携程旅行机票 token 滑块 图标点选双重验证 分析

声明:
本文章中所有内容仅供学习交流使用，不用于其他任何目的，抓包内容、敏感网址、数据接口等均已做脱敏处理，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关！

数据集自备，或者打码。

分析过程

"aHR0cHM6Ly9pYy5jdHJpcC5jb20vY2FwdGNoYS92NC9yZWZyZXNoX2ppZ3Nhdw=="

 "J2h0dHBzOi8vaWMuY3RyaXAuY29tL2NhcHRjaGEvdjQvdmVyaWZ5X2ppZ3Nhdyc="

"Imh0dHBzOi8vZmxpZ2h0cy5jdHJpcC5jb20vaW50ZXJuYXRpb25hbC9zZWFyY2gvYXBpL2F1dGhjb2RlL3ZlcmlmeVBpY0F1dGhDb2RlIg=="

"Imh0dHBzOi8vaWMuY3RyaXAuY29tL2NhcHRjaGEvdjQvdmVyaWZ5X2ljb24i"

请求的url如上。

主要代码

function sliderVerify(x,track1,track2,totalTime,extend_param,dimensions,token,rid){
    info={}
    var _0x21e43f = __0x5139b8(window['__sJSON']['stringify'](info), 0x0)
   var _0x39072d = 'appid=100008370&business_site=search_airticketscivil_online_pic&version=2.0.20' + '&verify_msg=' + _0x21e43f + '&dimensions=' + dimensions + '&extend_param=' + extend_param + '&token=' + token + '&captcha_type=' + 'JIGSAW'
    sign=window['__CryptoJS']['MD5'](_0x39072d).toString()
    return {
                'appid': '100008370',
                'business_site': 'search_airticketscivil_online_pic',
                'token':token,
                'rid': rid,
                'version':'2.0.20',
                'verify_msg':_0x21e43f,
                'dimensions': dimensions,
                'extend_param': extend_param,
                'sign': sign
            }

}
function verifyPoint(trace,points,dimensions,rid,token){
    _0x2f7496={

}
preIconSlidingTrack=[]
_0x2f7496['preIconClickTrack'] = preIconSlidingTrack

// _0x5c81a0=[trace]
_0x5c81a0=[]
_0x2f7496['iconClickTrack']=_0x5c81a0['join']('&')
_0x206936={
    "resolution_width": 1536,
    "resolution_height": 864,
    "language": ""
}
_0x184a86 = __0x5139b8(window['__sJSON']['stringify'](_0x206936), 0x0)
  _0x2f7496['inputStartTs'] = Date.now() - 1234
_0x2f7496['inputEndTs'] = Date.now()
_0x2f7496['inputTime'] = _0x2f7496['inputEndTs'] -  _0x2f7496['inputStartTs']
_0x391c88 = [];
_0x46b174=[]
for (var _0x4fcf7d = 0x0; _0x4fcf7d < _0x5c81a0['length']; _0x4fcf7d++) {
                _0x391c88[_0x4fcf7d] = [];
                var _0x514806 =window['__sJSON']['parse'](_0x5c81a0[_0x4fcf7d]);
                for (var _0x2426eb = 0x0; _0x2426eb < _0x514806['length']; _0x2426eb++) {
                    _0x391c88[_0x4fcf7d]['push']({
                        'x': _0x514806[_0x2426eb]['x'],
                        'y': _0x514806[_0x2426eb]['y']
                    });
                }
                _0x391c88[_0x4fcf7d] = window['__sJSON']['stringify'](_0x391c88[_0x4fcf7d]);
            }
var _0x515b62 = [];
_0x5ce5d0=[
     {
        "key": 1,
        "value": {},
        "coordinate":points[0]
    },
     {
        "key": 2,
        "value": {},
        "coordinate":points[1]
    },
     {
        "key": 3,
        "value": {},
        "coordinate": points[2]
    }]
_0x5ce5d0['forEach'](function(_0x308bdc) {
                _0x515b62 = _0x515b62['concat'](_0x308bdc['coordinate']);
})
_0x2f7496['value'] = _0x515b62;
var _0x835810 = __0x5139b8(window['__sJSON']['stringify'](_0x2f7496), 0x0);
  _0x184f6e = window['__CryptoJS']['MD5']('appid=' + "" +'&business_site=' + 's' +
      '&version=' + '' + '&verify_msg=' + _0x835810 + '&dimensions=' + dimensions + '&extend_param=' + _0x184a86 +
      '&token=' + token + '&captcha_type=' + 'ICON')
_0x5c81a0 = []
_0x46b174 = []
_0x30bdf8 = ![]
_0x7e8b37 = ![]
result= {
                'appid': '',
                'token': token,
                'rid': rid,
                'business_site':"",
                'version': '',
                'verify_msg': _0x835810,
                'dimensions': dimensions,
                'extend_param': _0x184a86,
                'sign': _0x184f6e['toString']()
            }
            return result
}

结果

样本不是很多成功率只有一半。增加标注量可解决。

总结

1.出于安全考虑,本章未提供完整流程,调试环节省略较多,只提供大致思路,具体细节要你自己还原,相信你也能调试出来。