阿里140滑块分析 聚名网

声明

本文章中所有内容仅供学习交流使用，不用于其他任何目的，抓包内容、敏感网址、数据接口等均已做脱敏处理，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关！

分析

触发流程

a=new noCaptcha({
    "renderTo": "#passwordSlider",
    "appkey": "FFFF0N0N000000008364",
    "scene": "nc_login",
    "token": "FFFF0N0N000000008364:1722861547444:0.7308612705223763",
    "customWidth": 340,
    "trans": {
        "key1": "code0"
    },
    "elementID": [
        "passwordSlider"
    ],
    "is_Opt": 0,
    "language": "cn",
    "isEnabled": true,
    "timeout": 3000,
    "times": 5,
    "apimap": {}
})
a.reload()
a.reset()
a.upLang("cn", {
                        _startTEXT: "请按住滑块，拖动到最右边",
                        _yesTEXT: "验证通过",
                        _error300: '哎呀，出错了，点击<a href="javascript:__nc.reset()">刷新</a>再来一次',
                        _errorNetwork: '网络不给力，请<a href="javascript:__nc.reset()">点击刷新</a>'
})

执行事务方法

count=1;
document.addEventListener=function(val1,val2,val3){
    if(val1=='mousemove' && count == 1){
        val1(mouseMoveData)
    }
    if(val2=='mousedown'){
        val1(mouseDownData)
    }
    if(val2=='mouseup'){
        val2(mouseUpData1)
    }
}

调用链路分析

import json
import re

import requests

session=requests.session()
headers = {
    "accept": "application/json, text/javascript, */*; q=0.01",
    "accept-language": "zh-CN,zh;q=0.9",
    "cache-control": "no-cache",
    "content-type": "application/x-www-form-urlencoded; charset=UTF-8",
    "pragma": "no-cache",
    "priority": "u=1, i",
    "sec-ch-ua": "\"Not)A;Brand\";v=\"99\", \"Microsoft Edge\";v=\"127\", \"Chromium\";v=\"127\"",
    "sec-ch-ua-mobile": "?0",
    "sec-ch-ua-platform": "\"Windows\"",
    "sec-fetch-dest": "empty",
    "sec-fetch-mode": "cors",
    "sec-fetch-site": "same-origin",
    "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0",
    "x-requested-with": "XMLHttpRequest"
}
cookies = {}
data=requests.get("http://localhost:3000/get227").json()
n=data['140']

url = ""
token="FFFF0N000000000087DE:1722872631144:0.8386373516987531"
params = {
    "a": "FFFF0N000000000087DE",
    "t": "FFFF0N000000000087DE:1722872631144:0.8386373516987531",
    "n": n,
    "p": "{\"key1\":\"code0\",\"ncSessionID\":\"6700a296a179\",\"umidToken\":\"T2gA0FmfThMkq14SUs48D2xmlT7WLFn2n1vP0GB6wegrPGWQCXNSsan--682mkWfauA=\"}",
    "scene": "nc_login",
    "asyn": "0",
    "lang": "cn",
    "v": "1099",
    "callback": "jsonp_03580335480038517"
}
response = session.get(url, headers=headers, cookies=cookies, params=params)


data=json.loads(re.findall('\{.*\}',response.text)[0])['result']
csessionid=data["csessionid"]
value=data["value"]
print(csessionid)
print(value)
url = "https://www.juming.com/reg/tj_list"
data = {
    "token": token,
    "sid": csessionid,
    "sig": value
}
response = session.post(url, headers=headers, cookies=cookies, data=data)
url = ""
data = {
    "csrf_token": "hWfuo4HJ8U8IOXLE",
    "ym": "www",
    "hz": ""
}
response = session.post(url, headers=headers, cookies=cookies, data=data)

print(response.text)
print(response)

结果

总结

1.出于安全考虑,本章未提供完整流程,调试环节省略较多,只提供大致思路,具体细节要你自己还原,相信你也能调试出来。