search%3A%3A%3A%3Abaidu%3A%3A%3A%3A%3A%3A%3A%3Awww.baidu.com%3A%3A%3A%3Apmf_from_free_search; yfx_mr_f_10003717=%3A%3Amarket_type_free_search%3A%3A%3A%3Abaidu%3A%3A%3A%3A%3A%3A%3A%3Awww.baidu.com%3A%3A%3A%3Apmf_from_free_search; yfx_key_10003717=; _trs_uv=lo2bf0nn_343_37vx; yfx_f_l_v_t_10000056=f_t_1690184329273__r_t_1698031764057__v_t_1698031764057__r_c_4; yfx_mr_10000056=%3A%3Amarket_type_free_search%3A%3A%3A%3Abaidu%3A%3A%3A%3A%3A%3A%3A%3Awww.baidu.com%3A%3A%3A%3Apmf_from_free_search; yfx_mr_f_10000056=%3A%3Amarket_type_free_search%3A%3A%3A%3Abaidu%3A%3A%3A%3A%3A%3A%3A%3Awww.baidu.com%3A%3A%3A%3Apmf_from_free_search; yfx_key_10000056=; x_host_key=18b5a96316a-0319ba9b6d54ab05e9ddd7bcef1957b061d44daa',
    'Origin': 'https://tpass.jilin.chinatax.gov.cn:8443',
    'Referer': 'https://tpass.jilin.chinatax.gov.cn:8443/',
    'Sec-Fetch-Dest': 'empty',
    'Sec-Fetch-Mode': 'cors',
    'Sec-Fetch-Site': 'same-origin',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36',
    'X-APP-CLIENTID': 'e2eb5ccdc19b11edb89a40a6b72a3d68',
    'X-LANG-ID': 'null',
    'X-NATURE-IP': '',
    'X-SM4-INFO': '0',
    'X-TEMP-INFO': 'bc004edfa30341ec901388640ee2bcb2',
    'X-TICKET-ID': 'null',
    'deviceIdentyNo': 'pwRA8D1PoH0pu2jNdYgHU8wLv48ag16T',
    'hUid': 'd40c61676d2c4ddccd7601b48e7b3ef9',
    'sec-ch-ua': '"Chromium";v="118", "Google Chrome";v="118", "Not=A?Brand";v="99"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"Windows"',
}

localstorage = {
    "areaName": "吉林",
    "naturepublicKey": "04A21F3C79FAD0F87A54CA0C7FBEB8662F9F08DFEB720580C071CCA5CEB621168580AF4DC014F12F9F8FE5C9696D57C366E70508F4517AB60D7FC80758E8929B31",
    "idSel": "0",
    "new_key16": "U6kMwMFxKW9EMWyY",
    "areaPrefix": "2200",
    "timestamp": "1698053978365",
    "ud": "d40c61676d2c4ddccd7601b48e7b3ef9",
    # "logConfig": "{\"loginTips\":[{\"enterpriseQuickLogin\":{\"tips\":\"<div style='margin-bottom: 10px;'>温馨提示：</div><div style='margin-bottom: 10px;'>1.跨区域报验户、跨区税源登记纳税人等用户请在“企业业务”—“特定主体登录”入口登录。</div><div style='margin-bottom: 10px;'>2.未注册用户请在“自然人业务”登录页面下方点击“用户注册”进行用户实名注册。</div>\"},\"agentQuickLogin\":{\"tips\":\"<div style='margin-bottom: 16px;'>温馨提示：</div><div style='margin-bottom: 16px;'>当前登录方式仅支持涉税专业服务机构登录。原委托代征单位、交通部门、承印单位、自然资源部门等第三方机构请从企业业务入口登录。</div>\"}}],\"scanCodeTabList\":[{\"name\":\"吉林税务APP\",\"value\":\"appScan\",\"tips\":\"http://jilin.chinatax.gov.cn/art/2023/1/10/art_3292_427739.html\"},{\"name\":\"个人所得税APP\",\"value\":\"personTaxScan\",\"tips\":\"<div style='margin-bottom: 16px;'>温馨提示：</div><div style='margin-bottom: 16px;'>1.请使用个人所得税APP“扫一扫”扫码登录。</div><div style='margin-bottom: 16px;'>2.“个人所得税APP扫码”登录仅支持以下证件类型刷脸验证身份：居民身份证、中华人民共和国港澳居民居住证、中华人民共和国台湾居民居住证、港澳居民来往内地通行证。</div>\"}],\"secondCetifyLevelThree\":[{\"label\":\"证书认证\",\"componentName\":\"CertCertify\",\"value\":\"cert\"},{\"label\":\"扫脸认证\",\"componentName\":\"FaceCertify\",\"value\":\"face\"}],\"cetifyLoginTypeList\":[{\"name\":\"税务数字证书\",\"value\":\"0\",\"tips\":\"请将税务数字证书介质（金税盘、税控盘或税务UKey）插入电脑。\"}],\"dpptData\":[{\"dpptUrl\":\"https://dppt.jilin.chinatax.gov.cn:8443/dpmhpt/rest/homePageInit\",\"clientId\":\"g6cgb898a94c4g46885g8ba36fd4ff56\",\"titleName\":\"(电子发票快捷入口)\",\"notShowLang\":false}],\"specialLoginList\":[{\"name\":\"跨区域报验户\",\"value\":\"1\"},{\"name\":\"跨区税源登记纳税人\",\"value\":\"2\"}],\"personTaxScan\":[{\"name\":\"吉林税务APP扫码认证\",\"value\":\"appScan\",\"tips\":\"\"},{\"name\":\"个人所得税APP扫码认证\",\"value\":\"personTaxScan\",\"tips\":\"<div style='margin-bottom: 16px;'>温馨提示：</div><div style='margin-bottom: 16px;'>1.请使用个人所得税APP“扫一扫”扫码登录。</div><div style='margin-bottom: 16px;width:598px;'>2.“个人所得税APP扫码”登录仅支持以下证件类型刷脸验证身份：居民身份证、<br/>中华人民共和国港澳居民居住证、中华人民共和国台湾居民居住证、港澳居民来往内地通行证。</div>\"}],\"moreLinkUrl\":[{\"url\":\"https://etax.jilin.chinatax.gov.cn:10812/sword?ctrl=LnGdsPortalCtrl_dlqtz&rk=gzfw\"}],\"switch\":[{\"sliderValidateOld\":true,\"mobilelShowSlide\":false,\"showChangeLang\":true,\"itsScan\":false,\"emailsliderValidate\":true,\"srfSwitch\":false,\"funTreeDisabled\":false}],\"idTypeList\":[{\"name\":\"居民身份证\",\"value\":\"201\"},{\"name\":\"港澳居民来往内地通行证\",\"value\":\"210\"},{\"name\":\"台湾居民来往大陆通行证\",\"value\":\"213\"},{\"name\":\"中国护照\",\"value\":\"227\"},{\"name\":\"外国人永久居留证\",\"value\":\"233\"},{\"name\":\"中华人民共和国港澳居民居住证\",\"value\":\"237\"},{\"name\":\"中华人民共和国台湾居民居住证\",\"value\":\"238\"},{\"name\":\"外国护照\",\"value\":\"208\"},{\"name\":\"中华人民共和国外国人工作许可证（A类）\",\"value\":\"239\"},{\"name\":\"中华人民共和国外国人工作许可证（B类）\",\"value\":\"240\"},{\"name\":\"中华人民共和国外国人工作许可证（C类）\",\"value\":\"241\"},{\"name\":\"其他个人证件\",\"value\":\"299\"}],\"loginCheckType\":[{\"name\":\"滑动验证\",\"value\":\"0\"}],\"noLoginLink\":[{\"linkUrl\":\"https://etax.jilin.chinatax.gov.cn:10812/sword?ctrl=LnGdsPortalCtrl_initPageln&gnlj=%2Fsword%3Fctrl%3DNsrdYhzcCtrl_nsrdzcyzInit%3FybyBz%3DN\",\"icon\":\"el-icon-thumb\",\"linkName\":\"跨省报验户报验登记\"},{\"linkUrl\":\"https://etax.jilin.chinatax.gov.cn:10812/sword?ctrl=LnGdsPortalCtrl_gzcxPageInit&type=gzcx&gzcxurl=https%3A%2F%2Fetax.jilin.chinatax.gov.cn%3A10812%2Fsword%3Fctrl%3DLnGdsPortalCtrl_dlqtz%26rk%3Dgzfw&gnlj=/sword?ctrl=CxzxFplxcxCtrl_initView&gnbt=%E5%8F%91%E7%A5%A8%E6%B5%81%E5%90%91%E6%9F%A5%E8%AF%A2\",\"icon\":\"el-icon-tickets\",\"linkName\":\"发票流向查询\"},{\"linkUrl\":\"http://jilin.chinatax.gov.cn/col/col330/index.html\",\"icon\":\"el-icon-chat-line-square\",\"linkName\":\"热点问题\"},{\"linkUrl\":\"https://12366.chinatax.gov.cn/bsfw/bsdt/\",\"icon\":\"el-icon-map-location\",\"linkName\":\"办税地图\"},{\"linkUrl\":\"https://12366.chinatax.gov.cn/bsfw/calendar/main\",\"icon\":\"el-icon-date\",\"linkName\":\"办税日历\"}],\"registType\":[{\"name\":\"统一身份管理平台注册\",\"is_residents\":\"1\",\"value\":\"1\"}],\"secondCetifyLevelTwo\":[{\"label\":\"短信认证\",\"componentName\":\"SmsCertify\",\"value\":\"sms\"},{\"label\":\"证书认证\",\"componentName\":\"CertCertify\",\"value\":\"cert\"},{\"label\":\"扫脸认证\",\"componentName\":\"FaceCertify\",\"value\":\"face\"}],\"areaInfoData\":[{\"areaPrefix\":\"2200\",\"areaName\":\"吉林\",\"areaPreName\":\"吉林省\"}],\"oldLoginPage\":[{\"pageUrl\":\"https://etax.jilin.chinatax.gov.cn:10812/sword?ctrl=LoginCtrlTmp_logout&old\"}],\"fundPwdTypes\":[{\"name\":\"吉林税务APP扫码验证\",\"value\":\"1\"}],\"agentTabList\":[{\"firstStep\":[{\"secondStep\":{\"isSms\":\"1\",\"scanList\":[{\"name\":\"税务APP扫码\",\"value\":\"1\"},{\"name\":\"个人所得税APP扫码\",\"value\":\"3\"},{\"name\":\"短信验证\",\"value\":\"0\"}],\"isSmsVerify\":\"0\"},\"name\":\"密码验证\",\"value\":\"0\"}],\"isStepTwo\":\"1\",\"name\":\"账号密码登录\",\"value\":\"isActiveQuick\"}],\"functionSettings\":[{\"zxm\":{\"name\":\"助信码\",\"show\":\"1\"}}],\"personTwiceList\":[{\"name\":\"税务APP扫码认证\",\"value\":\"1\"}],\"baseLoginPage\":[{\"name\":\"https://etax.jilin.chinatax.gov.cn:10812/sword?ctrl=LoginCtrlTmp_logout\"}],\"enterpriseTabList\":[{\"firstStep\":[{\"secondStep\":{\"isSms\":\"1\",\"scanList\":[{\"name\":\"税务APP扫码\",\"value\":\"1\"},{\"name\":\"个人所得税APP扫码\",\"value\":\"3\"},{\"name\":\"短信验证\",\"value\":\"0\"}],\"isSmsVerify\":\"0\"},\"name\":\"密码验证\",\"value\":\"0\"}],\"isStepTwo\":\"1\",\"name\":\"账号密码登录\",\"value\":\"isActiveQuick\"},{\"secondStep\":[{\"name\":\"密码验证\",\"value\":\"isActivePwd\"},{\"name\":\"短信验证\",\"value\":\"isActiveSms\"},{\"scanList\":\"1\",\"name\":\"税务APP扫码\",\"value\":\"isActiveScan\"},{\"scanList\":\"3\",\"name\":\"个人所得税APP扫码\",\"value\":\"isActiveScan\"}],\"name\":\"数字证书登录\",\"value\":\"isActiveTaxC\"},{\"firstStep\":[{\"secondStep\":{\"isSms\":\"1\",\"scanList\":[{\"name\":\"税务APP扫码\",\"value\":\"1\"},{\"name\":\"个人所得税APP扫码\",\"value\":\"3\"},{\"name\":\"短信验证\",\"value\":\"0\"}],\"isSmsVerify\":\"0\"},\"name\":\"密码验证\",\"value\":\"0\"}],\"isStepTwo\":\"1\",\"name\":\"特定主体登录\",\"value\":\"isSpecialLogin\"},{\"firstStep\":[{\"name\":\"密码验证\",\"value\":\"0\"}],\"isStepTwo\":\"0\",\"name\":\"非居民企业登录\",\"value\":\"isNonResidentLogin\"}],\"infoMaaintenance\":[{\"addressMaintainP\":\"1\",\"userNameMaintainP\":\"1\",\"emailMaintainP\":\"1\",\"CAMaintainP\":\"1\"}],\"secondAuthScan\":[{\"name\":\"吉林税务APP扫码认证\",\"value\":\"appScan\",\"tips\":\"\"},{\"name\":\"个人所得税APP扫码认证\",\"value\":\"personTaxScan\",\"tips\":\"<div style='margin-bottom: 16px;'>温馨提示：</div><div style='margin-bottom: 16px;'>1.请使用个人所得税APP“扫一扫”扫码登录。</div><div style='margin-bottom: 16px;width:598px;'>2.“个人所得税APP扫码”登录仅支持以下证件类型刷脸验证身份：居民身份证、<br/>中华人民共和国港澳居民居住证、中华人民共和国台湾居民居住证、港澳居民来往内地通行证。</div>\"}],\"secondCetifyLevelFour\":[{\"label\":\"扫脸认证\",\"componentName\":\"FaceCertify\",\"value\":\"face\"}],\"specialIsPage\":[{\"isPage\":\"0\"}],\"showChangeLang\":[{\"show\":\"1\"}],\"loginFirstType\":[{\"name\":\"密码登录\",\"value\":\"0\"}],\"personTabList\":[{\"firstStep\":[{\"secondStep\":{\"isSms\":\"1\",\"scanList\":[{\"name\":\"税务APP扫码\",\"value\":\"1\"},{\"name\":\"个人所得税APP扫码\",\"value\":\"3\"},{\"name\":\"短信验证\",\"value\":\"0\"}],\"isSmsVerify\":\"0\"},\"isStepTwo\":\"1\",\"name\":\"手机号登录\",\"value\":\"isActiveSms\"}],\"name\":\"账号密码登录\",\"value\":\"0\"},{\"firstStep\":[{\"isStepTwo\":\"0\",\"name\":\"境外自然人登录\",\"value\":\"isActiveNonResident\"}],\"name\":\"境外自然人登录\",\"value\":\"2\"}],\"forgetPasswordScan\":[{\"name\":\"吉林税务APP扫码认证\",\"value\":\"appScan\",\"tips\":\"\"},{\"name\":\"个人所得税APP扫码认证\",\"value\":\"personTaxScan\",\"tips\":\"<div style='margin-bottom: 16px;'>温馨提示：</div><div style='margin-bottom: 16px;'>1.请使用个人所得税APP“扫一扫”扫码登录。</div><div style='margin-bottom: 16px;width:598px;'>2.“个人所得税APP扫码”登录仅支持以下证件类型刷脸验证身份：居民身份证、<br/>中华人民共和国港澳居民居住证、中华人民共和国台湾居民居住证、港澳居民来往内地通行证。</div>\"}]}",
    "ded": "pwRA8D1PoH0pu2jNdYgHU8wLv48ag16T",
    "natureuuid": "50ae991a2b6f42a0bf7c89af0bf98171",
    "clientId": "e2eb5ccdc19b11edb89a40a6b72a3d68"
}
js_str = execjs.compile(open("wpack_load.js", "r", encoding="utf8").read())

newkey16 = localstorage.get("new_key16")
# uuid = localstorage.get("natureuuid")
client_id = localstorage.get("clientId")
naturepublicKey = localstorage.get("naturepublicKey")
natureuuid = localstorage.get("natureuuid")

headers['X-APP-CLIENTID'] = client_id
headers['X-TEMP-INFO'] = natureuuid
session = requests.session()
# session.cookies.update(cookies)

f = '{}'
json_data = js_str.call("get_secretdata", f, newkey16, 0)
print(json_data)

response = session.post(
     'https://tpass.jilin.chinatax.gov.cn:8443/sys-api/v1.0/auth/oauth2/getPublicKey',
    # cookies=cookies,
    headers=headers,
    json=json_data,
)
print(response.json())
uuid = json.loads(response.json().get("datagram")).get("uuid")

secret, key16 = js_str.call("get_sm4", naturepublicKey)
f = '{"uuid":"%s","secret":"%s"}' % (uuid, secret)
json_data = js_str.call("get_secretdata", f, newkey16, 0)
print(json_data)

response = session.post(
    'https://tpass.jilin.chinatax.gov.cn:8443/sys-api/v1.0/auth/white/sendSm4',
    # cookies=cookies,
    headers=headers,
    json=json_data,
)
print(response.json())

f = '{"client_id":"%s","account":"1241","password":"24124","redirect_uri":"https://etax.jilin.chinatax.gov.cn:10812/sword?ctrl=DzswjKxtxCtrl_getKxtxOauth2Token","creditCode":"123"}' % (client_id)
json_data = js_str.call("get_secretdata", f, newkey16, 2)
print(json_data)

response = session.post(
    'https://tpass.jilin.chinatax.gov.cn:8443/sys-api/v1.0/auth/enterprise/quick/factorAccountLogin',
    # cookies=cookies,
    headers=headers,
    json=json_data,
)
print(response.json())