若依框架渗透测试用户名密码明文传输问题

解决思路，前端js加密，controller层解密

1、前端加密

引入js(jsencrypt.min.js) 个人备份js

function login() {
	$.modal.loading($("#btnSubmit").data("loading"));
	var username = $("input[name='username']").val().trim();
    var password = $("input[name='password']").val().trim();
    var validateCode = $("input[name='validateCode']").val();
    var rememberMe = $("input[name='rememberme']").is(':checked');
    $.ajax({
        type: "post",
        url: ctx + "login",
        data: {
            "username": username,
            "password": getP(password),
            "validateCode" : validateCode,
            "rememberMe": rememberMe
        },
        success: function(r) {

。。。。。。。。。。。。。。。省略

function getP(pw){
    var encrypt = new JSEncrypt();
    encrypt.setPublicKey("-----BEGIN PUBLIC KEY-----MIIBITANBgkqhkiG9w0BAQEFAAOCAQ4AMIIBCQKCAQBdGLuF0cP1mE8cuK24mp7qi5sSmNVSB0qdJiiw6jzkU+iH1+bVJmFbuiAmYG/VOym6ZDftCy2R4oJvkP7MgS1nsxBRdnb0eAU/abVy1Wk2y1d6ZsiF35Shpy235WfkIVc9cRX71LpNxetfMiFAJSqSZ2XbNJTBWZEah/r0rBgRSAkC6NbFsgdWi6VbPGDVM+Y2pM8wQjrUi3ZCTE9SSchv/grbl/OJm/T5uaYP0VqoOV0Zzi89bqjby9XexInyCj+1hxy7+9NP1brx5qHRAuiidbtqHzVOyKpsKGPh2fJugbVhzUoqM6ebL/j1y8w92obMj3snsgykqj5T2kfSiiMxAgMBAAE=-----END PUBLIC KEY-----");
    var encryted = encrypt.encrypt(pw);
    return encryted;
}

这儿的公钥可以放到jsencrypt.min.js的最后面，然后在这儿取，我直接就写到这儿了

　　controller层解密代码

@PostMapping("/login")
@ResponseBody
public AjaxResult ajaxLogin(String username, String password, Boolean rememberMe)
{
    String repassword = "";
    //System.out.println("解密前"+password);

    //对传过来密码的值进行解密
    try {
         repassword = RSAUtil.decrypt(password,RSAUtil.PRIVATE_KEY);
        //System.out.println("解密后"+repassword);
    } catch (Exception e) {
        e.printStackTrace();
        return error("非法登录");
    }
    UsernamePasswordToken token = new UsernamePasswordToken(username, repassword, rememberMe);
    Subject subject = SecurityUtils.getSubject();
    try{
        subject.login(token);
        return success();
    }
    catch (AuthenticationException e)
    {
        String msg = "用户或密码错误";
        if (StringUtils.isNotEmpty(e.getMessage()))
        {
            msg = e.getMessage();
        }
        return error(msg);
    }
}

　　工具类SHAUtil

package com.ruoyi.common.utils;

import org.apache.commons.codec.binary.Base64;

import javax.crypto.Cipher;
import java.security.*;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.HashMap;
import java.util.Map;

public class RSAUtil {
    //public static String PRIVATE_KEY="MIIEoQIBAAMMMMMMMMMMMMMMMMFbuiAmYG/VOym6ZDftCy2R4oJvkP7MgS1nsxBRdnb0eAU/abVy1Wk2y1d6ZsiF35Shpy235WfkIVc9cRX71LpNxetfMiFAJSqSZ2XbNJTBWZEah/r0rBgRSAkC6NbFsgdWi6VbPGDVM+Y2pM8wQjrUi3ZCTE9SSchv/grbl/OJm/T5uaYP0VqoOV0Zzi89bqjby9XexInyCj+1hxy7+9NP1brx5qHRAuiidbtqHzVOyKpsKGPh2fJugbVhzUoqM6ebL/j1y8w92obMj3snsgykqj5T2kfSiiMxAgMBAAECggEALujqfMixJEyl+IP6TV3kG61S63EFdHrmFv+GW3b8TdUWA3VABEF9p1nHH29SirBwG1Kqd5A9Wxg2v37hVSz2Mx2gaFv4HsFna4eZfY6ZoJmfr7ag7gw1+aqit9opmmNOcVBNUoLjiZLkQiihZpATvofJZEY/epnmKudABg+9ZN86vnbA2DFnYmVLbZvWwhGyr7AnvDO+678PtpIaWL4yxRA+p+6CxQd5ZkQf8E6VGeU4qSmbksjN+fav1SwDm4hGSBvHP6r2dWZ7MITg4DomavOwCJseh9AVX9LUtygumjY/NdYoUXkyoSeniQwL/uMd1ewB9Qi8jrJj9NAxUbsXDQKBgQCe2zRMi+R5u35FL2jWs/gAgT7KQ8d0vlv/eAOD2filiEGRoTgdzAXuGY0vytICf11HZ/y0qhPuiDuNIOnvIa9kj2zHawVBbm6Fl6J6GP874V894Bh3J3oWn9ilMIfEjvM4Jlg6aKPiht1EiykLgvIim4qaFj8UTBMMkaqUZJjw6wKBgQCWBurdYj59dZ6XOlYZTDNjJriTm4MdOZrvxAOnYIdvtDcVhqWNcocR0OXYilwehLxnsbExbE3En4OmUbZZe2pOvQ96OojUQHP4vwFUD3dm6gS87yT9nwDkMFgNETVbxVUI2SYsmtPnI8NgkkSiJfbj3Jlfe4ZCu4gwWJfD2WJVUwKBgDZW4XL1v3fsrOrZptEaytDRZTsnKElE/I9M7Fbj7uwgyd0Y+usmaTjjQKqChIgaLTxJ0+Ww8BR+QXCrO5pzOV36uckVULzrG59TGV8OwfAnzb6Ks5O+y0KF90O6cBbKl2QzqaaBON46J+JUf/vSFSXFcwn2Zil5RGLeSS1to+t1AoGAcq6NAHfmDt9HQJC+Wg4uxd9GfscEneV380oiBOM8BH59EP5hNNPUPiEyYam6KzYKEzX4njAM7n2FFDEoNBSsOc45s5RlHeK7A+12JXzBKDFBN++SljDibIwr8qkx4Znhm6bqkHQ2AV0ML5j/z/c3WA08TInPItnZjCNct8BHc7MCgYAsV4y3/CtQEmxk3wQr8ng/4LZtHuXdojh8ZQ74b3gQqO/iml6XdzZJRN/fmO+ikDAY6jPQAW4RsqZ1l8W1pKbzCvuTW6jGoUyti+Lrt3HDF9SlZMHk4gc/tq1/ad4lIgHbCxBJv7UvP6YDQX+7itJmpmYmhTuYuJ11ZnAZg9qCQg==";
    public static String PRIVATE_KEY="MIIEuwNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNgEAAoIBAF0Yu4XRw/WYTxy4rbianuqLmxKY1VIHSp0mKLDqPORT6IfX5tUmYVu6ICZgb9U7KbpkN+0LLZHigm+Q/syBLWezEFF2dvR4BT9ptXLVaTbLV3pmyIXflKGnLbflZ+QhVz1xFfvUuk3F618yIUAlKpJnZds0lMFZkRqH+vSsGBFICQLo1sWyB1aLpVs8YNUz5jakzzBCOtSLdkJMT1JJyG/+CtuX84mb9Pm5pg/RWqg5XRnOLz1uqNvL1d7EifIKP7WHHLv700/VuvHmodEC6KJ1u2ofNU7IqmwoY+HZ8m6BtWHNSiozp5sv+PXLzD3ahsyPeyeyDKSqPlPaR9KKIzECAwEAAQKCAQAu6Op8yLEkTKX4g/pNXeQbrVLrcQV0euYW/4ZbdvxN1RYDdUAEQX2nWccfb1KKsHAbUqp3kD1bGDa/fuFVLPYzHaBoW/gewWdrh5l9jpmgmZ+vtqDuDDX5qqK32imaY05xUE1SguOJkuRCKKFmkBO+h8lkRj96meYq50AGD71k3zq+dsDYMWdiZUttm9bCEbKvsCe8M77rvw+2khpYvjLFED6n7oLFB3lmRB/wTpUZ5TipKZuSyM359q/VLAObiEZIG8c/qvZ1ZnswhODgOiZq87AImx6H0BVf0tS3KC6aNj811ihReTKhJ6eJDAv+4x3V7AH1CLyOsmP00DFRuxcNAoGBAJ7bNEyL5Hm7fkUvaNaz+ACBPspDx3S+W/94A4PZ+KWIQZGhOB3MBe4ZjS/K0gJ/XUdn/LSqE+6IO40g6e8hr2SPbMdrBUFuboWXonoY/zvhXz3gGHcnehaf2KUwh8SO8zgmWDpoo+KG3USLKQuC8iKbipoWPxRMEwyRqpRkmPDrAoGBAJYG6t1iPn11npc6VhlMM2MmuJObgx05mu/EA6dgh2+0NxWGpY1yhxHQ5diKXB6EvGexsTFsTcSfg6ZRtll7ak69D3o6iNRAc/i/AVQPd2bqBLzvJP2fAOQwWA0RNVvFVQjZJiya0+cjw2CSRKIl9uPcmV97hkK7iDBYl8PZYlVTAoGANlbhcvW/d+ys6tmm0RrK0NFlOycoSUT8j0zsVuPu7CDJ3Rj66yZpOONAqoKEiBotPEnT5bDwFH5BcKs7mnM5Xfq5yRVQvOsbn1MZXw7B8CfNvoqzk77LQoX3Q7pwFsqXZDOppoE43jon4lR/+9IVJcVzCfZmKXlEYt5JLW2j63UCgYByro0Ad+YO30dAkL5aDi7F30Z+xwSd5XfzSiIE4zwEfn0Q/mE009Q+ITJhqborNgoTNfieMAzufYUUMSg0FKw5zjmzlGUd4rsD7XYlfMEoMUE375KWMOJsjCvyqTHhmeGbpuqQdDYBXQwvmP/P9zdYDTxMic8i2dmMI1y3wEdzswKBgCxXjLf8K1ASbGTfBCvyeD/gtm0e5d2iOHxlDvhveBCo7+KaXpd3NklE39+Y76KQMBjqM9ABbhGypnWXxbWkpvMK+5NbqMahTK2L4uu3ccMX1KVkweTiBz+2rX9p3iUiAdsLEEm/tS8/pgNBf7uK0mamZiaFO5i4nXVmcBmD2oJC";
    public static String PUBLIC_KEY="MIIBITANBgkqhkiKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKi5sSmNVSB0qdJiiw6jzkU+iH1+bVJmFbuiAmYG/VOym6ZDftCy2R4oJvkP7MgS1nsxBRdnb0eAU/abVy1Wk2y1d6ZsiF35Shpy235WfkIVc9cRX71LpNxetfMiFAJSqSZ2XbNJTBWZEah/r0rBgRSAkC6NbFsgdWi6VbPGDVM+Y2pM8wQjrUi3ZCTE9SSchv/grbl/OJm/T5uaYP0VqoOV0Zzi89bqjby9XexInyCj+1hxy7+9NP1brx5qHRAuiidbtqHzVOyKpsKGPh2fJugbVhzUoqM6ebL/j1y8w92obMj3snsgykqj5T2kfSiiMxAgMBAAE=";
    private static Map<Integer, String> keyMap = new HashMap<Integer, String>();  //用于封装随机产生的公钥与私钥
/*    public static void main(String[] args) throws Exception {
        //生成公钥和私钥
        genKeyPair();
        //加密字符串
        String message = "testmsg";
        System.out.println("随机生成的公钥为:" + keyMap.get(0));
        System.out.println("随机生成的私钥为:" + keyMap.get(1));
        String messageEn = encrypt(message,keyMap.get(0));
        System.out.println("明文："+message);
        System.out.println("加密后的字符串为:" + messageEn);
        String messageDe = decrypt(messageEn,keyMap.get(1));
        System.out.println("还原后的字符串为:" + messageDe);
    }*/

    /**
     * 随机生成密钥对
     * @throws NoSuchAlgorithmException
     */
    public static void genKeyPair() throws NoSuchAlgorithmException {
        // KeyPairGenerator类用于生成公钥和私钥对，基于RSA算法生成对象
        KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("RSA");
        // 初始化密钥对生成器，密钥大小为96-1024位
        keyPairGen.initialize(1024,new SecureRandom());
        // 生成一个密钥对，保存在keyPair中
        KeyPair keyPair = keyPairGen.generateKeyPair();
        RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();   // 得到私钥
        RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();  // 得到公钥
        String publicKeyString = new String(Base64.encodeBase64(publicKey.getEncoded()));
        // 得到私钥字符串
        String privateKeyString = new String(Base64.encodeBase64((privateKey.getEncoded())));
        // 将公钥和私钥保存到Map
        keyMap.put(0,publicKeyString);  //0表示公钥
        keyMap.put(1,privateKeyString);  //1表示私钥
    }
    /**
     * RSA公钥加密
     *
     * @param str
     *            加密字符串
     * @param publicKey
     *            公钥
     * @return 密文
     * @throws Exception
     *             加密过程中的异常信息
     */
    public static String encrypt( String str, String publicKey ) throws Exception{
        //base64编码的公钥
        byte[] decoded = Base64.decodeBase64(publicKey);
        RSAPublicKey pubKey = (RSAPublicKey) KeyFactory.getInstance("RSA").generatePublic(new X509EncodedKeySpec(decoded));
        //RSA加密
        Cipher cipher = Cipher.getInstance("RSA");
        cipher.init(Cipher.ENCRYPT_MODE, pubKey);
        String outStr = Base64.encodeBase64String(cipher.doFinal(str.getBytes("UTF-8")));
        return outStr;
    }

    /**
     * RSA私钥解密
     *
     * @param str
     *            加密字符串
     * @param privateKey
     *            私钥
     * @return 铭文
     * @throws Exception
     *             解密过程中的异常信息
     */
    public static String decrypt(String str, String privateKey) throws Exception{
        //64位解码加密后的字符串
        byte[] inputByte = Base64.decodeBase64(str.getBytes("UTF-8"));
        //base64编码的私钥
        byte[] decoded = Base64.decodeBase64(privateKey);
        RSAPrivateKey priKey = (RSAPrivateKey) KeyFactory.getInstance("RSA").generatePrivate(new PKCS8EncodedKeySpec(decoded));
        //RSA解密
        Cipher cipher = Cipher.getInstance("RSA");
        cipher.init(Cipher.DECRYPT_MODE, priKey);
        String outStr = new String(cipher.doFinal(inputByte));
        return outStr;
    }
}

　　公钥和私钥生成地址

https://www.bm8.com.cn/webtool/rsa/

生成的密钥要格式转化

 把密钥格式转化为  pksc8

http://tool.chacuo.net/cryptrsapkcs1pkcs8