request请求方式登录操作Oray蒲公英路由

需要利用蒲公英路由压测，但在待机一段时间后web主界面输入密码进入后闪退

考虑用request请求的方式来实现登录，重启路由器，修改路由器参数配置

登录窗口

第一步：分析http请求

在F12查看network请求时，有两个info，

第一个info status提示302 Found，应该是重定向了，这次请求返回的stok值和cookie值都是之后发请求所需要的，需要在脚本中进行保存。

比较方便的是，oray在传输数据时，payload会直接显示password字符串，不像之前接触的360 小米路由对输入的密码用js脚本进行加密，整个分析流程快了很多

第二个info

应该是重定向到了第二个info，此时点击查看第二个info，request url上用到的就是第一个info response的stok和cookie

第二步：python脚本实现

登录流程明确以后，就开始用python脚本实现

request中的post方法会默认allow_redirects=True，自动跳转到重定向的url。最后status_code返回了200，而不是302，说明直接重定向到了第二个info请求的位置

这里可以选择allow_redirects=False，或者allow_redirects=True，直接获取第二个info的结果。我选择第一种方式

login_url = "http://192.168.1.14/cgi-bin/orayboxmgr/admin/system/info"
login_data = {
    "username": "oray",
    "password": "AAbbcc123"
}
res = requests.post(url=login_url,data=login_data,allow_redirects=False)

配置路由器

先访问login_url来获取stok值和cookies值，作为参数传给第二个请求地址，data中包含需要设置的信道、加密方式等参数

import requests

login_url = "http://192.168.1.14/cgi-bin/orayboxmgr/admin/system/info"
login_data = {
    "username": "oray",
    "password": "AAbbcc123"
}

headers = {
  "Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
    "Accept-Encoding":"gzip, deflate",
    "Accept-Language":"zh-CN,zh;q=0.9",
    "Connection":"keep-alive",
    "Content-Length":"220",
    "Content-Type":"application/x-www-form-urlencoded",
    "Host":"192.168.1.14",
    "Origin":"http://192.168.1.14",
    "Referer":"http://192.168.1.14/cgi-bin/orayboxmgr/admin/system/info",
    "Upgrade-Insecure-Requests":"1",
    "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
}

log_res = requests.post(url=login_url,data=login_data,allow_redirects=False)
print(log_res.headers.get("Set-Cookie"))
print(f"sysauth is {cookie}")
#返回的cookie信息如下sysauth=3d430fb3b89ef8a019acb515089589e5; path=/cgi-bin/orayboxmgr/, sysauth=3d430fb3b89ef8a019acb515089589e5; path=/
#/cgi-bin/orayboxmgr/;stok=ab1c363fa528de5a5dbd57c31ebcbe4e/admin/system/info
stok = res.headers.get("Location").split("=")[1].split("/")[0]
print(stok)
data = {
    "not_restart_net": "1",
    "is_restart_wifi": "0",
    "dev": "2.4G",
    "switch": "1",
    "htmode": "HT40",
    "level": "3",
    "channel": "11",
    "ssid_list": '[{"ssid":"OrayBox","hidden":0,"auth":"WPA-PSK","encrypt":"AUTO","pwd":"123456789","isolation":"0"},{},{},{}]',
}
#auth（加密方式）WPA—PSK，WPA2-PSK，
url = "http://192.168.1.14/cgi-bin/oraybox?_api=wifi_set"
headers = {
 "Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
    "Accept-Encoding":"gzip, deflate",
    "Accept-Language":"zh-CN,zh;q=0.9",
    "Connection":"keep-alive",
    "Content-Length":"220",
    "Content-Type":"application/x-www-form-urlencoded",
    "Cookie":f"sysauth={cookie}",
    "Host":"192.168.1.14",
    "Origin":"http://192.168.1.14",
    "Referer":f"http://192.168.1.14/cgi-bin/orayboxmgr/;stok={stok}/admin/network/wifi2g",
    "Upgrade-Insecure-Requests":"1",
    "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
}
src = requests.post(url=url,data=data,headers=headers)
print(src.status_code)

重启

先完成了参数配置，重启的功能请求之后再添加一下

后面还有几台路由器有空也扒出来看看