Akamai-1.75 version-_ Abck parameter generation JS reverse analysis

Preface

This article only analyzes js Parameters of the part , Risk control cracking is not included ..
I mean Akamai This thing , Almost everyone in the circle knows , Its value is also very attractive , But in terms of difficulty, the basic ceiling level , Risk control is really disgusting , Recently, I have been watching Akamai Things that are , Only on js In terms of strength ,1.75 Of Akamai It's really disappointing , The difficulty lies between the difficulty of ape man learning and the medium difficulty ,
This victim ( Understand everything )：

aHR0cHM6Ly93d3cuZGhsLmNvbS8=

---

One 、 Caught analysis

Because of the popularity , It is not necessary to analyze that parameter here , Direct search _abck, Then the ultimate goal is to obtain logistics information
By viewing the request , Find out _abck adopt set-cookie obtain , Find such a paragraph directly js, And this interface get Encrypted when requested js,post When requested, obtain abck

Let's start the reverse , The first way of thinking ： Get by supplementing the environment cookie, The second way of thinking ： Direct deduction algorithm , I choose oral arithmetic here .
Old rules , First ast To solve the confusion , But the confusion is light , In addition to a ob There is no confusion beyond array decryption , The preliminary results are as follows （）

Sort out the logic ,cookie Well , Definitely with document It matters , You can directly hook once cookie Set up , Then there is the overall situation cookie Where are the words , What's the role .
First look at js structure , Defined a bmak object , It declares a large number of properties and methods , Methods include operations , Detection environment, etc , Next if Within the statement is the whole process , Finally through bmak Medium bpd Method to generate sensor_data( I can't see it here bpd, Because I've reduced a lot of code to one line , Convenient screenshot , Look at the slider below to see how long it is )


Put... Directly bpd Get it down , And then what's missing makes up for what's missing , I was lazy when it was difficult , Copy the results directly to the browser , Finally it is concluded that sersor_data, It includes many environments , It should be noted that the operation needs the last time abck To get the final result

Two 、 Process implementation

First visit the home page to get the initial abck, then xpath Get that js The specific address of , Because the address seems to change every day , And then through post Submit parameters , Get this js Interface return cookie, Use this again cookie To access the final interface , Just like this. ：

---

summary

The data is obtained , But it is still unstable , That is to say, hang up for a period of time every other period of time , Intermittent success , Whether you get up or not ,ja3 Some of them are not available for the time being , After all, concurrency also requires a lot of fingerprints , It's not just ja3 A need to , So to sum up , Only on js part , That is to have hands