携程旅行 web 验证码 分析

声明
本文章中所有内容仅供学习交流使用，不用于其他任何目的，抓包内容、敏感网址、数据接口等均已做脱敏处理，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关！
逆向分析

部分python代码

result = cp.call('verifyPoint', result_track, points)
url = "captcha/v4/verify_icon"
data = {
    "appid": "",
    "token": token,
    "rid": rid,
    "business_site": '',
    "version": "1.0.6",
    "verify_msg": result['verify_msg'],
    "dimensions": dimensions,
    "extend_param": result['extend_param'],
    "sign": result['sign'],
}
data = json.dumps(data, separators=(',', ':'))
response = session.post(url, headers=headers, data=data, proxies=proxies)

print(response.text)
result = json.loads(response.text)['result']
print(result)

result = cp.call('verifyPoint', result_track, points)
url = "captcha/v4/verify_icon"
data = {
    "appid": "",
    "token": token,
    "rid": rid,
    "business_site": '',
    "version": "1.0.6",
    "verify_msg": result['verify_msg'],
    "dimensions": dimensions,
    "extend_param": result['extend_param'],
    "sign": result['sign'],
}
data = json.dumps(data, separators=(',', ':'))
response = session.post(url, headers=headers, data=data, proxies=proxies)

print(response.text)
result = json.loads(response.text)['result']
print(result)

结果

总结

1.出于安全考虑,本章未提供完整流程,调试环节省略较多,只提供大致思路,具体细节要你自己还原,相信你也能调试出来。