百度某查旋转验证逆向

地址百度旋转验证

查看重定向的url,获取as, ds, tk 三个值

获取旋转的原图 和 backstr 的值

旋转验证参数提交，dbug 调试参数跟进, 跟进来后发现重点在 r.rzData

控制台打印 r.raData, 点击进入函数

在r.rzData中ac_c是检测的关键，ac_c=round((o / 212),2)，而o是滑动的距离，o=angle*212/360 （angle）是识别的角度。然后backstr是前面返回的，其他的所有参数都可固定，包括轨迹fs是对r.rzData进行aes加密的结果（key是ac+'appsapi0'）

重写js文件

var CryptoJS = require('crypto-js');

function encrypt_(angle, as, backstr) {
    var tt = {
        "cl": [
            {
                "x": 862,
                "y": 287,
                "t": 1657760616916
            }
        ],
        "mv": [
            {
                "fx": 987,
                "fy": 149,
                "t": 1657760613905,
                "bf": 2
            },
            {
                "fx": 979,
                "fy": 370,
                "t": 1657760615529,
                "bf": 2
            },
            {
                "fx": 948,
                "fy": 339,
                "t": 1657760615688,
                "bf": 2
            },
            {
                "fx": 911,
                "fy": 321,
                "t": 1657760615848,
                "bf": 2
            },
            {
                "fx": 892,
                "fy": 309,
                "t": 1657760616008,
                "bf": 2
            },
            {
                "fx": 880,
                "fy": 299,
                "t": 1657760616176,
                "bf": 2
            },
            {
                "fx": 869,
                "fy": 290,
                "t": 1657760616440,
                "bf": 2
            },
            {
                "fx": 864,
                "fy": 288,
                "t": 1657760616641,
                "bf": 2
            },
            {
                "fx": 862,
                "fy": 287,
                "t": 1657760616866,
                "bf": 2
            },
            {
                "fx": 864,
                "fy": 288,
                "t": 1657760617026,
                "bf": 1
            },
            {
                "fx": 877,
                "fy": 293,
                "t": 1657760617186,
                "bf": 1
            },
            {
                "fx": 882,
                "fy": 295,
                "t": 1657760617360,
                "bf": 1
            },
            {
                "fx": 891,
                "fy": 298,
                "t": 1657760617537,
                "bf": 1
            },
            {
                "fx": 900,
                "fy": 300,
                "t": 1657760617688,
                "bf": 1
            },
            {
                "fx": 908,
                "fy": 301,
                "t": 1657760617864,
                "bf": 1
            },
            {
                "fx": 910,
                "fy": 301,
                "t": 1657760618585,
                "bf": 1
            }
        ],
        "sc": [],
        "kb": [
            {
                "key": "a",
                "t": 1657760606047
            }
        ],
        "sb": [],
        "sd": [],
        "sm": [],
        "cr": {
            "screenTop": 0,
            "screenLeft": 0,
            "clientWidth": 1920,
            "clientHeight": 979,
            "screenWidth": 1920,
            "screenHeight": 1080,
            "availWidth": 1920,
            "availHeight": 1050,
            "outerWidth": 1920,
            "outerHeight": 1050,
            "scrollWidth": 1920,
            "scrollHeight": 1920
        },
        "simu": 0,
        "ac_c": (angle * 212 / 360 / 212).toFixed(2),
        "backstr": backstr
    };
    var t = as + 'appsapi0'
        , n = CryptoJS.enc.Utf8.parse(t)
        , i = CryptoJS.enc.Utf8.parse(JSON.stringify(tt))
        , r = CryptoJS.AES.encrypt(i, n, {
        mode: CryptoJS.mode.ECB,
        padding: CryptoJS.pad.Pkcs7
    });
    return [r.toString(), tt['ac_c']];
}


// console.log(encrypt_('175','77af72b4','3665-Px4DcLoit3uVe824uBkHUhYlQRP9J1snLUo3oUo4NCni3QAeNyHrm3CQYE1d0+bG4z2Vv/PQXdv1Qp9j+bImhNo+yvQeYZjOGBVq/fJYQARPO+z357jr0N2VdtJR6PLV/ZF/4vWSekHq0V0F9PvNX4E9FL+bBVTtveoWXlDB3zxsr30wdtMey7lw/HDDDKm05KTU72MoN+B2g6pXkXJLfwXeK557yhbIgeqaUUxYRgI46RjrwoF1Em3LISq+4Ke5TIyH89awQ6ups+DSlxyJZbU/WxmL6wSrpxmVpQ0rYrwgtgO8yAPCE2myWZ7uQnMkWTnNNBThHZHALC3YA4xWkA=='))

调用旋转模型，整体代码

from urllib.parse import unquote
import requests
import execjs
import time
import json
import re
import urllib3
from baidu_aiqicha_rotate.rotate_captcha import fun_get_angle_
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class BaiduAiqichaRotate:

    def __init__(self):
        self.session = requests.session()
        self.headers = {
            'Accept': 'text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, '
                      '*/*; q=0.01',
            'Accept-Language': 'zh-CN,zh;q=0.9',
            'Connection': 'keep-alive',
            'Sec-Fetch-Dest': 'empty',
            'Sec-Fetch-Mode': 'cors',
            'Sec-Fetch-Site': 'same-origin',
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) '
                          'Chrome/103.0.0.0 Safari/537.36',
            'X-Requested-With': 'XMLHttpRequest',
            'Referer': 'https://wappass.baidu.com/static/captcha/tuxing.html?ak=33c48884b7df83d4230e07cbcd0d07fd&backurl=http%3A%2F%2Fwww.aiqicha.com%2Fs%3Fq%3D%E5%8D%8E%E4%B8%BA%E6%8A%80%E6%9C%AF%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%26t%3D0%26p_type%3D2&timestamp=1658303050&signature=0a25abf3ad473d83e846a510b7b5d1ed',
            'sec-ch-ua': '".Not/A)Brand";v="99", "Google Chrome";v="103", "Chromium";v="103"',
            'sec-ch-ua-mobile': '?0',
            'sec-ch-ua-platform': '"Windows"',
        }

    def get_image_request_data(self):
        """
        :return: 获取需要获取图片的参数
        """
        url = "https://wappass.baidu.com/viewlog"
        params = {
            "callback": "jQuery110205449684422426735_" + str(int(time.time() * 1000)),
            "ak": "33c48884b7df83d4230e07cbcd0d07fd",
            "_": str(int(time.time() * 1000))
        }
        response = self.session.get(url, headers=self.headers, params=params)
        res_data = re.findall(r'.*?(\{.*?})\)', response.text)[0]
        res_data = json.loads(res_data)
        item = {
            "tk": res_data['data']['tk'],
            "as": res_data['data']['as'],
            "ds": res_data['data']['ds']
        }
        return item

    def get_img(self, item):
        url = "https://wappass.baidu.com/viewlog/getstyle"
        params = {
            "callback": "jQuery110205449684422426735_" + str(time.time() * 1000),
            "ak": '33c48884b7df83d4230e07cbcd0d07fd',
            "tk": item["tk"],
            "isios": "0",
            "type": "spin",
            "_": str(time.time() * 1000)
        }
        response = self.session.get(url, headers=self.headers, params=params)
        ret_data = re.findall(r'.*?(\{.*?})\)', response.text)[0]
        ret_data = json.loads(ret_data)
        item_img = {
            "img_url": unquote(ret_data['data']['ext']['img']),
            "backstr": ret_data['data']['backstr'],
            "tk": item["tk"],
            "as": item["as"]
        }
        response = self.session.get(item_img['img_url'], verify=False)
        with open('img.png', 'wb')as f:
            f.write(response.content)
        return item_img

    def verify_data(self, item):
        url = "https://wappass.baidu.com/viewlog"
        print("angle：", item['angle'])
        print("as：", item['as'])
        with open('get_encrypt.js', 'r', encoding='utf-8') as f:
            js_text = f.read()
        fs = execjs.compile(js_text).call('encrypt_', str(item['angle']), str(item['as']), str(item['backstr']))
        print("fs：", fs)
        params = {
            "callback": "jQuery110204100787474351779_" + str(time.time() * 1000),
            "ak": "33c48884b7df83d4230e07cbcd0d07fd",
            "as": item['as'],
            "fs": fs[0],
            "tk": item['tk'],
            "cv": "submit",
            "_": str(time.time() * 1000)
        }
        response = self.session.get(url, headers=self.headers, params=params)
        ret_data = re.findall(r'.*?(\{.*?})\)', response.text)[0]
        ret_data = json.loads(ret_data)
        print("验证结果：", ret_data)
        return ret_data


if __name__ == '__main__':
    item = BaiduAiqichaRotate().get_image_request_data()
    item_img = BaiduAiqichaRotate().get_img(item)
    angle = fun_get_angle_('img.png')
    item_img['angle'] = angle
    print(item_img)
    ret_data = BaiduAiqichaRotate().verify_data(item_img)
    if 1 == ret_data['data']['op']:
        print("验证通过")
        # break

参考链接