看了一圈发现返回值被加密但是我们看不懂不知道这几个返回值是干什么用的还得逆向如上图点击这里进去看返回值如上图进来之后发现这里就是返回值的位置看看他是怎末处理的他先用k和v生成了j再用j去匹配出想要的我们首先要求j_key经检查hex_md5就是标准的md5直接用就行所以js代码直接照搬如上图 如下代码constcryptorequire(crypto);md5function(str){letscrypto.createHash(md5).update(str).digest(hex);returns;}functionencrypt(key,value){letj_key.md5(btoa(keyvalue).replace(//g,));returnj_key.split(.)[1];}miencrypt(Ip8Iki3grF,b12hgw8ztI);console.log(mi)现在我们不知道是要匹配什么但是可以明显的猜到匹配的是返回值里的info我们先发一下请求匹配一下看看如下代码importrequestsimportexecjs sessionrequests.Session()defget_flag(key,value):fopen(04.js,r,encodingutf-8)js_codef.read()f.close()jsexecjs.compile(js_code)mjs.call(encrypt,key,value)returnmdefmain(page):urlfhttps://match.yuanrenxue.cn/api/question/4?page{page}pageSize10kwheaders{accept:application/json, text/javascript, */*; q0.01,accept-encoding:gzip, deflate, br, zstd,accept-language:zh-CN,zh;q0.9,cache-control:no-cache,cookie:Hm_lvt_434c501fe98c1a8ec74b813751d4e3e31779001012; sessionidpfbaql9kj35r40sh0blqriu4ua713fs4; Hm_lvt_f80b2b389f44bbfb3bfe1704817d44e01779860838,1780122825,1780267813,1780731259; HMACCOUNT316FD8398D3BEA37; Hm_lpvt_f80b2b389f44bbfb3bfe1704817d44e01780739241,pragma:no-cache,priority:u1, i,referer:https://match.yuanrenxue.cn/match/4,sec-ch-ua:Not/A)Brand;v99, Chromium;v148,sec-ch-ua-mobile:?0,sec-ch-ua-platform:Windows,sec-fetch-dest:empty,sec-fetch-mode:cors,sec-fetch-site:same-origin,user-agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36,x-requested-with:XMLHttpRequest}ifpage5:headers[user-agent]yuanrenxueressession.get(url,headersheaders)txtres.json().get(info)kres.json().get(key)vres.json().get(value)flagget_flag(k,v)print(flag,txt)if__name____main__:main(1)我把返回的info放入了HTML里有助于观察这是发了一次请求拿的一页数据有多个td标签每一个td标签下面都有多个img标签可以猜到每一个td标签是一个数每一个img是组成数的数字但是每一个td下的img标签和页面显示的位数不相等如果去掉img_number为j_key的就相等了下图的displaynone刚好证实了这一点其实返回的就是这里的标签用返回图像的base去识别数字发现数字的顺序和展示的顺序不同原因是标签里的style的值0表示不用动负数表示需要向做偏移正数需要向右偏移数越大偏移越多到此位置此题就解完了整体代码如下importrequestsimportddddocrimportexecjsimportre sessionrequests.Session()defget_flag(key,value):fopen(04.js,r,encodingutf-8)js_codef.read()f.close()jsexecjs.compile(js_code)mjs.call(encrypt,key,value)returnmdefget_num(url):baseurl.split(,)[-1].split( class)[0]ocrddddocr.DdddOcr(betaTrue,show_adFalse)# 实例化 ddddocr 对象textocr.classification(base)# 图像识别returntextdeforder_sum(arr):sum0tmp[]fori,iteminenumerate(arr):new_posiint(item[1])tmp.append((new_pos,item))# 按新位置排序tmp.sort(keylambdax:x[0])new[itemfor_,itemintmp]foriteminnew:sumsum*10item[0]returnsumdefmain(page):sum0urlfhttps://match.yuanrenxue.cn/api/question/4?page{page}pageSize10kwheaders{accept:application/json, text/javascript, */*; q0.01,accept-encoding:gzip, deflate, br, zstd,accept-language:zh-CN,zh;q0.9,cache-control:no-cache,cookie:Hm_lvt_434c501fe98c1a8ec74b813751d4e3e31779001012; sessionidpfbaql9kj35r40sh0blqriu4ua713fs4; Hm_lvt_f80b2b389f44bbfb3bfe1704817d44e01779860838,1780122825,1780267813,1780731259; HMACCOUNT316FD8398D3BEA37; Hm_lpvt_f80b2b389f44bbfb3bfe1704817d44e01780739241,pragma:no-cache,priority:u1, i,referer:https://match.yuanrenxue.cn/match/4,sec-ch-ua:Not/A)Brand;v99, Chromium;v148,sec-ch-ua-mobile:?0,sec-ch-ua-platform:Windows,sec-fetch-dest:empty,sec-fetch-mode:cors,sec-fetch-site:same-origin,user-agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36,x-requested-with:XMLHttpRequest}ifpage5:headers[user-agent]yuanrenxueressession.get(url,headersheaders)txtres.json().get(info)kres.json().get(key)vres.json().get(value)flagget_flag(k,v)obj1re.compile(rtd(?PNum.*?)/td)obj2re.compile(rimg src(?Pnum.*?) styleleft:(?Pstyle.*?)px)result1obj1.finditer(txt)forjinresult1:arr[]result2obj2.finditer(j.group(Num))forkinresult2:uk.group(num)sfloat(k.group(style))//8.5ifflaginu:continuenget_num(u)arr.append([int(n),s])# print(arr)sumorder_sum(arr)print(page,sum)returnsumif__name____main__:result0foriinrange(1,6):resultmain(i)print(result)
看了一圈发现返回值被加密但是我们看不懂不知道这几个返回值是干什么用的还得逆向如上图点击这里进去看返回值如上图进来之后发现这里就是返回值的位置看看他是怎末处理的他先用k和v生成了j再用j去匹配出想要的我们首先要求j_key经检查hex_md5就是标准的md5直接用就行所以js代码直接照搬如上图 如下代码constcryptorequire(crypto);md5function(str){letscrypto.createHash(md5).update(str).digest(hex);returns;}functionencrypt(key,value){letj_key.md5(btoa(keyvalue).replace(//g,));returnj_key.split(.)[1];}miencrypt(Ip8Iki3grF,b12hgw8ztI);console.log(mi)现在我们不知道是要匹配什么但是可以明显的猜到匹配的是返回值里的info我们先发一下请求匹配一下看看如下代码importrequestsimportexecjs sessionrequests.Session()defget_flag(key,value):fopen(04.js,r,encodingutf-8)js_codef.read()f.close()jsexecjs.compile(js_code)mjs.call(encrypt,key,value)returnmdefmain(page):urlfhttps://match.yuanrenxue.cn/api/question/4?page{page}pageSize10kwheaders{accept:application/json, text/javascript, */*; q0.01,accept-encoding:gzip, deflate, br, zstd,accept-language:zh-CN,zh;q0.9,cache-control:no-cache,cookie:Hm_lvt_434c501fe98c1a8ec74b813751d4e3e31779001012; sessionidpfbaql9kj35r40sh0blqriu4ua713fs4; Hm_lvt_f80b2b389f44bbfb3bfe1704817d44e01779860838,1780122825,1780267813,1780731259; HMACCOUNT316FD8398D3BEA37; Hm_lpvt_f80b2b389f44bbfb3bfe1704817d44e01780739241,pragma:no-cache,priority:u1, i,referer:https://match.yuanrenxue.cn/match/4,sec-ch-ua:Not/A)Brand;v99, Chromium;v148,sec-ch-ua-mobile:?0,sec-ch-ua-platform:Windows,sec-fetch-dest:empty,sec-fetch-mode:cors,sec-fetch-site:same-origin,user-agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36,x-requested-with:XMLHttpRequest}ifpage5:headers[user-agent]yuanrenxueressession.get(url,headersheaders)txtres.json().get(info)kres.json().get(key)vres.json().get(value)flagget_flag(k,v)print(flag,txt)if__name____main__:main(1)我把返回的info放入了HTML里有助于观察这是发了一次请求拿的一页数据有多个td标签每一个td标签下面都有多个img标签可以猜到每一个td标签是一个数每一个img是组成数的数字但是每一个td下的img标签和页面显示的位数不相等如果去掉img_number为j_key的就相等了下图的displaynone刚好证实了这一点其实返回的就是这里的标签用返回图像的base去识别数字发现数字的顺序和展示的顺序不同原因是标签里的style的值0表示不用动负数表示需要向做偏移正数需要向右偏移数越大偏移越多到此位置此题就解完了整体代码如下importrequestsimportddddocrimportexecjsimportre sessionrequests.Session()defget_flag(key,value):fopen(04.js,r,encodingutf-8)js_codef.read()f.close()jsexecjs.compile(js_code)mjs.call(encrypt,key,value)returnmdefget_num(url):baseurl.split(,)[-1].split( class)[0]ocrddddocr.DdddOcr(betaTrue,show_adFalse)# 实例化 ddddocr 对象textocr.classification(base)# 图像识别returntextdeforder_sum(arr):sum0tmp[]fori,iteminenumerate(arr):new_posiint(item[1])tmp.append((new_pos,item))# 按新位置排序tmp.sort(keylambdax:x[0])new[itemfor_,itemintmp]foriteminnew:sumsum*10item[0]returnsumdefmain(page):sum0urlfhttps://match.yuanrenxue.cn/api/question/4?page{page}pageSize10kwheaders{accept:application/json, text/javascript, */*; q0.01,accept-encoding:gzip, deflate, br, zstd,accept-language:zh-CN,zh;q0.9,cache-control:no-cache,cookie:Hm_lvt_434c501fe98c1a8ec74b813751d4e3e31779001012; sessionidpfbaql9kj35r40sh0blqriu4ua713fs4; Hm_lvt_f80b2b389f44bbfb3bfe1704817d44e01779860838,1780122825,1780267813,1780731259; HMACCOUNT316FD8398D3BEA37; Hm_lpvt_f80b2b389f44bbfb3bfe1704817d44e01780739241,pragma:no-cache,priority:u1, i,referer:https://match.yuanrenxue.cn/match/4,sec-ch-ua:Not/A)Brand;v99, Chromium;v148,sec-ch-ua-mobile:?0,sec-ch-ua-platform:Windows,sec-fetch-dest:empty,sec-fetch-mode:cors,sec-fetch-site:same-origin,user-agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36,x-requested-with:XMLHttpRequest}ifpage5:headers[user-agent]yuanrenxueressession.get(url,headersheaders)txtres.json().get(info)kres.json().get(key)vres.json().get(value)flagget_flag(k,v)obj1re.compile(rtd(?PNum.*?)/td)obj2re.compile(rimg src(?Pnum.*?) styleleft:(?Pstyle.*?)px)result1obj1.finditer(txt)forjinresult1:arr[]result2obj2.finditer(j.group(Num))forkinresult2:uk.group(num)sfloat(k.group(style))//8.5ifflaginu:continuenget_num(u)arr.append([int(n),s])# print(arr)sumorder_sum(arr)print(page,sum)returnsumif__name____main__:result0foriinrange(1,6):resultmain(i)print(result)
