网址
aHR0cHM6Ly93d3cudmlldGpldGFpci5jb20vemgtQ04=
### 抓包
PATCH /booking/api/v1/search-flight HTTP/1.1
Host: ********
authority: ********
accept: application/json
accept-language: zh-cn
cache-control: no-cache
content-language: zh-cn
content-type: application/json
origin: https://********
pragma: no-cache
referer: https://********/
sec-ch-ua: "Google Chrome";v="107", "Chromium";v="107", "Not=A?Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: same-site
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Length: 1040
{"encrypted":"gbBZR3xvwX1JYTgNwrIHTIoVbYUPR2eozjwg9/RyZYsTITs6HDdI99y0edH+aQfE794jbuxAf06SZ2lVBWlm921H5MyS7aouLiAIT6qTPSYSZXM8tdy9UsL44psUmfcWEi3cPECmKb1UDA6dpIxd/wKYwHYoqNs6TrHcYVCx2YKpKpsKh9iv4qvy1AVnOufdChledXN1TxG85+xHUfugwxSRh1ngTCcPxnz88pQkcavvLCKD9YuGc6M1LMADkF+MFq4cdtw1Q/Kzc0kEyCwU4nOC0KdHJFYK8oWQbG8I86qavdoefzUYQrH99buctqRKhndoHAgUFUVWdhlYrYxwJIkXMszIlU4F9SFfRif8BK/onJRL1QmDEhk49RJv1bSR6rwcsi42yCzbhRV5Yw34jPZMlKPHQDdB2nGAeRuu5hYYQxtlMuWwBvKhPvVBLoMVEqa7q9QFNUhN8cEAhr0cc2KiRAk02l0GM/JdrVYHsw3ORww/Jj+1ZUDYxn47JGNeEv48qSyv+u23X/l7roQmWPqADpPNpkGhJHB5Plqb2EK2LbWnNRm47Ib+TsjTilCdhfsazYpT6vL0rY1nd284l7X0QmL+v2HxTrO/qtrj9eUHxbtbqZJ6tTnejkFmp5k/CdjcpttLanKt9lMZ8/tL0rM7OMEQjYd17NlkDSIXj15i42oLx49k6QqFquhwQIYwHRiDN4sjHjLJpvH2nUllvWLZnKzK7coLcFELJCeU6Ks6vOfB6GJqkIyH2ohVW+6p4Wp2kw4N5H1lEq0FFb3GBTMWKevMv94HxX7AJARJcJkDimerVn5uJKcoP210GtX2VtU3PhXIi3/kOIl4i2Xja1wLfbMorct4RXW9vK3BGyR8xMERY7XOaYmqkrPgNIZ8Bn0u1vnLBnsJ1gc1G2mmzlso+hZnp9pNgJuOLqPE2A0L1E/Z7uZdZUWQ3rpOphTiu5J+Xt07atzsEYFxKp736KITGjDYMtp/4RHsuIW9TuOZu0XsBJ/teTcSMTEQD7hs"}
从上述可以看到对body体进行了加密
encrypted加密
搜索关键参数打断点
断下来看看,发现加密的位置就在此处
看看加密参数是什么
既然定位到了加密参数,那么扣代码翻译的事各位自己来吧!
_signature加密
搜索相关位置
打断点控制台调用一下
这不就是除了_signature之外别的字段的一个排序嘛
根据堆栈相关追到这块
剩下的代码自己扣吧!需要补一下相关环境奥
requestId加密
搜索相关参数并打断点调试看看
发现就是个字母加数字随机出来的12位外加时间戳
user-agent-ls-data加密
很明显可以看出来是uuid4+时间戳
部分加密展示
import hashlib
import random
import time
import uuid
strs = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
requestId = ''.join(random.sample(strs, 12))
ts = int(time.time() * 1000)
url = "https://*************/booking/api/v1/search-flight"
dds = {"currency": "USD", "departureDate": "2022-11-21", "daysBeforeDeparture": 0, "daysAfterDeparture": 0,
"departurePlace": "SGN", "arrival": "HAN", "oneway": 1, "adultCount": 1, "childCount": 0, "infantCount": 0,
"requestId": str(requestId) + '-' + str(ts), "sessionId": None,
"x-power-web-s-d": "",
"user-agent-ls-data": str(uuid.uuid4()) + '-' + str(ts)}
mmd = []
for m in sorted(list(dds.keys())):
if dds[m] != None:
mmd.append(str(m) + '=' + str(dds[m]))
else:
mmd.append(str(m) + '=' + '')
data_sha = hashlib.sha256('&'.join(mmd).encode('utf-8')).hexdigest()
print(data_sha)