数美滑块验证码是一种常见的安全验证方式,用于防止自动化脚本和机器人进行恶意操作。本文将详细介绍如何通过抓包获取滑块图片信息、分析加密参数、生成滑动轨迹等步骤,成功破解数美滑块验证码。以下是我们要实现的主要步骤:
抓取滑块图片信息并计算滑动距离
分析加密参数
生成滑动轨迹并进行DES加密
验证破解结果
1. 抓取滑块图片信息并计算滑动距离
首先,进入数美滑块验证码的演示页面,进行抓包操作以获取滑块验证码的前景和背景图片。我们通过fetch从网站获取图片:
javascript
const fetch = require('node-fetch');
const cv = require('opencv4nodejs');
async function getImages(registerUrl) {
const response = await fetch(registerUrl, { method: 'POST', body: '{}' });
const data = await response.json();
const fgUrl = data.fg; // 假设返回JSON包含前景和背景图片URL
const bgUrl = data.bg;
const fgResponse = await fetch(fgUrl);
const bgResponse = await fetch(bgUrl);
const fgBuffer = await fgResponse.buffer();
const bgBuffer = await bgResponse.buffer();
return { fgBuffer, bgBuffer };
}
接下来,我们使用opencv4nodejs库计算滑块需要滑动的距离:
javascript
function getDistance(fgBuffer, bgBuffer) {
const target = cv.imdecode(fgBuffer);
const template = cv.imdecode(bgBuffer);
const matched = target.matchTemplate(template, cv.TM_CCORR_NORMED);
const minMax = matched.minMaxLoc();
const distance = minMax.maxLoc.x;
return distance;
}
2. 分析加密参数
在滑动滑块的过程中,我们需要分析加密参数。抓包查看请求信息,可以看到有一个fverify的验证信息。如果正确的话,riskLevel返回值为PASS,失败为REJECT。
通过在浏览器中设置断点,我们可以找到参数aw等的生成函数,并确定这些参数的加密方式。使用断点调试后,发现是通过DES加密。
以下是通过crypto-js库实现DES加密的示例代码:
javascript
const CryptoJS = require('crypto-js');
function pad(data) {
const blockSize = 8;
const paddingSize = blockSize - (data.length % blockSize);
return data + '\0'.repeat(paddingSize);
}
function encryptContent(message, key, flag) {
const paddedMessage = pad(message.replace(/\s+/g, ''));
const keyHex = CryptoJS.enc.Utf8.parse(key);
if (flag) {
const encrypted = CryptoJS.DES.encrypt(paddedMessage, keyHex, {
mode: CryptoJS.mode.ECB,
padding: CryptoJS.pad.NoPadding
});
return encrypted.toString();
} else {
const decrypted = CryptoJS.DES.decrypt(message, keyHex, {
mode: CryptoJS.mode.ECB,
padding: CryptoJS.pad.NoPadding
});
return decrypted.toString(CryptoJS.enc.Utf8);
}
}
3. 生成滑动轨迹并进行DES加密
滑动轨迹可以通过模拟人的滑动行为来生成,包括一些随机的抖动和速度变化。以下是生成滑动轨迹的示例代码:
javascript
function getRandom(distance) {
const track = [[0, 0, 0]];
for (let i = 0; i < 10; i++) {
const x = 0;
const y = Math.floor(Math.random() * 3) - 1;
const t = 100 * (i + 1) + Math.floor(Math.random() * 3);
track.push([x, y, t]);
}
for (let i = 1; i < track.length - 5; i++) {
track[i][0] = Math.floor(distance / 2);
}
for (let i = track.length - 5; i < track.length - 1; i++) {
track[i][0] = distance + Math.floor(Math.random() * 4);
}
track[track.length - 1][0] = distance;
return JSON.stringify(track), track[track.length - 1][2];
}
4. 验证破解结果 更多内容联系1436423940
最后,结合前面的步骤,实现滑块破解。以下是完整的示例代码:
javascript
const fetch = require('node-fetch');
const CryptoJS = require('crypto-js');
const cv = require('opencv4nodejs');
async function main() {
const registerUrl = "https://www.ishumei.com/trial/captcha.html";
const { fgBuffer, bgBuffer } = await getImages(registerUrl);
const distance = getDistance(fgBuffer, bgBuffer);
const [nm, dy] = getRandom(distance);
// 假设已经获取了必要的key和flag
const key = "your_key_here";
const flag = true;
const encryptedNm = encryptContent(nm, key, flag);
const encryptedDy = encryptContent(dy.toString(), key, flag);
const verifyData = {
nm: encryptedNm,
dy: encryptedDy,
rid: "register_id_here",
dl: distance
};
const response = await fetch("https://www.ishumei.com/trial/fverify", {
method: 'POST',
body: JSON.stringify(verifyData),
headers: { 'Content-Type': 'application/json' }
});
const result = await response.json();
if (result.riskLevel === "PASS") {
console.log("验证成功");
} else {
console.log("验证失败");
}
}
main();