某航司 x-s3-s4e cookie分析

你买

1913人浏览 · 2026-03-16 16:48:35

你买 · 2026-03-16 16:48:35 发布

文章目录

免责声明

本文章主要用于技术交流学习,作者不承担任何滥用技术所产生的法律责任。如有侵权，请联系作者删除!

目标cookie

访问: aHR0cHM6Ly93d3cuc2hlbnpoZW5haXIuY29tL3N6YWlyX0IyQy9pbmRleC5odG1s

x-s3-s4e = KvxJYr3FIiTEsGaiT9B20cjQHLlFFZZ65ePJEctMBU3xs8g196pP4raaB7cxVdnGeMf8uXO8AzMQT+CfclObHvF4L1u72dbtZc5cx/hMfO+UTKCeE0ESwMzIv0wy3hCCb6weXeQE7DwysCxg4aD3xp0PmkunzQbsziixCUdPlD0MGvHs6S5FXEW8RVopK0F3VZ9cnFZqEErs6BC3bJxCpj6xpZ2rCDOZWr862+G+PMtfCnvOWmkf/U8ABCgGR6cNq+49L5SC+5eEszCGC2qeWqG6V7TorSaYbWkhsxFPBUS0xtDuo8cMpBSsLyT+xX0CUVylNQk2uocokTdGi5iG6VRltZ/hPhVdmr4UE8CVd+GGidrtUsjJd0IswEG2FQnbyjKxteQHrD75yTtDifr66tZ+RY+7M6Zfs5R6M9/kf4KE+7OOpkmFPltlNXs5ETLs5VFUMt2ef5yAPhqmnA2AN5M3Z6S3Q40xMQpxkxsEXhWJ3/7g66irL6Uv7OwHSVqZT7bovgK4BC/lMKR76KeUKgS5nTQP3dTnjqJ15lhxyEApxkMwShakV6dQcHYRzudr5VFUMt2ef5yAPhqmnA2AN7stXD/vfkPUU/TVwzaWIe/W8fYH5+/N+UMEjxJoPAOQT/0tPFQuGL8xQgRTqEsv885qCWPlBYkrQrKAjfTe6atNzulLJysEj910JiWW42k8MunZRN8dRafN+jPilvv78X3O4k6rsAH8LsDHDhbtGXlyNIBb1bT7RXObr0/Oc8G3u5TkrkbpJFsOq7jBeojfzjx8IhX73rm0GIPEI1E50IYCztkfK/HIB9ybc9OkUE1EWAz2n1A3dfTjTvGvUuDZ/w==3sSsb02d0003171afeb4af3149899edb0c396336f06a:48:22ec0112-17b1-11f1-97d1-005056ae692b:0030002097

x-s3-tid = b02d0003171afeb4af3149899edb0c396336f06a:48:22ec0112-17b1-11f1-97d1-005056ae692b:0030002097
            
x-s3-sid = S18gBAibade5j3441ypkuc33m

x-s3-sid

x-s3-tid

hook分析一下 x-s3-tid 值如何来的

// 进行了混淆
window[s3const[0x19]][s3const[0x5]] = _0x329b56[_0x4c31('0x14a')](
    _0x329b56[_0x4c31('0x14b')](_0x329b56['GkatO'](_0x329b56[_0x4c31('0x14c')](s3const[0x10][_0x4c31('0x50')](0x2) + s3const[0x2]['charAt'](0x8) + s3const[0xc]['charAt'](0x1), s3const[0x6][_0x4c31('0x50')](0x0)), s3const[0x2][_0x4c31('0x50')](0x8)) + s3const[0x2][_0x4c31('0x50')](0x4) + s3const[0x5][_0x4c31('0x50')](0x4) + s3const[0x3][_0x4c31('0x50')](0x0) + s3const[0x2][_0x4c31('0x50')](0x9), _s3_tid)
    +
    _s3[_0x329b56[_0x4c31('0x146')]][0x1b](_0x4525a6[_0x329b56[_0x4c31('0x14d')]]), _s3[_0x4c31('0x12')][0x1c]()
);

// cookie部分代码 x-s3-tid=47b18d0f9a671f57fbe6b16770aa962de038eaab:48:30e56325-17b2-11f1-967b-3cd2e55daed6:08140220c2
_0x329b56[_0x4c31('0x14b')](_0x329b56['GkatO'](_0x329b56[_0x4c31('0x14c')](s3const[0x10][_0x4c31('0x50')](0x2) + s3const[0x2]['charAt'](0x8) + s3const[0xc]['charAt'](0x1), s3const[0x6][_0x4c31('0x50')](0x0)), s3const[0x2][_0x4c31('0x50')](0x8)) + s3const[0x2][_0x4c31('0x50')](0x4) + s3const[0x5][_0x4c31('0x50')](0x4) + s3const[0x3][_0x4c31('0x50')](0x0) + s3const[0x2][_0x4c31('0x50')](0x9), _s3_tid)

_0x329b56[_0x4c31('0x14b')](
    _0x329b56['GkatO'](_0x329b56[_0x4c31('0x14c')](s3const[0x10][_0x4c31('0x50')](0x2) + s3const[0x2]['charAt'](0x8) + s3const[0xc]['charAt'](0x1), s3const[0x6][_0x4c31('0x50')](0x0)), s3const[0x2][_0x4c31('0x50')](0x8))
    +
    s3const[0x2][_0x4c31('0x50')](0x4) 
    + 
    s3const[0x5][_0x4c31('0x50')](0x4) 
    + 
    s3const[0x3][_0x4c31('0x50')](0x0) 
    + 
    s3const[0x2][_0x4c31('0x50')](0x9)
    ,
    _s3_tid
)
// 控制台输出一下 _s3_tid 就是x-s3-tid的值
_0x329b56['GkatO'](_0x329b56[_0x4c31('0x14c')](s3const[0x10][_0x4c31('0x50')](0x2) + s3const[0x2]['charAt'](0x8) + s3const[0xc]['charAt'](0x1), s3const[0x6][_0x4c31('0x50')](0x0)), s3const[0x2][_0x4c31('0x50')](0x8))
'x-s3-'
s3const[0x2][_0x4c31('0x50')](0x4)
't'
 s3const[0x5][_0x4c31('0x50')](0x4)
'i'
 s3const[0x3][_0x4c31('0x50')](0x0)
'd'
 s3const[0x2][_0x4c31('0x50')](0x9)
'='
_s3_tid
'47b18d0f9a671f57fbe6b16770aa962de038eaab:48:30e56325-17b2-11f1-967b-3cd2e55daed6:08140220c2'

分析_s3_tid

// 下断后清除cookie刷新

var _0x37b5cf = _0x17e27f[_0x1eeb('0x6aa')]
    ?
    _0x17e27f[_0x1eeb('0x6aa')](_0x5577ed, _0x4e29e2[_0x1eeb('0x94')][_0x1eeb('0x23')][_0x1eeb('0x36')][_0x1eeb('0x6a9')], _0x17e27f[_0x4904e6[_0x1eeb('0x6ab')]], _0x17e27f['_daSize'], _0x2daaea)
    :
    0x2;

分析 _0x17e27f[‘_tid’] 值的生成

// 跟栈发现

// 搜索 _0x17e27f 发现

// 没有发现值生成的地方 尝试在 bootstrap.js 搜索 _s3_tid

// _s3_tid 值为 
https://www.shenzhenair.com/vodka/v1/bootstrap/param?t=1772777474340 请求返回

// 返回数据
{
    "_a": [
        "6b23a75e6c02c4f880dbee59a8230dd94c17c85a:48:479c7573-1923-11f1-967b-3cd2e55daed6:0030032074",
        "S1x8pXe9bg8Jj3441ypkuc31r",
        "",
        0,
        "/vodka/v1/js/sw.js"
    ],
    "_c": [
        [
            "00aaarasab",
            "00aaagacab01"
        ],
        1000,
        [
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1,
            1
        ],
        {
            "junicode": 1002,
            "nimbus mono": 1001,
            "presto": 1003
        },
        30,
        0,
        200,
        [],
        86400,
        2
    ],
    "_k": [],
    "_r": [
        ""
    ],
    "_t": [
        0,
        0,
        "",
        "",
        0,
        "",
        [
            1,
            1,
            "",
            0,
            0,
            0,
            31,
            0
        ],
        []
    ]
}

x-s3-s4e

// hook cookie 跟一下

"x-s3-s4e=2edDuiIZJ%2BLezQ5gM5JOQRLcyQjT8yCAltx3m723sJS00Q1kg5cFgNh10zl142YCm71YWWicfTeBu7cQ2hzhtlqZrQuF5JJhOCtrNGDZW9hVFdnspRN6wJlUuNM%2F9%2FzXKJZdpjpFHt%2F4bWQuYFY72rzvItbovv08kXJ8jYJ6DSCvmgpp73xCR6QbXLP7c%2Bz5jyZTkGGJBZfbqpqrEn%2BURG2otr14fhnabMEBof2jvTELLgj96XtaCy0FrGnL6kxRTJccFWLGfpP3eJZAaeRUNI15jW98%2BWVxbSi14rsW3gZHfGEDRxRWwsIhjTzFgS8XHj%2F3vLKNDK8oaZ%2FWAPnzo3d2eZz2oZ4WnnEvOcO%2FpdusI3%2BR9MpBl2BiBH885mDcwifJgkZT%2BnfQOz1Nr0DFoipAZ%2F%2F%2F6nWClrFdOm10WDVtUAMCVKcccgPq%2FMGd0%2BT0bYjTImYnengxiK2FVlcES3qQqDCse1orwTT26XyvASZkwgOrU%2BdhAHDcif1AR1fXTtdPqWdKEcF%2BmqL%2BahMh2W1VXz1szfBLEIYUYp%2BA5opOhWPw0NwqJ2GqgW%2BOB86mFVUGH4znjt1TD8OTp0fRzY5eJSJBTYx00Q9E4pyoz8mlU%2B5iDO2eEBhLuyhFo0Qg2fiF0tB8rLWC0g5fhWMd0ruqizi97DxBe8xXjbuut6VyGLdHDmPDxgzepYJZgTS22aYxKs0OUIgACO0jllT42XHPjys5tSFsXNrUUxJzJS8Scp9nLAHhtwjw0BHb5UgQTrz92yk6YQY1ecxx3yZNd4u0wP7%2FoZ1vcXXSkj%2BVfnrFFHRUwWET4L8L%2FF%2F51yJRD2S1PYQttSSBk%2BNewJMSkQ%3D%3D3sSs5ee177fa238d9e2636242ddcfdf3ece7670f64cf:48:03a4179f-1925-11f1-967b-3cd2e55daed6:07800a205d;domain=.shenzhenair.com;path=/;max-age=86400"

window[_ssc[0xd]][_ssc[0x5]] =
    _s3[_0x4c31('0x12')][0xf]()
    +
    (!!_s3[_0x4c31('0x12')][0x5a] ? _s3['_st'][0x5a](window[_0x329b56['YOvGr'](_ssc[0x14] + _ssc[0x13], _ssc[0x12]) + _ssc[0x16]](_0x408575) + _0x4c31('0x39') + _s3_tid, _0xec4b86, _0x1aeb4e, _0x9629df) : _0x329b56[_0x4c31('0x14e')](window[_0x329b56[_0x4c31('0x14e')](_ssc[0x14], _ssc[0x13]) + _ssc[0x12] + _ssc[0x16]](_0x408575) + _0x4c31('0x39'), _s3_tid))
    +
    _s3[_0x329b56['GudUO']][0x1c]()
    +
    _s3[_0x4c31('0x12')][0x1b](_0x4525a6[_0x4c31('0x140')]);


_s3['_st'][0x5a](
    window[_0x329b56['YOvGr'](_ssc[0x14] + _ssc[0x13], _ssc[0x12]) + _ssc[0x16]](_0x408575)
    +
    _0x4c31('0x39')
    + _s3_tid,
    _0xec4b86,
    _0x1aeb4e,
    _0x9629df
)

2edDuiIZJ%2BLezQ5gM5JOQRLcyQjT8yCAltx3m723sJS00Q1kg5cFgNh10zl142YCm71YWWicfTeBu7cQ2hzhtlqZrQuF5JJhOCtrNGDZW9hVFdnspRN6wJlUuNM%2F9%2FzXKJZdpjpFHt%2F4bWQuYFY72rzvItbovv08kXJ8jYJ6DSCvmgpp73xCR6QbXLP7c%2Bz5jyZTkGGJBZfbqpqrEn%2BURG2otr14fhnabMEBof2jvTELLgj96XtaCy0FrGnL6kxRTJccFWLGfpP3eJZAaeRUNI15jW98%2BWVxbSi14rsW3gZHfGEDRxRWwsIhjTzFgS8XHj%2F3vLKNDK8oaZ%2FWAPnzo3d2eZz2oZ4WnnEvOcO%2FpdusI3%2BR9MpBl2BiBH885mDcwifJgkZT%2BnfQOz1Nr0DFoipAZ%2F%2F%2F6nWClrFdOm10WDVtUAMCVKcccgPq%2FMGd0%2BT0bYjTImYnengxiK2FVlcES3qQqDCse1orwTT26XyvASZkwgOrU%2BdhAHDcif1AR1fXTtdPqWdKEcF%2BmqL%2BahMh2W1VXz1szfBLEIYUYp%2BA5opOhWPw0NwqJ2GqgW%2BOB86mFVUGH4znjt1TD8OTp0fRzY5eJSJBTYx00Q9E4pyoz8mlU%2B5iDO2eEBhLuyhFo0Qg2fiF0tB8rLWC0g5fhWMd0ruqizi97DxBe8xXjbuut6VyGLdHDmPDxgzepYJZgTS22aYxKs0OUIgACO0jllT42XHPjys5tSFsXNrUUxJzJS8Scp9nLAHhtwjw0BHb5UgQTrz92yk6YQY1ecxx3yZNd4u0wP7%2FoZ1vcXXSkj%2BVfnrFFHRUwWET4L8L%2FF%2F51yJRD2S1PYQttSSBk%2BNewJMSkQ%3D%3D3sSs5ee177fa238d9e2636242ddcfdf3ece7670f64cf:48:03a4179f-1925-11f1-967b-3cd2e55daed6:07800a205d
-> 解url编码
2edDuiIZJ+LezQ5gM5JOQRLcyQjT8yCAltx3m723sJS00Q1kg5cFgNh10zl142YCm71YWWicfTeBu7cQ2hzhtlqZrQuF5JJhOCtrNGDZW9hVFdnspRN6wJlUuNM/9/zXKJZdpjpFHt/4bWQuYFY72rzvItbovv08kXJ8jYJ6DSCvmgpp73xCR6QbXLP7c+z5jyZTkGGJBZfbqpqrEn+URG2otr14fhnabMEBof2jvTELLgj96XtaCy0FrGnL6kxRTJccFWLGfpP3eJZAaeRUNI15jW98+WVxbSi14rsW3gZHfGEDRxRWwsIhjTzFgS8XHj/3vLKNDK8oaZ/WAPnzo3d2eZz2oZ4WnnEvOcO/pdusI3+R9MpBl2BiBH885mDcwifJgkZT+nfQOz1Nr0DFoipAZ///6nWClrFdOm10WDVtUAMCVKcccgPq/MGd0+T0bYjTImYnengxiK2FVlcES3qQqDCse1orwTT26XyvASZkwgOrU+dhAHDcif1AR1fXTtdPqWdKEcF+mqL+ahMh2W1VXz1szfBLEIYUYp+A5opOhWPw0NwqJ2GqgW+OB86mFVUGH4znjt1TD8OTp0fRzY5eJSJBTYx00Q9E4pyoz8mlU+5iDO2eEBhLuyhFo0Qg2fiF0tB8rLWC0g5fhWMd0ruqizi97DxBe8xXjbuut6VyGLdHDmPDxgzepYJZgTS22aYxKs0OUIgACO0jllT42XHPjys5tSFsXNrUUxJzJS8Scp9nLAHhtwjw0BHb5UgQTrz92yk6YQY1ecxx3yZNd4u0wP7/oZ1vcXXSkj+VfnrFFHRUwWET4L8L/F/51yJRD2S1PYQttSSBk+NewJMSkQ==3sSs5ee177fa238d9e2636242ddcfdf3ece7670f64cf:48:03a4179f-1925-11f1-967b-3cd2e55daed6:07800a205d
-> 2edDuiIZJ+LezQ5gM5JOQRLcyQjT8yCAltx3m723sJS00Q1kg5cFgNh10zl142YCm71YWWicfTeBu7cQ2hzhtlqZrQuF5JJhOCtrNGDZW9hVFdnspRN6wJlUuNM/9/zXKJZdpjpFHt/4bWQuYFY72rzvItbovv08kXJ8jYJ6DSCvmgpp73xCR6QbXLP7c+z5jyZTkGGJBZfbqpqrEn+URG2otr14fhnabMEBof2jvTELLgj96XtaCy0FrGnL6kxRTJccFWLGfpP3eJZAaeRUNI15jW98+WVxbSi14rsW3gZHfGEDRxRWwsIhjTzFgS8XHj/3vLKNDK8oaZ/WAPnzo3d2eZz2oZ4WnnEvOcO/pdusI3+R9MpBl2BiBH885mDcwifJgkZT+nfQOz1Nr0DFoipAZ///6nWClrFdOm10WDVtUAMCVKcccgPq/MGd0+T0bYjTImYnengxiK2FVlcES3qQqDCse1orwTT26XyvASZkwgOrU+dhAHDcif1AR1fXTtdPqWdKEcF+mqL+ahMh2W1VXz1szfBLEIYUYp+A5opOhWPw0NwqJ2GqgW+OB86mFVUGH4znjt1TD8OTp0fRzY5eJSJBTYx00Q9E4pyoz8mlU+5iDO2eEBhLuyhFo0Qg2fiF0tB8rLWC0g5fhWMd0ruqizi97DxBe8xXjbuut6VyGLdHDmPDxgzepYJZgTS22aYxKs0OUIgACO0jllT42XHPjys5tSFsXNrUUxJzJS8Scp9nLAHhtwjw0BHb5UgQTrz92yk6YQY1ecxx3yZNd4u0wP7/oZ1vcXXSkj+VfnrFFHRUwWET4L8L/F/51yJRD2S1PYQttSSBk+NewJMSkQ== 拼接 3sSs 再拼接 5ee177fa238d9e2636242ddcfdf3ece7670f64cf:48:03a4179f-1925-11f1-967b-3cd2e55daed6:07800a205d

5ee177fa238d9e2636242ddcfdf3ece7670f64cf:48:03a4179f-1925-11f1-967b-3cd2e55daed6:07800a205d _s3_tid 值


window[_0x329b56['YOvGr'](_ssc[0x14] + _ssc[0x13], _ssc[0x12]) + _ssc[0x16]](_0x408575) 简化为
window['encodeURIComponent'](_0x408575)

分析_0x408575

var _0x408575 = _0x6c54d2[_s3[_0x4c31('0x12')][0x16]()](
    window[_0x329b56['LASmD']][_0x329b56['dGNYq']][_0x329b56[_0x4c31('0x142')](window['_s3'][_0x4c31('0x25')][_0x329b56['LtdfR']], 0x1)]
);
->
简化
var _0x408575 = _0x6c54d2['encrypt'](
    window['_s3']['_sc'][10]
);
'["019f96e86d0bad0c1659c174efb5995ef0f9c708:48:d7e0cded-1929-11f1-967b-3cd2e55daed6:0000412036;S1dhqO55dg6lj3441ypkuc3zm","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36","zh-CN","124.04347527516074","Win32",["218.76.22.217"],"c2331586",["1920","1080","1","32"],-480,"https://www.shenzhenair.com/szair_B2C/index.html","20d20a7473f3c0e98248a5ebe32dc7aebdbc50c7","7f7dda45","(https://www.shenzhenair.com/vodka/v1/js/sw.js:1:248045)\\n","30c26ca0822c51c9e98292ff3eb031149535b635",[[2,2,2,2,2],[2,2,3,2,3,3],2,2,2,[3,2,3,2,2,3],[2,2,2,1,1,1,3,0],[2],[2],2,[2],[2,2],2,2],[],2]'

//  应该是cookie生成所需明文
'["019f96e86d0bad0c1659c174efb5995ef0f9c708:48:d7e0cded-1929-11f1-967b-3cd2e55daed6:0000412036;S1dhqO55dg6lj3441ypkuc3zm","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36","zh-CN","124.04347527516074","Win32",["218.76.22.217"],"c2331586",["1920","1080","1","32"],-480,"https://www.shenzhenair.com/szair_B2C/index.html","20d20a7473f3c0e98248a5ebe32dc7aebdbc50c7","7f7dda45","(https://www.shenzhenair.com/vodka/v1/js/sw.js:1:248045)\\n","30c26ca0822c51c9e98292ff3eb031149535b635",[[2,2,2,2,2],[2,2,3,2,3,3],2,2,2,[3,2,3,2,2,3],[2,2,2,1,1,1,3,0],[2],[2],2,[2],[2,2],2,2],[],2]'

 _0x6c54d2['encrypt'] 是加密方法
 
 // 1.剩下要解决的就是自己实现_0x6c54d2['encrypt']加密方法
 // 2.自己模拟生成所需明文部分,可以看到携带了两个响应cookie的值,还有浏览器api相关信息
 
 // ai对算法的分析

// 算法还原

// 加密key分析 很简单,分析过程放知识星球了,有需要可以加星球获取
https://wx.zsxq.com/group/51115211518854

亚马逊云科技技术品牌专区

更多推荐

open-code-review Codex 插件教程：对话式调用评审技能指南

本文是一份面向新手的 **open-code-review Codex 插件教程**，教你在 Codex 中通过对话式方式调用 open-code-review 的 AI 代码评审技能。open-code-review 是阿里巴巴开源的 AI 代码评审工具，采用"确定性流水线 + LLM Agent"混合架构，内置多语言评审规则（NPE、线程安全、XSS、SQL 注入等），可在 Codex 里用一

亚马逊云科技技术品牌专区

OBS Studio 完整指南：免费开源录屏与直播软件从零上手

想做一场像模像样的直播，或者把屏幕内容录成教程视频，但一想到商用软件的订阅费就有些犹豫？其实你不需要花一分钱。OBS Studio 是一款免费开源的直播与录屏软件，支持 Windows、macOS 和 Linux，采集、混音、编码、推流、录制，一条流水线全包了。## 先搞清楚 OBS Studio 是什么OBS Studio 是一个"场景化"的采集合成工具：你把摄像头、窗口、浏览器、图片、

亚马逊云科技技术品牌专区

如何用MediaCrawler爬取小红书抖音数据？7大平台爬虫从安装到实战完整指南

MediaCrawler 是一个支持小红书、抖音、快手、B站、微博、百度贴吧、知乎的开源自媒体数据采集工具。它能按关键词、按帖子、按创作者主页三种方式抓取笔记/视频内容、评论甚至二级评论，并把结果存成 JSON、CSV、Excel 或数据库。适合做市场调研、竞品监控、内容选题的运营人员，以及想要现成爬虫框架而不想从零写 JS 逆向的开发者。## 从一次"手动抄数据"说起想象这个场景：你负责