逆向28-中大网校

目录

网址

其实我想拿到的数据比如考试题，是需要登陆之后才可以拿到，所以我们需要逆向登陆，添加cookie才可以

1. 登陆

image

登陆的时候一共有三个请求，主要目标是passwordLogin 至于其他的两个 一个是拿时间，一个是拿图片验证吗

2. 源码分析

2.1 password

image

有三个关键字imageCaptchaCode,password,userName 搜索分析,目标是密码加密，先使用 password

image

image

2.1.1 ress.data
  1. 看是谁传递的这个参数

image

o(n)函数
image

具体的

image

哦 也就是说，这些个参数是通过/common/getTime 这个接口获取的，在回到我们的入口，也就是箭头函数那

    zdAjax(paramss, (ress) => { 
      var param = {
        url: '/login/passwordLogin',
        data: {
          userName: username,
          password: encryptFn(pwd + '' + ress.data),// 取data数据，也就是时间戳，python可以time.time()
          imageCaptchaCode: imgCode,
        },
      }
      ......
2.1.2 encryptFn

image

encrypt，可以看出这样就是生成了我们要的数据，继续观察

image

image

RSA算法

image

至此我们大概知道了，password 就是 我们的密码+时间戳 进行了一个RSA加密

2.2 imageCaptchaCode

接口

image

根据观察，就是一个POST请求，我们直接用python实现

3. 代码实现

3.1 imageCaptchaCode

import requests
import base64
cookies = {
  'sessionId': '1729838707571',
  'mantis6894': 'fde487ed71dd45eda7da98e617ed00cb@6894',
  'Hm_lvt_86efc728d941baa56ce968a5ad7bae5f': '1729838715',
  'HMACCOUNT': '5B3A86709F76EACE',
  '_bl_uid': '8RmLz20hon3d08bvk3ab2s1e5bdF',
  'Hm_lpvt_86efc728d941baa56ce968a5ad7bae5f': '1729838781',
}
headers = {
  'Accept': 'application/json, text/javascript, */*; q=0.01',
  'Accept-Language': 'zh-CN,zh;q=0.9',
  'Cache-Control': 'no-cache',
  'Connection': 'keep-alive',
  # 'Content-Length': '0',
  'Content-Type': 'application/json;charset=UTF-8',
  # 'Cookie': 'sessionId=1729838707571; mantis6894=fde487ed71dd45eda7da98e617ed00cb@6894; Hm_lvt_86efc728d941baa56ce968a5ad7bae5f=1729838715; HMACCOUNT=5B3A86709F76EACE; _bl_uid=8RmLz20hon3d08bvk3ab2s1e5bdF; Hm_lpvt_86efc728d941baa56ce968a5ad7bae5f=1729838781',
  'EagleEye-SessionID': 'mnm3h28wo1hd45csLhzavdFgFO9w',
  'EagleEye-TraceID': 'fd4b25b51729840541093101681d1d',
  'EagleEye-pAppName': 'ihuy5j2ab7@7cd9bc63da81d1d',
  'Origin': 'https://user.wangxiao.cn',
  'Pragma': 'no-cache',
  'Referer': 'https://user.wangxiao.cn/login',
  'Sec-Fetch-Dest': 'empty',
  'Sec-Fetch-Mode': 'cors',
  'Sec-Fetch-Site': 'same-origin',
  'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36',
  'X-Requested-With': 'XMLHttpRequest',
  'sec-ch-ua': '"Not/A)Brand";v="8", "Chromium";v="126", "Google Chrome";v="126"',
  'sec-ch-ua-mobile': '?0',
  'sec-ch-ua-platform': '"macOS"',
  'sessionId': '1729838707571',
  'source': 'pc',
  'token': '',
}



response = requests.post('https://user.wangxiao.cn/apis//common/getImageCaptcha', cookies=cookies, headers=headers)
# 从返回值里拿到img的数据
base64_img = response.json().get('data').split(",")[-1]

# 测试使用
with open("./captcha.png", "wb") as f:
    f.write(base64.b64decode(base64_img))

使用ddddocr来识别图片验证码

import ddddocr

ocr = ddddocr.DdddOcr(show_ad=False) # 去广告
with open('./captcha.png', 'rb') as f:
    img_bytes = f.read()
img_res = ocr.classification(img_bytes)

print(img_res)

3.2 password加密

3.2.1 时间戳
# 时间戳有两种获取的方式
# 1. getTime服务器获取
res = requests.post("https://user.wangxiao.cn/apis//common/getTime", cookies=cookies, headers=headers)
timestamp = res.json().get("data")
print(timestamp)
# 2. python的time.time()获取
import time
print(str(int(time.time())*1000))
3.2.2 RSA加密
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_v1_5
import base64

# 固定用法
publicKey = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA5Zq6ZdH/RMSvC8WKhp5gj6Ue4Lqjo0Q2PnyGbSkTlYku0HtVzbh3S9F9oHbxeO55E8tEEQ5wj/+52VMLavcuwkDypG66N6c1z0Fo2HgxV3e0tqt1wyNtmbwg7ruIYmFM+dErIpTiLRDvOy+0vgPcBVDfSUHwUSgUtIkyC47UNQIDAQAB"
rsa_pk = RSA.importKey(base64.b64decode(publicKey))
rsa = PKCS1_v1_5.new(rsa_pk)
 
user = "xxxxx"
pwd = "xxxxx"
data = pwd + timestamp
encrypt_data = rsa.encrypt(data.encode())
pwd_enc = base64.b64encode(encrypt_data).decode()
print(pwd_enc)

3.3 发送请求

url = "https://user.wangxiao.cn/apis//login/passwordLogin"
 
data = {
    "imageCaptchaCode": img_res,
    "userName": "*",
    "password": pwd_enc
}

response = requests.post('https://user.wangxiao.cn/apis//login/passwordLogin', cookies=cookies, headers=headers, data=json.dumps(data))
print("res:::", response.text)

总代码

import requests
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_v1_5
import base64
import json
cookies = {
  'sessionId': '1729838707571',
  'mantis6894': 'fde487ed71dd45eda7da98e617ed00cb@6894',
  'Hm_lvt_86efc728d941baa56ce968a5ad7bae5f': '1729838715',
  'HMACCOUNT': '5B3A86709F76EACE',
  '_bl_uid': '8RmLz20hon3d08bvk3ab2s1e5bdF',
  'Hm_lpvt_86efc728d941baa56ce968a5ad7bae5f': '1729838781',
}
headers = {
  'Accept': 'application/json, text/javascript, */*; q=0.01',
  'Accept-Language': 'zh-CN,zh;q=0.9',
  'Cache-Control': 'no-cache',
  'Connection': 'keep-alive',
  # 'Content-Length': '0',
  'Content-Type': 'application/json;charset=UTF-8',
  # 'Cookie': 'sessionId=1729838707571; mantis6894=fde487ed71dd45eda7da98e617ed00cb@6894; Hm_lvt_86efc728d941baa56ce968a5ad7bae5f=1729838715; HMACCOUNT=5B3A86709F76EACE; _bl_uid=8RmLz20hon3d08bvk3ab2s1e5bdF; Hm_lpvt_86efc728d941baa56ce968a5ad7bae5f=1729838781',
  'EagleEye-SessionID': 'mnm3h28wo1hd45csLhzavdFgFO9w',
  'EagleEye-TraceID': 'fd4b25b51729840541093101681d1d',
  'EagleEye-pAppName': 'ihuy5j2ab7@7cd9bc63da81d1d',
  'Origin': 'https://user.wangxiao.cn',
  'Pragma': 'no-cache',
  'Referer': 'https://user.wangxiao.cn/login',
  'Sec-Fetch-Dest': 'empty',
  'Sec-Fetch-Mode': 'cors',
  'Sec-Fetch-Site': 'same-origin',
  'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36',
  'X-Requested-With': 'XMLHttpRequest',
  'sec-ch-ua': '"Not/A)Brand";v="8", "Chromium";v="126", "Google Chrome";v="126"',
  'sec-ch-ua-mobile': '?0',
  'sec-ch-ua-platform': '"macOS"',
  'sessionId': '1729838707571',
  'source': 'pc',
  'token': '',
}


# (1) 获取验证码
response = requests.post('https://user.wangxiao.cn/apis//common/getImageCaptcha', cookies=cookies, headers=headers)

base64_img = response.json().get('data').split(",")[-1]

with open("./captcha.png", "wb") as f:
    f.write(base64.b64decode(base64_img))

# (2) 基于打码平台实现验证码识别
# def base64_api(b64):
#     data = {"username": "q6035945", "password": "q6035945", "typeid": 3, "image": b64}
#     result = json.loads(requests.post("http://api.ttshitu.com/predict", json=data).text)
#     if result['success']:
#         return result["data"]["result"]
#     else:
#         return result["message"]
#     return ""
 
 
# code = base64_api(base64_img)
# print(code)
import ddddocr

ocr = ddddocr.DdddOcr(show_ad=False)
with open('./captcha.png', 'rb') as f:
    img_bytes = f.read()
img_res = ocr.classification(img_bytes)

print(img_res)
# (3) 获取时间戳 + RSA加密密码
res = requests.post("https://user.wangxiao.cn/apis//common/getTime", cookies=cookies, headers=headers)
timestamp = res.json().get("data")

publicKey = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA5Zq6ZdH/RMSvC8WKhp5gj6Ue4Lqjo0Q2PnyGbSkTlYku0HtVzbh3S9F9oHbxeO55E8tEEQ5wj/+52VMLavcuwkDypG66N6c1z0Fo2HgxV3e0tqt1wyNtmbwg7ruIYmFM+dErIpTiLRDvOy+0vgPcBVDfSUHwUSgUtIkyC47UNQIDAQAB"
rsa_pk = RSA.importKey(base64.b64decode(publicKey))
rsa = PKCS1_v1_5.new(rsa_pk)
 
user = "*"
pwd = "*"
data = pwd + timestamp
encrypt_data = rsa.encrypt(data.encode())
pwd_enc = base64.b64encode(encrypt_data).decode()
print(pwd_enc)
# (4) 登录
url = "https://user.wangxiao.cn/apis//login/passwordLogin"
 
data = {
    "imageCaptchaCode": img_res,
    "userName": "*",
    "password": pwd_enc
}
 
response = requests.post('https://user.wangxiao.cn/apis//login/passwordLogin', cookies=cookies, headers=headers, data=json.dumps(data))
print("res:::", response.text)

4 登陆之后去请求其他接口

image

url = "https://ks.wangxiao.cn/TestPaper/getPaperRuleQuestions"
data = {
    "id": "DE66B073-F36A-4B44-A4F5-4761C9B81583"
    }
res_fin = requests.post(url, data=json.dumps(data), cookies=cookies, headers=headers,)
print(res_fin.text)

image

推理看一下源码

image

// 成功之后走下面的三行代码设置值，外加最后一行来设置值
keepOurCookie12('autoLogin', null)
keepOurCookie12('userInfo', JSON.stringify(res.data))
keepOurCookie12('token', res.data.token)
syncLogin(res.data)

res.data

image

syncLogin(res.data)

image

  $.cookie("UserCookieName", e.userName, n),
  $.cookie("OldUsername2", e.userNameCookies, n),
  $.cookie("OldUsername", e.userNameCookies, n),
  $.cookie("OldPassword", e.passwordCookies, n),
  $.cookie("UserCookieName_", e.userName, n),
  $.cookie("OldUsername2_", e.userNameCookies, n),
  $.cookie("OldUsername_", e.userNameCookies, n),
  $.cookie("OldPassword_", e.passwordCookies, n),
   // 如果对象e中的sign属性存在且为真值，则设置一个名为e.userName + "_exam"的cookie，其值为e.sign，并且这个cookie将在365天后过期。这个操作依赖于jQuery的$.cookie插件。
  e.sign && (n.expires = 365, $.cookie(e.userName + "_exam", e.sign, n))

python 实现,我们要加载cookie 这个时候最好是在session中，request中有一个request.session

import requests
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_v1_5
import base64
import json

session = requests.session()
session.get("https://user.wangxiao.cn/login")
session.headers['Content-Type'] = "application/json;charset=UTF-8"
# (1) 获取验证码
response = session.post('https://user.wangxiao.cn/apis//common/getImageCaptcha')

base64_img = response.json().get('data').split(",")[-1]

with open("./captcha.png", "wb") as f:
    f.write(base64.b64decode(base64_img))

import ddddocr

ocr = ddddocr.DdddOcr(show_ad=False)
with open('./captcha.png', 'rb') as f:
    img_bytes = f.read()
img_res = ocr.classification(img_bytes)

print(img_res)
# (3) 获取时间戳 + RSA加密密码
res = session.post("https://user.wangxiao.cn/apis//common/getTime")
timestamp = res.json().get("data")

publicKey = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA5Zq6ZdH/RMSvC8WKhp5gj6Ue4Lqjo0Q2PnyGbSkTlYku0HtVzbh3S9F9oHbxeO55E8tEEQ5wj/+52VMLavcuwkDypG66N6c1z0Fo2HgxV3e0tqt1wyNtmbwg7ruIYmFM+dErIpTiLRDvOy+0vgPcBVDfSUHwUSgUtIkyC47UNQIDAQAB"
rsa_pk = RSA.importKey(base64.b64decode(publicKey))
rsa = PKCS1_v1_5.new(rsa_pk)
 
user = "*"
pwd = "*"
data = pwd + timestamp
encrypt_data = rsa.encrypt(data.encode())
pwd_enc = base64.b64encode(encrypt_data).decode()
print(pwd_enc)
# (4) 登录
url = "https://user.wangxiao.cn/apis//login/passwordLogin"
 
data = {
    "imageCaptchaCode": img_res,
    "userName": "*",
    "password": pwd_enc
}
 

response = session.post('https://user.wangxiao.cn/apis//login/passwordLogin', data=json.dumps(data))
print("res:::", response.text)
login_success_data = response.json().get("data")
 
# 写cookie
session.cookies['autoLogin'] = 'null'
session.cookies['userInfo'] = json.dumps(login_success_data)  
session.cookies['token'] = login_success_data.get("token")
 
session.cookies['UserCookieName'] = login_success_data.get("userName")
session.cookies['OldUsername2'] = login_success_data.get("userNameCookies")
session.cookies['OldUsername'] = login_success_data.get("userNameCookies")
session.cookies['OldPassword'] = login_success_data.get("passwordCookies")
session.cookies['UserCookieName_'] = login_success_data.get("userName")
session.cookies['OldUsername2_'] = login_success_data.get("userNameCookies")
session.cookies['OldUsername_'] = login_success_data.get("userNameCookies")
session.cookies['OldPassword_'] = login_success_data.get("passwordCookies")
session.cookies[login_success_data.get('userName') + "_exam"] = login_success_data.get("sign")
# 登陆之后获取其他页面的数据 因为页面需要cookie，所以上面要加载cookie，js代码中实现的
url = "https://ks.wangxiao.cn/TestPaper/getPaperRuleQuestions"
data = {
    "id": "DE66B073-F36A-4B44-A4F5-4761C9B81583"
    }

res_fin = session.post(url, data=json.dumps(data))
print(res_fin.text)

直接扣cookie

url = "https://ks.wangxiao.cn/TestPaper/getPaperRuleQuestions"
data = {
    "id": "DE66B073-F36A-4B44-A4F5-4761C9B81583"
    }
 
cookies2 = {
    'mantis6894': 'fde487ed71dd45eda7da98e617ed00cb@6894',
    'autoLogin': 'null',
    'userInfo': '%7B%22userName%22%3A%22pc_154531469%22%2C%22token%22%3A%22b5a9ff61-6a51-44f3-9bae-81b1fa63987c%22%2C%22headImg%22%3Anull%2C%22nickName%22%3A%22153****5323%22%2C%22sign%22%3A%22fangchan%22%2C%22isBindingMobile%22%3A%221%22%2C%22isSubPa%22%3A%220%22%2C%22userNameCookies%22%3A%22RMueSgKKnUbincC%2Br9rR4w%3D%3D%22%2C%22passwordCookies%22%3A%22oy%2BfBUYDZTZFTjU9C7d6VA%3D%3D%22%7D',
    'token': 'b5a9ff61-6a51-44f3-9bae-81b1fa63987c',
    'UserCookieName': 'pc_154531469',
    'OldUsername2': 'RMueSgKKnUbincC%2Br9rR4w%3D%3D',
    'OldUsername': 'RMueSgKKnUbincC%2Br9rR4w%3D%3D',
    'OldPassword': 'oy%2BfBUYDZTZFTjU9C7d6VA%3D%3D',
    'UserCookieName_': 'pc_154531469',
    'OldUsername2_': 'RMueSgKKnUbincC%2Br9rR4w%3D%3D',
    'OldUsername_': 'RMueSgKKnUbincC%2Br9rR4w%3D%3D',
    'OldPassword_': 'oy%2BfBUYDZTZFTjU9C7d6VA%3D%3D',
    'pc_154531469_exam': 'fangchan',
}

res_fin = requests.post(url, data=json.dumps(data), cookies=cookies, headers=headers,)
print(res_fin.text)

全部代码

import requests
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_v1_5
import base64
import json
cookies = {
  'sessionId': '1729838707571',
  'mantis6894': 'fde487ed71dd45eda7da98e617ed00cb@6894',
  'Hm_lvt_86efc728d941baa56ce968a5ad7bae5f': '1729838715',
  'HMACCOUNT': '5B3A86709F76EACE',
  '_bl_uid': '8RmLz20hon3d08bvk3ab2s1e5bdF',
  'Hm_lpvt_86efc728d941baa56ce968a5ad7bae5f': '1729838781',
}
headers = {
  'Accept': 'application/json, text/javascript, */*; q=0.01',
  'Accept-Language': 'zh-CN,zh;q=0.9',
  'Cache-Control': 'no-cache',
  'Connection': 'keep-alive',
  # 'Content-Length': '0',
  'Content-Type': 'application/json;charset=UTF-8',
  # 'Cookie': 'sessionId=1729838707571; mantis6894=fde487ed71dd45eda7da98e617ed00cb@6894; Hm_lvt_86efc728d941baa56ce968a5ad7bae5f=1729838715; HMACCOUNT=5B3A86709F76EACE; _bl_uid=8RmLz20hon3d08bvk3ab2s1e5bdF; Hm_lpvt_86efc728d941baa56ce968a5ad7bae5f=1729838781',
  'EagleEye-SessionID': 'mnm3h28wo1hd45csLhzavdFgFO9w',
  'EagleEye-TraceID': 'fd4b25b51729840541093101681d1d',
  'EagleEye-pAppName': 'ihuy5j2ab7@7cd9bc63da81d1d',
  'Origin': 'https://user.wangxiao.cn',
  'Pragma': 'no-cache',
  'Referer': 'https://user.wangxiao.cn/login',
  'Sec-Fetch-Dest': 'empty',
  'Sec-Fetch-Mode': 'cors',
  'Sec-Fetch-Site': 'same-origin',
  'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36',
  'X-Requested-With': 'XMLHttpRequest',
  'sec-ch-ua': '"Not/A)Brand";v="8", "Chromium";v="126", "Google Chrome";v="126"',
  'sec-ch-ua-mobile': '?0',
  'sec-ch-ua-platform': '"macOS"',
  'sessionId': '1729838707571',
  'source': 'pc',
  'token': '',
}


# (1) 获取验证码
response = requests.post('https://user.wangxiao.cn/apis//common/getImageCaptcha', cookies=cookies, headers=headers)

base64_img = response.json().get('data').split(",")[-1]

with open("./captcha.png", "wb") as f:
    f.write(base64.b64decode(base64_img))

# (2) 基于ddddocr实现验证码识别
import ddddocr

ocr = ddddocr.DdddOcr(show_ad=False)
with open('./captcha.png', 'rb') as f:
    img_bytes = f.read()
img_res = ocr.classification(img_bytes)

print(img_res)
# (3) 获取时间戳 + RSA加密密码
res = requests.post("https://user.wangxiao.cn/apis//common/getTime", cookies=cookies, headers=headers)
timestamp = res.json().get("data")

publicKey = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA5Zq6ZdH/RMSvC8WKhp5gj6Ue4Lqjo0Q2PnyGbSkTlYku0HtVzbh3S9F9oHbxeO55E8tEEQ5wj/+52VMLavcuwkDypG66N6c1z0Fo2HgxV3e0tqt1wyNtmbwg7ruIYmFM+dErIpTiLRDvOy+0vgPcBVDfSUHwUSgUtIkyC47UNQIDAQAB"
rsa_pk = RSA.importKey(base64.b64decode(publicKey))
rsa = PKCS1_v1_5.new(rsa_pk)
 
user = "*"
pwd = "*"
data = pwd + timestamp
encrypt_data = rsa.encrypt(data.encode())
pwd_enc = base64.b64encode(encrypt_data).decode()
print(pwd_enc)
# (4) 登录
url = "https://user.wangxiao.cn/apis//login/passwordLogin"
 
data = {
    "imageCaptchaCode": img_res,
    "userName": "*",
    "password": pwd_enc
}
 

response = requests.post('https://user.wangxiao.cn/apis//login/passwordLogin', cookies=cookies, headers=headers, data=json.dumps(data))
print("res:::", response.text)

# 拓展
url = "https://ks.wangxiao.cn/TestPaper/getPaperRuleQuestions"
data = {
    "id": "DE66B073-F36A-4B44-A4F5-4761C9B81583"
    }
 
cookies2 = {
    'mantis6894': 'fde487ed71dd45eda7da98e617ed00cb@6894',
    'autoLogin': 'null',
    'userInfo': '%7B%22userName%22%3A%22pc_154531469%22%2C%22token%22%3A%22b5a9ff61-6a51-44f3-9bae-81b1fa63987c%22%2C%22headImg%22%3Anull%2C%22nickName%22%3A%22153****5323%22%2C%22sign%22%3A%22fangchan%22%2C%22isBindingMobile%22%3A%221%22%2C%22isSubPa%22%3A%220%22%2C%22userNameCookies%22%3A%22RMueSgKKnUbincC%2Br9rR4w%3D%3D%22%2C%22passwordCookies%22%3A%22oy%2BfBUYDZTZFTjU9C7d6VA%3D%3D%22%7D',
    'token': 'b5a9ff61-6a51-44f3-9bae-81b1fa63987c',
    'UserCookieName': 'pc_154531469',
    'OldUsername2': 'RMueSgKKnUbincC%2Br9rR4w%3D%3D',
    'OldUsername': 'RMueSgKKnUbincC%2Br9rR4w%3D%3D',
    'OldPassword': 'oy%2BfBUYDZTZFTjU9C7d6VA%3D%3D',
    'UserCookieName_': 'pc_154531469',
    'OldUsername2_': 'RMueSgKKnUbincC%2Br9rR4w%3D%3D',
    'OldUsername_': 'RMueSgKKnUbincC%2Br9rR4w%3D%3D',
    'OldPassword_': 'oy%2BfBUYDZTZFTjU9C7d6VA%3D%3D',
    'pc_154531469_exam': 'fangchan',
}

res_fin = requests.post(url, data=json.dumps(data), cookies=cookies, headers=headers,)
print(res_fin.text)
posted @ 2024-10-25 17:08  流年中渲染了微笑  阅读(0)  评论(0)    收藏  举报