<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd"> | |
<html locale="true" xhtml="http://www.w3.org/1999/xhtml"> | |
<head> | |
<!-- ç¨äºçº¯ååºä¸çpcç»éé¡µé¢ --> | |
<title> | |
上网认证 | ePortal | |
</title> | |
<meta http-equiv="pragma" content="no-cache"> | |
<meta http-equiv="cache-control" content="no-cache"> | |
<meta http-equiv="expires" content="0"> | |
<meta http-equiv="keywords" content="keyword1,keyword2,keyword3"> | |
<meta http-equiv="description" content="This is my page"> | |
<script type="text/javascript">window.history.forward();</script> | |
<link rel="stylesheet" href="./css/login2.css" type="text/css" /> | |
<script language="Javascript"> | |
/** | |
* æ¾ç¤ºé误信æ¯çæ¹æ³ | |
*/ | |
function showErrorMessage() { | |
var errorMessageTr = document.getElementById("errorMessageTr"); | |
var errorMessageTd = document.getElementById("errorMessageTd"); | |
if(false) { | |
errorMessageTr.style.display = 'block'; //æ¾ç¤ºé误信æ¯æ | |
errorMessageTd.innerHTML = '<strong></strong>'; | |
} | |
} | |
</script> | |
</head> | |
<!-- 纯准出下的pc登陆页面 --> | |
<style type="text/css"> | |
body { | |
background-color: #eef0ef; | |
} | |
/*错误信息提示表格的css样式*/ | |
.errorMessageTable{width: 80%;} | |
/*错误提示信息所在的行的css样式*/ | |
.errorMessageTr{height: 30px;} | |
/*错误提示信息的css样式*/ | |
.errorMessageTd{font-size: 16px;color: red;} | |
/**/ | |
.errorImage{height: 35;} | |
/*用户名、密码等表头的css样式*/ | |
.SLoginFont1{color: #002F6B;font-size: 18px;} | |
/*用户名、密码、校验码输入框*/ | |
.SLoginInput{ | |
color: #666666; | |
border: 1px solid #B7B6B6; | |
margin-bottom: 6px; | |
font-family: Verdana, Arial, Helvetica, sans-serif; | |
font-size: 14px; | |
background-color: #FFFFFF; | |
padding-top: 3px; | |
height: 25px; | |
padding-bottom: 3px; | |
} | |
/*验证码图片的css样式*/ | |
.validcodeImg{vertical-align:middle;height: 21;} | |
/*登陆按钮的样式*/ | |
.loginButton{color: #002F6B;font-size: 18px;width:100px;} | |
/*公告提示信息所在的table的css样式*/ | |
.noticeTable{width: 100%;} | |
/*点击登录时的登录信息提示栏的css样式*/ | |
.notice_panel_head{text-align: center;background: #BFEBAA;} | |
/*系统通知所在的table的css样式*/ | |
.sysNoticeTable{width: 100%;} | |
/*系统通知的头部的css样式*/ | |
.sysNoticeTitle{color: #EC5600;font-family: '幼圆';font-size: 18px;text-align: left;} | |
/*系统通知的内容所在的行的css样式*/ | |
.sysNoticeContentTd{text-align: left;} | |
/*系统通知的内容的css样式*/ | |
.sysNoticeContent{font-size: 14px;} | |
/*系统通知上方的hr横线的css样式*/ | |
.sysNoticeHr{width: 100%;} | |
/*公告栏所在的table的css样式*/ | |
.publishTable{width: 100%;} | |
/*公告标题的css样式*/ | |
.publishTitle{FONT-FAMILY: '幼圆'; COLOR: #ec5600; FONT-SIZE: 18px;text-align: left;} | |
/*公告内容的css样式*/ | |
.publishContext{text-align: left;} | |
/*公告栏上方的hr横线的css样式*/ | |
.publishHr{width: 100%;} | |
</style> | |
<body oncontextmenu="return false;" onload="loginForm.username.focus();showErrorMessage();"> | |
<center> | |
<table width="800" border="0" cellpadding="0" cellspacing="0" background="images/mobile/bj.jpg"> | |
<tr> | |
<td height="458"> | |
<table width="800" border="0" cellpadding="0" cellspacing="0"> | |
<tr> | |
<td width="323" height="116"> | |
<br> | |
</td> | |
<td width="477"> | |
<table width="90%"> | |
<tr> | |
<td align="center"> | |
<table> | |
<tr> | |
<td> | |
<strong style="color: #EC5600;font-family: '幼圆';font-size: 25px;"> | |
</strong> | |
</td> | |
</tr> | |
</table> | |
</td> | |
</tr> | |
<tr> | |
<td> | |
| |
</td> | |
</tr> | |
<tr> | |
<td> | |
<!-- 用户登陆信息控件 --> | |
<html> | |
<head> | |
<title>纯准出时用于Pc的用户登陆信息组件</title> | |
<script language="javascript" src="./js/jquery-1.3.1.js" | |
type="text/javascript"></script> | |
<script type="text/javascript"> | |
function killErrors() { | |
return true; | |
} | |
window.onerror = killErrors; | |
var formName = 'loginForm'; | |
function $F(name){ | |
var form = document.getElementById(formName); //表单对象 | |
var input = form[name]; //获取表单中指定名称的标签的值 | |
return input.value; | |
} | |
function $FE(name){ | |
var form = document.getElementById(formName); | |
var input = form[name]; | |
return input; | |
} | |
//错误图标 | |
var CONS_IMG_ERROR="<img src=\"./images/cc_error.gif\" align=\"absmiddle\">"; | |
//正确图标 | |
var CONS_IMG_RIGHT="<img src=\"./images/cc_right.gif\">"; | |
/** | |
* 验证移动方案用户认证表单的方法 | |
* @returns {Boolean} | |
* 表单合格返回true | |
* 否则返回false | |
*/ | |
function checkForm(){ | |
var myUser = document.getElementById("myUser"); | |
var myPassword = document.getElementById("myPassword"); | |
var errorMessageTr = document.getElementById("errorMessageTr"); | |
errorMessageTr.style.display = 'none'; //隐藏错误信息提示栏 | |
var flag1 = false; //错误标记 | |
var flag2 = false; | |
var flag3 = false; | |
if ($F('username').replace(/(^\s*)|(\s*$)/g, "") == '') { //去左右空格 | |
myUser.innerHTML = CONS_IMG_ERROR+'<span style="color:red;">请填写用户名</span>'; | |
$FE('username').select(); | |
flag1 = true; | |
}else { | |
myUser.innerHTML = CONS_IMG_RIGHT; | |
document.getElementById("usernameHidden").value=encodeURIComponent(document.getElementById("username").value); | |
} | |
if ($F('pwd') == '') { | |
myPassword.innerHTML = CONS_IMG_ERROR+'<span style="color:red;">请填写密码</span>'; | |
$FE('pwd').select(); | |
flag2 = true; | |
}else { | |
myPassword.innerHTML = CONS_IMG_RIGHT; | |
} | |
if('false'=='true'){ | |
var myValidcode = document.getElementById("myValidcode"); | |
if ($F('validcode').replace(/(^\s*)|(\s*$)/g, "") == '') { //去左右空格 | |
myValidcode.innerHTML = CONS_IMG_ERROR+'<span style="color:red;">请填写验证码</span>'; | |
$FE('validcode').select(); | |
flag3 = true; | |
}else { | |
myValidcode.innerHTML = CONS_IMG_RIGHT; | |
} | |
} | |
if(flag1 == false && flag2 == false && flag3 == false) { | |
return true; | |
}else { | |
return false; | |
} | |
} | |
/** | |
* 提交表单 | |
*/ | |
function doauthen_pure_internet(){ | |
if(checkForm()==true){ | |
openAuthingWindow(); | |
document.getElementById('loginForm').submit(); | |
} | |
} | |
/** | |
* 显示认证提示栏 | |
*/ | |
function openAuthingWindow(){ | |
jQuery('#authing_wait').show(); | |
} | |
/** | |
* 刷新验证码图片的方法 | |
*/ | |
function freshImage(){ | |
if(self==top){ | |
jQuery('#validImage').attr('src',"./validcode?rnd="+Math.random()); | |
}else{ | |
alert('禁止在框架内的页面认证'); | |
top.location.href=self.location.href; | |
} | |
} | |
/** | |
* 登陆页面加载时自动获取一张验证码图片 | |
*/ | |
jQuery(document).ready(function(){ | |
if (self==top){ | |
//jQuery("#forceSwitchAddUser").attr("src",forceUrl+Math.random()); //会使login_foot.jsp页面的<img id="forceSwitchAddUser"标签自动请求一次后台 | |
jQuery("#validImage").attr("src","./validcode?rnd="+Math.random()); | |
} | |
}); | |
/** | |
* 只允许输入数字 | |
* @param t | |
*/ | |
function inputNum(t){ | |
t.value = t.value.replace(/[^\d]/g,""); | |
} | |
var request = false; | |
function createRequest(){ | |
request=createHttpAjaxRequest(); | |
} | |
function createHttpAjaxRequest(){ | |
var httpRequestAjax; | |
try { | |
httpRequestAjax = new XMLHttpRequest(); | |
if (httpRequestAjax.overrideMimeType) {//设置MiME类别 | |
httpRequestAjax.overrideMimeType('text/xml'); | |
} | |
return httpRequestAjax; | |
}catch(e){ | |
} | |
var versions = ['Microsoft.XMLHTTP', 'MSXML.XMLHTTP', 'Microsoft.XMLHTTP', 'Msxml2.XMLHTTP.7.0', 'Msxml2.XMLHTTP.6.0', 'Msxml2.XMLHTTP.5.0', 'Msxml2.XMLHTTP.4.0', 'MSXML2.XMLHTTP.3.0', 'MSXML2.XMLHTTP']; | |
for(var i=0; i<versions.length; i++) { | |
try { | |
httpRequestAjax = new ActiveXObject(versions[i]); | |
return httpRequestAjax; | |
} catch(e){ | |
} | |
} | |
throw { | |
name: 'GetRequestObject', | |
message: 'XMLHttpRequest is not available, xajax is disabled' | |
} | |
} | |
/** | |
* 清除保存的用户登陆信息 | |
*/ | |
function clearLoginInfo(){ | |
delCookie("EPORTAL_COOKIE_USERNAME"); | |
delCookie("EPORTAL_COOKIE_PASSWORD"); | |
var saveUserInfo = document.getElementById("saveUserInfo"); | |
saveUserInfo.innerHTML = '<input type="checkbox" name="is_check" id="is_check" value="true" />保存登录信息(两周) '; | |
} | |
// IE、遨游、Opera、Safari、Chrome 兼容回车事件 | |
document.onkeydown = function() { | |
if (window.event.keyCode == 13) { | |
document.getElementById("loginButton").click(); | |
} | |
}; | |
//Firefox 兼容回车事件 | |
if (document.addEventListener) { | |
document.addEventListener("keypress", fireFoxHandler, true); | |
} | |
function fireFoxHandler(event) { | |
if (event.keyCode == 13) { | |
//doauthen_pure_internet(); | |
var evt = document.createEvent("MouseEvents"); | |
evt.initEvent("click",true,true); | |
document.getElementById("loginButton").dispatchEvent(evt); //触发登陆按钮的点击事件 | |
} | |
} | |
var authModeflag=""; | |
/** | |
* 清除保存的用户登陆信息 | |
*/ | |
function clearLoginInfo(){ | |
try{ | |
delCookie("EPORTAL_COOKIE_USERNAME"); | |
delCookie("EPORTAL_COOKIE_PASSWORD"); | |
createRequest(); | |
var url = "./user.do?method=deleteCookie&rnd="+Math.random(); | |
request.open("GET", url, true); | |
var funcName; | |
request.onreadystatechange = loadCurpage; | |
request.send(null); | |
} catch(e){ | |
if(authModeflag=='web'){ | |
var redirectUrl = document.getElementById('redirectUrl').value; | |
window.location.href= redirectUrl+"&redirectFlag="+authModeflag; | |
}else{ | |
window.location.reload(); | |
} | |
} | |
} | |
function loadCurpage(){ | |
if(request.readyState==4){ | |
if (request.status == 200) { | |
if(authModeflag=='web'){ | |
var redirectUrl = document.getElementById('redirectUrl').value; | |
window.location.href= redirectUrl+"&redirectFlag="+authModeflag; | |
}else{ | |
window.location.reload(); | |
} | |
} | |
} | |
} | |
function getCookie(name){ | |
var arr = document.cookie.match(new RegExp("(^| )"+name+"=([^;]*)(;|$)")); | |
if(arr != null) return unescape(arr[2]); return null; | |
} | |
function delCookie(name){ | |
var exp = new Date(); | |
exp.setTime(exp.getTime() - 1); | |
var cval=getCookie(name); | |
if(cval!=null) | |
document.cookie= name + "=;expires="+exp.toGMTString();//ie8此不起作用 | |
} | |
</script> | |
</head> | |
<body> | |
<form name="loginForm" id="loginForm" method="post" action="webgateuser.do?method=login_ajax_pure_internet"> | |
<input type="hidden" name="s" id="s" value='1a0a4585a5a79636eac40552adcce384' /> | |
<input type="hidden" name="userIp" id="userIp" value='172.27.33.12' /> | |
<input type="hidden" name="url" id="url" value='http://www.baidu.com/' /> | |
<input type="hidden" name="t" id="t" value='ace' /> | |
<input type="hidden" name="ip" id="t" value='238fc550267156614b948c1bfcf62031' /> | |
<input type="hidden" name="dst_url" id="dst_url" value='0b9e64ac68b3a501b3e80cc709e62948d4c2e9db624afc4a' /> | |
<input type="hidden" name="authType" id="authType" value='web' /> | |
<table class="errorMessageTable" > | |
<tr id="errorMessageTr" class="errorMessageTr" align="center" style="display: none;"> | |
<td id="errorMessageTd" class="errorMessageTd" > | |
</td> | |
</tr> | |
<tr id="authing_wait" class="notice_panel_head" style="display: none;"> | |
<td class="notice_panel_head" > | |
正在认证,请稍候..... | |
</td> | |
</tr> | |
</table> | |
<table class="LoginTable"> | |
<tr id="uName"> | |
<td class="SLoginFont1"> | |
用户名: | |
</td> | |
<td colspan="2" align="left"> | |
<input name="username" id="username" type="text" class="SLoginInput" maxlength="80" size="20" tabindex="1" value="" /> | |
<input name="usernameHidden" id="usernameHidden" type="hidden" value="" /> | |
</td> | |
<td align="left"> | |
<span id="myUser" class="b" ></span> | |
</td> | |
</tr> | |
<tr> | |
<td class="SLoginFont1"> | |
密 码: | |
</td> | |
<td colspan="2" align="left"> | |
<input name="pwd" id="pwd" type="password" class="SLoginInput" maxlength="80" size="20" tabindex="2" value="" /> | |
</td> | |
<td align="left"> | |
<span id="myPassword" class="b"></span> | |
</td> | |
</tr> | |
<!-- 安全域 --> | |
<input name="seczone" id="seczone" type="hidden" value="" /> | |
<!-- validateCode 验证码--> | |
<tr> | |
<td colspan="4"> | |
<input name="validcode" id="validcode" type="hidden" value="no_check" /> | |
</td> | |
</tr> | |
<!-- saveUserInfo Web --> | |
<tr id="web" > | |
<td colspan="4"> | |
<div class="inputItem"> | |
<div class="inputItemValue" > | |
<input type="checkbox" name="is_check" id="is_check" value="true" /> | |
保存登录信息(两周) | |
| |
</div> | |
</div> | |
</td> | |
</tr> | |
<tr> | |
<td class="SLoginFont1"> | |
| |
</td> | |
<td colspan="2" align="left"> | |
<input type="button" id="loginButton" name="loginButton" class="loginButton" onclick="doauthen_pure_internet();" value="访问外网" /> | |
</td> | |
<td align="left"> | |
| |
</td> | |
</tr> | |
</table> | |
</form> | |
<script type="text/javascript"> | |
var authType = document.getElementById('authType').value; | |
if(authType=='web'){ | |
document.getElementById('web').style.display=""; | |
} | |
</script> | |
</body> | |
</html> | |
</td> | |
</tr> | |
</table> | |
</td> | |
</tr> | |
</table> | |
</td> | |
</tr> | |
</table> | |
<table width="800" border="0" cellpadding="0" cellspacing="0"> | |
<tr> | |
<td> | |
<!-- 认证客户端相关控件 --> | |
<html> | |
<head> | |
<title>认证客户端相关组件</title> | |
</head> | |
<body> | |
<table class="noticeTable"> | |
<tr> | |
<td class="noticeContext"> | |
</td> | |
</tr> | |
</table> | |
</body> | |
</html> | |
</td> | |
</tr> | |
<tr> | |
<td> | |
<!-- 公告提示信息控件 --> | |
<html> | |
<head> | |
<title>公告提示信息组件</title> | |
</head> | |
<body> | |
<table class="noticeTable"> | |
<tr> | |
<td class="noticeContext"> | |
</td> | |
</tr> | |
</table> | |
</body> | |
</html> | |
</td> | |
</tr> | |
<tr> | |
<td> | |
<!-- 系统通知 --> | |
<html> | |
<head> | |
<title>系统通知组件</title> | |
</head> | |
<body> | |
<table class="sysNoticeTable" id="sysNoticeTable" style="display:none;" > | |
<tr> | |
<td class="sysNoticeTitle"> | |
<strong> | |
系统通知: | |
</strong> | |
</td> | |
</tr> | |
<tr> | |
<td class="sysNoticeContentTd"> | |
<span class="sysNoticeContent" id="noticeSpan"> </span> | |
</td> | |
</tr> | |
</table> | |
</body> | |
</html> | |
<br> | |
</td> | |
</tr> | |
<tr> | |
<td> | |
<!-- 公告组件 --> | |
<html lang="zh"> | |
<head> | |
<title>公告信息组件</title> | |
</head> | |
<body> | |
<hr class="publishHr"/> | |
<table class="publishTable"> | |
<tr> | |
<td class="publishTitle"> | |
<strong>公告:</strong> | |
</td> | |
</tr> | |
<tr> | |
<td class="publishContext" > | |
<p> | |
</p> | |
<p> | |
<span style="color: #0099cc"><span style="font-size: 14px">各位老师:</span></span></p> | |
<p> | |
<span style="color: #0099cc"><span style="font-size: 14px"> </span></span></p> | |
<pre> | |
<span style="color: #0099cc"><span style="font-size: 14px"> </span><span style="font-size: 14px">此处打马赛克!!!</span><span style="font-size: 14px">。</span></span></pre> | |
</td> | |
</tr> | |
</table> | |
</body> | |
</html> | |
</td> | |
</tr> | |
</table> | |
</center> | |
</body> | |
</html> |
![]() |
1
alexrezit 2014-03-09 12:01:09 +08:00 via iPhone
样本不足.
|
![]() |
2
jakwings 2014-03-09 12:05:08 +08:00
可能是先算出 md5sum 再通过移位法得到的。
|
![]() |
5
Esay 2014-03-09 12:30:53 +08:00
能不能把你获取这段数据(或者你登陆到认证系统)的流程描述一下,比如说:
- 通过客户端,还是网页 - 如果是网页,是不是在 js 里有相关的内容 - 这段信息是你传递给服务器的,还是服务器传给你的 - 是在给地址设定之前还是之后 |
![]() |
8
icedx 2014-03-10 13:20:40 +08:00 via Android
问题不大 回寝室研究
|
![]() |
9
zzNucker 2014-03-10 13:40:24 +08:00
每8位字符对应一个IP段,不对吧,33那个就不一样。
|
![]() |
10
jakwings 2014-03-10 15:09:02 +08:00
原来是想造福更大范围的同学啊,哈……既然是 JSP 页面,你应该先研究一下 Java 的 API 吧,我不懂 Java ,菜鸟。:P
|
![]() |
11
creamiced 2014-03-10 15:20:33 +08:00
那就把通过百度和其他网站跳转的同ip字符串比较下看看有没有跳转网址的信息啊
|
![]() |
12
alexrezit 2014-03-10 15:32:02 +08:00
跳转地址大概是同样的加密方式... 黑盒么...
用大量字符串刷一下吧... 可以判断的是加密后的 16 进制字符串每 16 位为一组, 代表 8 位字符, 不足时会用特定方式补全. 我猜为了方便 IP 地址很可能是以字符串形式加密的. 然后啦继续轰击吧直到能找到明显规律... |
![]() |
13
decken OP @zzNucker 不知道后面的有没有加salt
@alexrezit @creamiced @icedx 下面是一些对应关系,看有没有头绪 https://gist.github.com/9463066 |
![]() |
14
coolzjy 2014-03-10 22:12:16 +08:00
如果是172.27这个网段的话 完全可以写个脚本把 65025(255x255) 个地址遍历一遍,不一定非要知道算法
|
![]() |
17
standin000 2014-03-10 22:32:39 +08:00
用userIp=172.27.33.16试试!
|
![]() |
19
alexapollo 2014-03-10 22:38:02 +08:00
为什么你不把IP放到网址那里去解析一下?
说不定有惊喜 |
![]() |
21
decken OP @standin000 这样会提示"提交的认证信息出错,请重新启动浏览器"
|
![]() |
22
decken OP @alexapollo 如果把IP放到网址去解析,会自动生成www.ruijie.com.cn对应的字符串,认证成功之后会跳转到这个链接.
|
![]() |
23
standin000 2014-03-14 21:48:57 +08:00
@decken 那只能用wireshark去抓包了,看是哪个http请求转换的。
|