# 前端攻防

***

## 免责声明

`本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.`

***

## 前端加解密

**相关文章**

* [浅析前端加密后数据包的修改方法](https://www.freebuf.com/articles/web/223011.html)
* [浅谈web安全之前端加密](https://mp.weixin.qq.com/s/W1Jbrj6Jtg-J3-AX4eO-Eg)
* [当爆破遇到JS加密](https://www.freebuf.com/articles/web/261459.html)

**相关案例**

* [H5页面漏洞挖掘之路-加密篇](https://mp.weixin.qq.com/s/QRxMQFgAPlJsUwuw8Sv0JQ)
* [挖洞小技巧--JS简单逆向](https://zone.huoxian.cn/d/722-js)
* [技术讨论 | 如何对经前端加密后的数据进行爆破](https://www.freebuf.com/articles/web/184455.html)
* [对某webvpn系统加解密分析](https://xz.aliyun.com/t/11007)
* [WEB非实用之JS断点调试教学](https://www.yuque.com/pmiaowu/bomi9w/tdy4pp)
* [加解密传输通杀方案之JSRPC](https://www.svenbeast.com/post/kn2fEdp4Q/)
* [前端攻防几个小案例](https://r0fus0d.blog.ffffffff0x.com/post/js-case/)
* [前端攻防案例续集](https://r0fus0d.blog.ffffffff0x.com/post/js-case2/)

**相关工具**

* [Ebryx/AES-Killer](https://github.com/Ebryx/AES-Killer) - 可即时解密移动应用程序的 AES 加密流量的 Burp 插件
* [c0ny1/jsEncrypter](https://github.com/c0ny1/jsEncrypter) - 一个用于前端加密 Fuzz 的 Burp Suite 插件
* [yaunsky/passToJs](https://github.com/yaunsky/passToJs) - 爆破 js 加密的后台登陆；JS 加密；爆破密码
*   [jxhczhl/JsRpc](https://github.com/jxhczhl/JsRpc) - jsrpc, 在浏览器开启一个 ws 和服务连接，以请求 http 接口的形式来和浏览器通信,浏览器端收到调用通信执行原先设置好的 js 代码并获得返回值。

    ```bash
    # m1 下如果编译出错,使用以下命令
    go get -u golang.org/x/sys
    ```

**常见加密库**

* https://github.com/emn178/js-md5
* https://github.com/travist/jsencrypt
* https://github.com/kjur/jsrsasign
* https://www.npmjs.com/package/crypto-js

**无限 Debug 解决方法**

* [JavaScript 逆向过程中无限 Debug 的绕过方案](https://developer.51cto.com/article/707354.html)

***

## JS 混淆

* JS 混淆

***

## sourcemap 还原

**什么是 sourceMap**

* [【webpack】你所不知道的sourceMap](https://juejin.cn/post/6844903971648372743)

**相关文章**

* [如何还原前端代码](https://mp.weixin.qq.com/s/ccW8I6ZHBaVWN5ZlDC1ucA)
* [利用SourceMap还原前端代码](https://mp.weixin.qq.com/s/LRRycBY9ERIMBEh-MKjBCw)

**相关工具**

*   [restore-source-tree](https://www.npmjs.com/package/restore-source-tree) - Restores file structure from source map (only Webpack source map files supported)

    ```bash
    npm i -g restore-source-tree
    restore-source-tree --out-dir <OUT_DIR> <FILE>
    ```
*   [paazmaya/shuji](https://github.com/paazmaya/shuji) - Reverse engineering JavaScript and CSS sources from sourcemaps

    ```bash
    npm install --global shuji
    shuji file.js.map -o folder
    ```
*   [reverse-sourcemap](https://www.npmjs.com/package/reverse-sourcemap) - Reverse engineering JavaScript and CSS sources from sourcemaps

    ```bash
    npm install --global reverse-sourcemap
    reverse-sourcemap -v xxx.js.map -o output
    ```
* [denandz/sourcemapper](https://github.com/denandz/sourcemapper) - Extract JavaScript source trees from Sourcemap files

***

## 验证码对抗

**相关文章**

* [谷歌验证码 ReCAPTCHA 的模拟点击破解方案来了！](https://mp.weixin.qq.com/s/vRkG_5s01tiDoMErp71QZw)
