292 lines
10 KiB
JavaScript
292 lines
10 KiB
JavaScript
/**
|
||
* 加密算法识别器
|
||
* 根据密文特征自动识别可能的加密算法
|
||
*
|
||
* 使用方式:
|
||
* node crypto-identifier.js "e10adc3949ba59abbe56e057f20f883e"
|
||
* node crypto-identifier.js --file=captured_params.json
|
||
*/
|
||
|
||
const PATTERNS = [
|
||
{
|
||
name: 'MD5',
|
||
regex: /^[0-9a-f]{32}$/i,
|
||
description: '32位十六进制字符串',
|
||
length: 32,
|
||
charset: 'hex',
|
||
verify: '对比标准 MD5 输出。如果不一致，可能是自定义 MD5（如 chrsz=16）',
|
||
},
|
||
{
|
||
name: 'MD5 (大写)',
|
||
regex: /^[0-9A-F]{32}$/,
|
||
description: '32位大写十六进制',
|
||
length: 32,
|
||
charset: 'HEX',
|
||
},
|
||
{
|
||
name: 'SHA-1',
|
||
regex: /^[0-9a-f]{40}$/i,
|
||
description: '40位十六进制字符串',
|
||
length: 40,
|
||
charset: 'hex',
|
||
},
|
||
{
|
||
name: 'SHA-256',
|
||
regex: /^[0-9a-f]{64}$/i,
|
||
description: '64位十六进制字符串',
|
||
length: 64,
|
||
charset: 'hex',
|
||
},
|
||
{
|
||
name: 'SHA-512',
|
||
regex: /^[0-9a-f]{128}$/i,
|
||
description: '128位十六进制字符串',
|
||
length: 128,
|
||
charset: 'hex',
|
||
},
|
||
{
|
||
name: 'Base64',
|
||
regex: /^[A-Za-z0-9+/]+=*$/,
|
||
description: '标准 Base64 编码',
|
||
charset: 'base64',
|
||
verify: '尝试 atob() 解码，检查结果是否有意义',
|
||
},
|
||
{
|
||
name: 'Base64url',
|
||
regex: /^[A-Za-z0-9_-]+$/,
|
||
description: 'URL安全 Base64 编码（无填充）',
|
||
charset: 'base64url',
|
||
verify: '替换 -_ 为 +/ 后尝试解码',
|
||
},
|
||
{
|
||
name: 'AES-CBC/ECB (Base64)',
|
||
regex: /^[A-Za-z0-9+/]+=*$/,
|
||
test: (s) => {
|
||
const raw = Buffer.from(s, 'base64');
|
||
return raw.length > 0 && raw.length % 16 === 0;
|
||
},
|
||
description: 'Base64 编码，解码后长度为 16 的倍数',
|
||
verify: '需要找到 key (16/24/32字节) 和 iv (16字节，CBC模式)',
|
||
},
|
||
{
|
||
name: 'AES-CBC/ECB (Hex)',
|
||
regex: /^[0-9a-f]+$/i,
|
||
test: (s) => s.length >= 32 && s.length % 32 === 0,
|
||
description: '十六进制编码，长度为 32 的倍数',
|
||
verify: '需要找到 key 和 iv',
|
||
},
|
||
{
|
||
name: 'DES-ECB/CBC (Base64)',
|
||
regex: /^[A-Za-z0-9+/]+=*$/,
|
||
test: (s) => {
|
||
const raw = Buffer.from(s, 'base64');
|
||
return raw.length > 0 && raw.length % 8 === 0 && raw.length % 16 !== 0;
|
||
},
|
||
description: 'Base64 编码，解码后长度为 8 的倍数但不是 16 的倍数',
|
||
verify: '需要找到 8 字节 key',
|
||
},
|
||
{
|
||
name: 'RSA (Base64)',
|
||
regex: /^[A-Za-z0-9+/]+=*$/,
|
||
test: (s) => {
|
||
const raw = Buffer.from(s, 'base64');
|
||
return raw.length >= 64;
|
||
},
|
||
description: '较长的 Base64 字符串（64字节以上）',
|
||
verify: '需要找到公钥/私钥',
|
||
},
|
||
{
|
||
name: 'RSA (Hex)',
|
||
regex: /^[0-9a-f]+$/i,
|
||
test: (s) => s.length >= 128,
|
||
description: '较长的十六进制字符串',
|
||
verify: '搜索 RSA、publicKey、modulus 关键词',
|
||
},
|
||
{
|
||
name: 'HMAC-SHA256',
|
||
regex: /^[0-9a-f]{64}$/i,
|
||
description: '64位十六进制（与 SHA-256 相同格式）',
|
||
verify: '搜索 HMAC、createHmac、HmacSHA256 关键词',
|
||
},
|
||
{
|
||
name: 'UUID',
|
||
regex: /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,
|
||
description: 'UUID 格式',
|
||
},
|
||
{
|
||
name: '时间戳 (秒)',
|
||
regex: /^1[0-9]{9}$/,
|
||
description: '10位数字，Unix 时间戳（秒）',
|
||
},
|
||
{
|
||
name: '时间戳 (毫秒)',
|
||
regex: /^1[0-9]{12}$/,
|
||
description: '13位数字，Unix 时间戳（毫秒）',
|
||
},
|
||
{
|
||
name: 'JWT',
|
||
regex: /^eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
|
||
description: 'JSON Web Token（三段 Base64url）',
|
||
verify: '分别解码三段：Header.Payload.Signature',
|
||
},
|
||
{
|
||
name: '十六进制编码字符串',
|
||
regex: /^([0-9a-f]{2})+$/i,
|
||
test: (s) => s.length > 10 && s.length % 2 === 0,
|
||
description: '连续十六进制对',
|
||
verify: '尝试 Buffer.from(str, "hex").toString()',
|
||
},
|
||
];
|
||
|
||
function identify(ciphertext) {
|
||
const results = [];
|
||
const trimmed = ciphertext.trim();
|
||
|
||
for (const pattern of PATTERNS) {
|
||
if (pattern.regex.test(trimmed)) {
|
||
if (pattern.test && !pattern.test(trimmed)) continue;
|
||
if (pattern.length && trimmed.length !== pattern.length) continue;
|
||
|
||
results.push({
|
||
algorithm: pattern.name,
|
||
confidence: calculateConfidence(trimmed, pattern),
|
||
description: pattern.description,
|
||
verify: pattern.verify || '',
|
||
});
|
||
}
|
||
}
|
||
|
||
results.sort((a, b) => b.confidence - a.confidence);
|
||
return results;
|
||
}
|
||
|
||
function calculateConfidence(text, pattern) {
|
||
let score = 50;
|
||
|
||
if (pattern.length && text.length === pattern.length) score += 30;
|
||
if (pattern.charset === 'hex' && /^[0-9a-f]+$/i.test(text)) score += 10;
|
||
if (pattern.charset === 'base64' && text.endsWith('=')) score += 10;
|
||
if (pattern.test && pattern.test(text)) score += 20;
|
||
|
||
return Math.min(score, 95);
|
||
}
|
||
|
||
function analyzeMultiple(samples) {
|
||
const allResults = samples.map(s => ({ sample: s, matches: identify(s) }));
|
||
|
||
const lengthSet = new Set(samples.map(s => s.length));
|
||
const charsetConsistent = samples.every(s => /^[0-9a-f]+$/i.test(s)) ||
|
||
samples.every(s => /^[A-Za-z0-9+/]+=*$/.test(s));
|
||
|
||
const analysis = {
|
||
sampleCount: samples.length,
|
||
lengths: [...lengthSet],
|
||
fixedLength: lengthSet.size === 1,
|
||
charsetConsistent,
|
||
results: allResults,
|
||
};
|
||
|
||
if (analysis.fixedLength && analysis.charsetConsistent) {
|
||
analysis.recommendation = '所有样本长度相同且字符集一致，很可能是同一算法的不同输出';
|
||
} else if (!analysis.fixedLength) {
|
||
analysis.recommendation = '样本长度不一致，可能涉及变长输入或不同算法';
|
||
}
|
||
|
||
return analysis;
|
||
}
|
||
|
||
function formatReport(ciphertext) {
|
||
const results = identify(ciphertext);
|
||
|
||
let report = '';
|
||
report += `\n🔍 密文分析报告\n`;
|
||
report += `${'━'.repeat(50)}\n`;
|
||
report += `输入: ${ciphertext.substring(0, 80)}${ciphertext.length > 80 ? '...' : ''}\n`;
|
||
report += `长度: ${ciphertext.length}\n`;
|
||
report += `字符集: ${detectCharset(ciphertext)}\n`;
|
||
report += `${'━'.repeat(50)}\n`;
|
||
|
||
if (results.length === 0) {
|
||
report += `\n❌ 未识别到已知的加密模式\n`;
|
||
report += `建议：搜索 JS 源码中的加密函数名\n`;
|
||
} else {
|
||
report += `\n可能的算法（按可信度排序）:\n\n`;
|
||
results.forEach((r, i) => {
|
||
report += ` ${i + 1}. ${r.algorithm} (${r.confidence}%)\n`;
|
||
report += ` 描述: ${r.description}\n`;
|
||
if (r.verify) report += ` 验证: ${r.verify}\n`;
|
||
report += `\n`;
|
||
});
|
||
}
|
||
|
||
// Base64 解码尝试
|
||
if (/^[A-Za-z0-9+/]+=*$/.test(ciphertext)) {
|
||
try {
|
||
const decoded = Buffer.from(ciphertext, 'base64');
|
||
report += `📦 Base64 解码结果:\n`;
|
||
report += ` 二进制长度: ${decoded.length} 字节\n`;
|
||
if (decoded.length % 16 === 0) report += ` ⚠ 长度是 16 的倍数（可能是 AES）\n`;
|
||
if (decoded.length % 8 === 0) report += ` ⚠ 长度是 8 的倍数（可能是 DES）\n`;
|
||
const textAttempt = decoded.toString('utf-8');
|
||
if (/^[\x20-\x7e]+$/.test(textAttempt)) {
|
||
report += ` 文本: ${textAttempt.substring(0, 100)}\n`;
|
||
} else {
|
||
report += ` 十六进制: ${decoded.toString('hex').substring(0, 100)}\n`;
|
||
}
|
||
} catch (e) {}
|
||
}
|
||
|
||
return report;
|
||
}
|
||
|
||
function detectCharset(str) {
|
||
if (/^[0-9]+$/.test(str)) return '纯数字';
|
||
if (/^[0-9a-f]+$/i.test(str)) return '十六进制';
|
||
if (/^[A-Za-z0-9+/]+=*$/.test(str)) return 'Base64';
|
||
if (/^[A-Za-z0-9_-]+$/.test(str)) return 'Base64url / 字母数字';
|
||
if (/^[\x20-\x7e]+$/.test(str)) return '可打印ASCII';
|
||
return '混合/二进制';
|
||
}
|
||
|
||
// CLI
|
||
if (require.main === module) {
|
||
const args = process.argv.slice(2);
|
||
|
||
if (args.length === 0) {
|
||
console.log('用法:');
|
||
console.log(' node crypto-identifier.js "<密文>"');
|
||
console.log(' node crypto-identifier.js --file=params.json');
|
||
console.log(' node crypto-identifier.js --compare "<样本1>" "<样本2>" ...');
|
||
process.exit(0);
|
||
}
|
||
|
||
if (args[0] === '--compare') {
|
||
const samples = args.slice(1);
|
||
const analysis = analyzeMultiple(samples);
|
||
console.log('\n📊 多样本对比分析');
|
||
console.log('━'.repeat(50));
|
||
console.log(`样本数量: ${analysis.sampleCount}`);
|
||
console.log(`长度分布: ${analysis.lengths.join(', ')}`);
|
||
console.log(`固定长度: ${analysis.fixedLength ? '是' : '否'}`);
|
||
console.log(`字符集一致: ${analysis.charsetConsistent ? '是' : '否'}`);
|
||
if (analysis.recommendation) console.log(`\n💡 ${analysis.recommendation}`);
|
||
analysis.results.forEach((r, i) => {
|
||
console.log(`\n--- 样本 ${i + 1}: ${r.sample.substring(0, 40)}... ---`);
|
||
r.matches.slice(0, 3).forEach(m => {
|
||
console.log(` ${m.algorithm} (${m.confidence}%)`);
|
||
});
|
||
});
|
||
} else if (args[0].startsWith('--file=')) {
|
||
const fs = require('fs');
|
||
const data = JSON.parse(fs.readFileSync(args[0].substring(7), 'utf-8'));
|
||
const samples = Array.isArray(data) ? data : Object.values(data);
|
||
samples.forEach((s, i) => {
|
||
console.log(formatReport(String(s)));
|
||
});
|
||
} else {
|
||
console.log(formatReport(args[0]));
|
||
}
|
||
}
|
||
|
||
module.exports = { identify, analyzeMultiple, formatReport };
|