dacj4n's

1
sudo pip3 install mitmproxy

1
pip3 install mitmproxy

1
mitmdump --version

1
Mitmproxy: 9.0.1
2
Python:    3.9.2
3
OpenSSL:   OpenSSL 3.0.7 1 Nov 2022
4
Platform:  Windows-10-10.0.22621-SP0

1
from mitmproxy import http
2

3

4
class AutoDecoderClass(object):
5

6
    def request(self, flow: http.HTTPFlow):
7
        pass
8

9
    def response(self, flow: http.HTTPFlow):
10
        pass
11

12

13
addons = [
14
    AutoDecoderClass()
15
]

1
from mitmproxy import http
2
import json
3
from Crypto.Cipher import AES
4
from Crypto.Util.Padding import pad, unpad
5
from pwn import *
6

7
key = b'0ddmas1dfzcaedev'
8

9

10
def encrypt(text, key):
11
    cipher = AES.new(key, AES.MODE_ECB)
12
    padded_text = pad(text.encode('utf-8'), AES.block_size)
13
    encrypted_data = cipher.encrypt(padded_text)
14
    return b64e(encrypted_data).decode('utf-8')
15

16

17
def decrypt(encoded_text, key):
18
    cipher = AES.new(key, AES.MODE_ECB)
19
    encrypted_data = b64e(encoded_text.encode('utf-8'))
20
    decrypted_data = unpad(cipher.decrypt(encrypted_data), AES.block_size)
21
    return decrypted_data.decode('utf-8').encode('utf-8')
22

23

24
class AutoDecoderClass(object):
25

26
    def request(self, flow: http.HTTPFlow):
27

28
        # 如果body中有data字段
29
        if flow.request.method == 'POST' and flow.request.headers['Content-Type'] == 'application/json;charset=utf-8':
30
            # 如果是json格式
31
            if 'data' in json.loads(flow.request.content):
32
                print()
33
            else:
34
                flow.request.content = json.dumps({'data': encrypt(flow.request.content.decode('utf-8'), key)}).encode('utf-8')
35
                print(flow.request.content)
36

37
    def response(self, flow: http.HTTPFlow):
38
        print(flow.request.content)
39
        pass
40

41

42
addons = [
43
    AutoDecoderClass()
44
]

1
环境：
2
JeeSite V5.3.1
3
默认口令：
4
system
5
admin

1
from mitmproxy import http
2
import base64
3

4

5
class AutoDecoderClass(object):
6

7
    def request(self, flow: http.HTTPFlow):
8
        if flow.request.method == 'POST' and flow.request.headers['Content-Type'] == 'application/x-www-form-urlencoded; charset=UTF-8':
9
            # print(flow.request.content)
10
            data = flow.request.content.decode('utf-8').split('&')
11
            for i in range(len(data)):
12
                if data[i].split('=')[0] == 'username':
13
                    data[i] = 'username=' + base64.b64encode(data[i].split('=')[1].encode('utf-8')).decode('utf-8')
14
                if data[i].split('=')[0] == 'password':
15
                    data[i] = 'password=' + base64.b64encode(data[i].split('=')[1].encode('utf-8')).decode('utf-8')
16
            data = '&'.join(data)
17
            print(data)
18
            flow.request.content = data.encode('utf-8')
19

20
        pass
21

22
    def response(self, flow: http.HTTPFlow):
23
        pass
24

25

26
addons = [
27
    AutoDecoderClass()
28
]