2025年最新ALIPAY WEB 登陆rsa加密 分析记录

发现password字段是加密的和url编码了

我们先url解码看看 password

TGmwBXTQ9sE2P3v0TvTp9Ohd7MFVu49oGmaTuVsPSKjHkO09 FhGDs4pfvsz4EyPJK1MEiZHsissmVC1ok1NpXgBjR/l4R4eJ5QE B3H/VBJ80J19DcsZUDAve5lspik9Ob1g2FewafIoAENIL8wJpZAnHEA3haU4SiEaqupKRKDLxuJpEyAsufHcqNLwq/XhBAkBgvC 3kkRYbXv pCkZVMYqxCT8QiK492LEKp4XjnxdlT0xr0QGZAf/o1JSY1J91L4wwh64hLWdCbj2dShkgiT/Wpcnbtopfdjs4smw2iLtWxDigc0 1pQw79jDHnTBGAkfXKwDXsa4oYlC8Hqw==

goto: https://authweb.alipay.com/mobile/auth?v=h5&auth_type=AUTHACCOUNT&biz_type=openservice&sign=AIuHm3Q7BaDWv39Hu7udymjfpncLygKpen%2FNcZVABL8%3D&pid=2088821693967553&target_id=com.huawei.health&app_name=mc&apiname=com.alipay.account.auth&msp_type=sdk-and-lite&product_id=APP_FAST_LOGIN&scope=kuaijie&app_id=2017111309907804&timestamp=1617153466948

发现是密码的加密 和 登陆地址的拼接，那就看看密码的加密是怎么来的吧~~~~

经过调试，发现加密js文件路径

https://a.alipayobjects.com/g/authcenter-assets/h5login/1.2.6/login-accpwd.js

_initComponents 处下断点，刷新网页，得到 rsaPublicKey 加密公钥

我们来验证一下是对的

得到输入的账号和密码，再进行rsa加密的密码

来看看 getRsaPassword 的具体实现

发现 rsaSalt 是空的，以后有可能不是空

getRsaPassword 调用了 this._components.rsa.encrypt(e + t)

继续看 rsa.encrypt 加密实现

就是去除密码的前面245位，然后调用 this.key.encrypt(t.substr(0, 245)) 加密，得到十六进制数

5cc2c85be0c34e189a2bab02c4f23269fba074f1e4fb76a29108d941746087b2e6006a463809eddf66f6b364ad6a735d6cbcb19fcb8121dd66af03c51f7ded4adcd5a409405f51cf135c31af34d7480d772d6af42c6d71dff7fe00c51bfb3c2d41126aeb596ec9fb195ca45a1841168ebf82c14dc902765ca04e8b3841a2992766b450119b4b91779e5b02db1ed9b4ead0ed03c6979b8e5bb08c9586e15819bb3e48d781a3afcebcbbdf172f42fe88fa31537eaa6d3efea5726b7a310abd92eb7e8eb22689a63d30306bf282f52c13779c355e04d65be887988edb84b18d602c218ed05e6c0b57a3f59e9a261c6bd4466701bb2793589bcbc1b53c210bc0208c

加密完 调用了r() Call   其实就是 hexToBase64 编码一下 得到最终密码

“fhRKPmXU+rHGvFrtreEXMGwTa0+D5WHka+6ZzLiK6Q0qLwl4JpxlnMMDL0k5+2ZGokxsXWZLpnsHklfICBWa+7Cw9iuKvxyxveKlKdZnkTsPqFkxOGvMHZcarBP79Wk/1HjTvd9zY+xa8WugbsQ/3OcOuVYjtc/U+jzOsb6MHTWMXk1ouxXc7TUUQdgdIR3cb5OPlNhlmZslLSqRKSFJ+f4icBcSZcJvyNXbXfyQqDnOC0ulii0TIdy6d+zGzTHjNvU9R7Crfd6E8gn6equ7Et0HSmTQnolJAfJB70cz1QwbMoWNqbNuvrFuSJNPdu8iNRJ9p95TJv4YTnO1rS820A==”

getFormData 密码加结果，发现和分析相同

【作vip204888者徽交流信】

然后发送POSt

1. 1. account:“1111111”

2. password:“aaaaaaaaaaa”

3. rsaPassword:“fhRKPmXU+rHGvFrtreEXMGwTa0+D5WHka+6ZzLiK6Q0qLwl4JpxlnMMDL0k5+2ZGokxsXWZLpnsHklfICBWa+7Cw9iuKvxyxveKlKdZnkTsPqFkxOGvMHZcarBP79Wk/1HjTvd9zY+xa8WugbsQ/3OcOuVYjtc/U+jzOsb6MHTWMXk1ouxXc7TUUQdgdIR3cb5OPlNhlmZslLSqRKSFJ+f4icBcSZcJvyNXbXfyQqDnOC0ulii0TIdy6d+zGzTHjNvU9R7Crfd6E8gn6equ7Et0HSmTQnolJAfJB70cz1QwbMoWNqbNuvrFuSJNPdu8iNRJ9p95TJv4YTnO1rS820A==”

调用登陆流程，t传入 checkAndPost(t)，后调用 postLogin®

checkAndPost()这个是就是添加了 goto和loginScene 字段

1. goto:“https%3A%2F%2Fauthweb.alipay.com%2Fmobile%2Fauth%3Fv%3Dh5%26auth_type%3DAUTHACCOUNT%26biz_type%3Dopenservice%26sign%3DAIuHm3Q7BaDWv39Hu7udymjfpncLygKpen%252FNcZVABL8%253D%26pid%3D2088821693967553%26target_id%3Dcom.huawei.health%26app_name%3Dmc%26apiname%3Dcom.alipay.account.auth%26msp_type%3Dsdk-and-lite%26product_id%3DAPP_FAST_LOGIN%26scope%3Dkuaijie%26app_id%3D2017111309907804%26timestamp%3D1617153466948”

2. loginScene:“mobile_oauth”

3. logonId:“1111111”

4. password:“fhRKPmXU+rHGvFrtreEXMGwTa0+D5WHka+6ZzLiK6Q0qLwl4JpxlnMMDL0k5+2ZGokxsXWZLpnsHklfICBWa+7Cw9iuKvxyxveKlKdZnkTsPqFkxOGvMHZcarBP79Wk/1HjTvd9zY+xa8WugbsQ/3OcOuVYjtc/U+jzOsb6MHTWMXk1ouxXc7TUUQdgdIR3cb5OPlNhlmZslLSqRKSFJ+f4icBcSZcJvyNXbXfyQqDnOC0ulii0TIdy6d+zGzTHjNvU9R7Crfd6E8gn6equ7Et0HSmTQnolJAfJB70cz1QwbMoWNqbNuvrFuSJNPdu8iNRJ9p95TJv4YTnO1rS820A==”

这个是网页发包数据，和分析的加密密码一样

_json_token 是上次返回的的

接下来就是json_ua 的解密了

继续分析 post

e=“/login/h5Login.json”

n={logonId: “1111111”, password: “XMLIW+DDThiaK6sCxPIyafugdPHk+3aikQjZQXRgh7LmAGpGOA…NYCwhjtBebAtXo/WemiYca9RGZwG7J5NYm8vBtTwhC8AgjA==”, goto: “https%3A%2F%2Fauthweb.alipay.com%2Fmobile%2Fauth%3…id%3D2017111309907804%26timestamp%3D1617153466948”, loginScene: “mobile_oauth”}

运行完 _buildOpts 得到 i  就是请求数据

这是还是没有 json_ua 数据

json_ua 数据赋值  是json_ua对象得来的，再进行C 来url编码   var C = encodeURIComponent;