youku ckey 阿里140分析

声明:
本文章中所有内容仅供学习交流使用，不用于其他任何目的，抓包内容、敏感网址、数据接口等均已做脱敏处理，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关！

请求获得h5tk和h5tkenc

将_m_h5_tk通过split可以获得token和时间。sign应该是md5加密我直接扣的代码具体是token + "&" + s (时间)+ "&" + appid + "&" + data通过md5加密。这样第一步就完成了。1.获取Cookie数据和Sign。

py部分代码

import json
import os
import re
import time
import concurrent.futures
import execjs
import requests
import subprocess
session=requests.session()
cp=execjs.compile(open('优酷ckey.js','r',encoding='gbk',errors='ignore').read())
cookies = {}

headers = {
    'Accept': 'application/json',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    'Cache-Control': 'no-cache',
    'Connection': 'keep-alive',
    'Content-type': 'application/x-www-form-urlencoded',
    'Sec-Fetch-Dest': 'empty',
    'Sec-Fetch-Mode': 'cors',
    'Sec-Fetch-Site': 'same-site',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0',
    'sec-ch-ua': '"Not_A Brand";v="8", "Chromium";v="120", "Microsoft Edge";v="120"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"Windows"',
}
data='{"touch_point_code":"play_bar","device_id":"1","cna":"empty_cna","ext_map":"{\\"showId\\":\\"567140\\",\\"videoId\\":\\"1561752624\\"}"}'
cp.call('getSign',data)
params = {
    'jsv': '2.6.1',
    'appKey': '24679788',
    't': '1706930214015',
    'sign': '0a35af82d1d0a76d72a1eebcdffc06a2',
    'api': '',
    'type': 'originaljson',
    'v': '1.0',
    'ecode': '1',
    'dataType': 'json',
    'data': data,
}
response = session.get(
     url,
    params=params,
    cookies=cookies,
    headers=headers,
)

print(response.cookies)
token=cookies['_m_h5_tk']=response.cookies.get('_m_h5_tk')
cookies['_m_h5_tk_enc']=response.cookies.get('_m_h5_tk_enc')
cookies['mtop_partitioned_detect']=response.cookies.get('mtop_partitioned_detect')
ckey=cp.call("getData")
old_time='1706930214'
data=data.replace(old_time,str(int(time.time())))
result=cp.call("getSign",data,token)
print(new_ckey)
params = {
    'jsv': '2.6.1',
    'appKey': '24679788',
    't': result['t'],
    'sign': result['sign'],
    'api': '',
    'v': '1.1',
    'timeout': '15000',
    'AntiFlood': 'true',
    'AntiCreep': 'true',
    'type': 'jsonp',
    'dataType': 'jsonp',
    'callback': 'mtopjsonp1',
    'data': data,
}

response = session.get(
    url,
    params=params,
    cookies=cookies,
    headers=headers,
)
print(response.text)

补环境部分代码

window.Document=function Document(){
    throw new TypeError(' Illegal constructor')
}
window.attachEvent=function attachEvent(){
    console.log('window.attachEvent',arguments)
}
Object.defineProperties(window.Document.prototype,{
    [Symbol.toStringTag]:{
        value:'Document',
        configurable:true
    }
})
document = {
    visibilityState: 'visible',
    hidden: false,
    body:{},
    documentElement:{},
}
document.__proto__=window.Document.prototype
document.referrer='https://so.youku.com/search_video/q_%E5%89%91%E5%9F%9F%E9%A3%8E%E4%BA%91?searchfrom=3',
document.hasFocus = function hasFocus(val) {
    console.log('document.hasFocus', arguments)
    return false
}
window.toString=function toString(){
    return '[object Window]'
}
window.PerformanceEntry = function PerformanceEntry() {
    console.log('window.PerformanceEntry', arguments)
}
window.addFetchFilter = function addFetchFilter() {
    console.log('window.addFetchFilter', arguments)
}
window.DSJPLUGJS_VERSION = undefined
document.querySelector = function querySelector(v) {
    console.log('document.querySelector', arguments)
    if (v != null) {
        return null
    }
    return {
        bind: function bind(val) {
            console.log('document.querySelector.bind', val)
        }
    }

}

结果

总结 

1.出于安全考虑,本章未提供完整流程,调试环节省略较多,只提供大致思路,具体细节要你自己还原,相信你也能调试出来。