点击今日头条某帐号后，打开该帐号发表的所有新闻页，如图
下拉所有新闻，可通过fiddler等抓包工具抓到如下数据包
GET https://www.toutiao.com/c/user/article/?page_type=1&user_id=4377795668&max_behot_time=1555895168&count=20&as=A1450C7BED6232D&cp=5CBD5283C2EDDE1&_signature=ZZ6FqBATOSds0v-9UOJ-iGWehb HTTP/1.1 Host: www.toutiao.com Connection: keep-alive Accept: application/json, text/javascript X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36 Content-Type: application/x-www-form-urlencoded Referer: https://www.toutiao.com/c/user/4377795668/ Accept-Encoding: gzip, deflate, br Accept-Language: zh-CN,zh;q=0.9 Cookie: tt_webid=6682535974160254471; WEATHER_CITY=%E5%8C%97%E4%BA%AC; UM_distinctid=16a42d1194190-032ed1eacf81d6-5a40201d-1fa400-16a42d119424ad; CNZZDATA1259612802=268070970-1555896253-%7C1555896253; tt_webid=6682535974160254471; __tasessionId=8rs3f1u4u1555899161006; csrftoken=27a92e4530912e0a2cf24e8c5619e32d
userid:user_id=4377795668
时间戳:max_behot_time=1555895168
数量：count=20
as值：as=A1450C7BED6232D
cp值：cp=5CBD5283C2EDDE1
signature值：_signature=ZZ6FqBATOSds0v-9UOJ-iGWehb
其中，as和cp值获取简单
1 #email:[email protected] 2 #date:20190422 3 4 5 ''' 6 var e = Math.floor((new Date).getTime() / 1e3) 7 , i = e.toString(16).toUpperCase() 8 , t = md5(e).toString().toUpperCase(); 9 if (8 != i.length) 10 return { 11 as: "479BB4B7254C150", 12 cp: "7E0AC8874BB0985" 13 }; 14 for (var o = t.slice(0, 5), n = t.slice(-5), a = "", s = 0; 5 > s; s++) 15 a += o[s] + i[s]; 16 for (var r = "", l = 0; 5 > l; l++) 17 r += i[l + 3] + n[l]; 18 return { 19 as: "A1" + a + i.slice(-3), 20 cp: i.slice(0, 3) + r + "E1" 21 } 22 ''' 23 import time 24 import hashlib 25 def handle_as_cp(): 26 e = int(time.time())#获取当前时间戳 27 i = hex(e).upper()[2:]#转换16禁止并切片 28 my_md5 = hashlib.md5()#获取一个MD5的加密算法对象 29 my_md5.update(str(e).encode("utf-8")) #得到MD5消息摘要 30 t = my_md5.hexdigest().upper()#以16进制返回消息摘要，32位 31 if len(i) != 8: 32 as_value = "479BB4B7254C150" 33 cp_value = "7E0AC8874BB0985" 34 return as_value,cp_value 35 else: 36 o = t[0:5] 37 n = t[-5:] 38 a = "" 39 for s in range(0,5): 40 a = a + o[s]+i[s] 41 r = "" 42 for l in range(0,5): 43 r = r+i[l+3]+n[l] 44 as_value = "A1"+a+i[-3:] 45 cp_value = i[0:3]+r+"E1" 46 return as_value,cp_value 47 48 print(handle_as_cp())
附上大神的_signature破解代码
1 navigator = { 2 // WT-JS_DEBUG v1.7.5 - NLiger2018 3 appCodeName: "Mozilla", 4 appMinorVersion: "0", 5 appName: "Netscape", 6 appVersion: "5.0 (Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; rv:11.0) like Gecko", 7 browserLanguage: "zh-CN", 8 cookieEnabled: true, 9 cpuClass: "x86", 10 language: "zh-CN", 11 maxTouchPoints: 0, 12 msManipulationViewsEnabled: true, 13 msMaxTouchPoints: 0, 14 msPointerEnabled: true, 15 onLine: true, 16 platform: "Win32", 17 pointerEnabled: true, 18 product: "Gecko", 19 systemLanguage: "zh-CN", 20 userAgent: "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; rv:11.0) like Gecko", 21 userLanguage: "zh-CN", 22 vendor: "", 23 vendorSub: "", 24 webdriver: false 25 }, window = this, window.navigator = navigator; 26 27 if (typeof JSON !== "object") { 28 JSON = {}; 29 }(function () { 30 "use strict"; 31 var rx_one = /^[\],:{}\s]*$/; 32 var rx_two = /\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g; 33 var rx_three = /"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g; 34 var rx_four = /(?:^|:|,)(?:\s*\[)+/g; 35 var rx_escapable = /[\\"\u0000-\u001f\u007f-\u009f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g; 36 var rx_dangerous = /[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g; 37 38 function f(n) { 39 return n < 10 ? "0" + n : n; 40 } 41 42 function this_value() { 43 return this.valueOf(); 44 } 45 if (typeof Date.prototype.toJSON !== "function") { 46 Date.prototype.toJSON = function () { 47 return isFinite(this.valueOf()) ? this.getUTCFullYear() + "-" + f(this.getUTCMonth() + 1) + "-" + f(this.getUTCDate()) + "T" + f(this.getUTCHours()) + ":" + f(this.getUTCMinutes()) + ":" + f(this.getUTCSeconds()) + "Z" : null; 48 }; 49 Boolean.prototype.toJSON = this_value; 50 Number.prototype.toJSON = this_value; 51 String.prototype.toJSON = this_value; 52 } 53 var gap; 54 var indent; 55 var meta; 56 var rep; 57 58 function quote(string) { 59 rx_escapable.lastIndex = 0; 60 return rx_escapable.test(string) ? "\"" + string.replace(rx_escapable, function (a) { 61 var c = meta[a]; 62 return typeof c === "string" ? c : "\\u" + ("0000" + a.charCodeAt(0).toString(16)).slice(-4); 63 }) + "\"" : "\"" + string + "\""; 64 } 65 66 function str(key, holder) { 67 var i; 68 var k; 69 var v; 70 var length; 71 var mind = gap; 72 var partial; 73 var value = holder[key]; 74 if (value && typeof value === "object" && typeof value.toJSON === "function") { 75 value = value.toJSON(key); 76 } 77 if (typeof rep === "function") { 78 value = rep.call(holder, key, value); 79 } 80 switch (typeof value) { 81 case "string": 82 return quote(value); 83 case "number": 84 return isFinite(value) ? String(value) : "null"; 85 case "boolean": 86 case "null": 87 return String(value); 88 case "object": 89 if (!value) { 90 return "null"; 91 } 92 gap += indent; 93 partial = []; 94 if (Object.prototype.toString.apply(value) === "[object Array]") { 95 length = value.length; 96 for (i = 0; i < length; i += 1) { 97 partial[i] = str(i, value) || "null"; 98 } 99 v = partial.length === 0 ? "[]" : gap ? "[\n" + gap + partial.join(",\n" + gap) + "\n" + mind + "]" : "[" + partial.join(",") + "]"; 100 gap = mind; 101 return v; 102 } 103 if (rep && typeof rep === "object") { 104 length = rep.length; 105 for (i = 0; i < length; i += 1) { 106 if (typeof rep[i] === "string") { 107 k = rep[i]; 108 v = str(k, value); 109 if (v) { 110 partial.push(quote(k) + (gap ? ": " : ":") + v); 111 } 112 } 113 } 114 } else { 115 for (k in value) { 116 if (Object.prototype.hasOwnProperty.call(value, k)) { 117 v = str(k, value); 118 if (v) { 119 partial.push(quote(k) + (gap ? ": " : ":") + v); 120 } 121 } 122 } 123 } 124 v = partial.length === 0 ? "{}" : gap ? "{\n" + gap + partial.join(",\n" + gap) + "\n" + mind + "}" : "{" + partial.join(",") + "}"; 125 gap = mind; 126 return v; 127 } 128 } 129 if (typeof JSON.stringify !== "function") { 130 meta = { 131 "\b": "\\b", 132 "\t": "\\t", 133 "\n": "\\n", 134 "\f": "\\f", 135 "\r": "\\r", 136 "\"": "\\\"", 137 "\\": "\\\\" 138 }; 139 JSON.stringify = function (value, replacer, space) { 140 var i; 141 gap = ""; 142 indent = ""; 143 if (typeof space === "number") { 144 for (i = 0; i < space; i += 1) { 145 indent += " "; 146 } 147 } else if (typeof space === "string") { 148 indent = space; 149 } 150 rep = replacer; 151 if (replacer && typeof replacer !== "function" && (typeof replacer !== "object" || typeof replacer.length !== "number")) { 152 throw new Error("JSON.stringify"); 153 } 154 return str("", { 155 "": value 156 }); 157 }; 158 } 159 if (typeof JSON.parse !== "function") { 160 JSON.parse = function (text, reviver) { 161 var j; 162 163 function walk(holder, key) { 164 var k; 165 var v; 166 var value = holder[key]; 167 if (value && typeof value === "object") { 168 for (k in value) { 169 if (Object.prototype.hasOwnProperty.call(value, k)) { 170 v = walk(value, k); 171 if (v !== undefined) { 172 value[k] = v; 173 } else { 174 delete value[k]; 175 } 176 } 177 } 178 } 179 return reviver.call(holder, key, value); 180 } 181 text = String(text); 182 rx_dangerous.lastIndex = 0; 183 if (rx_dangerous.test(text)) { 184 text = text.replace(rx_dangerous, function (a) { 185 return "\\u" + ("0000" + a.charCodeAt(0).toString(16)).slice(-4); 186 }); 187 } 188 if (rx_one.test(text.replace(rx_two, "@").replace(rx_three, "]").replace(rx_four, ""))) { 189 j = eval("(" + text + ")"); 190 return (typeof reviver === "function") ? walk({ 191 "": j 192 }, "") : j; 193 } 194 throw new SyntaxError("JSON.parse"); 195 }; 196 } 197 }()); 198 199 var CryptoJS = CryptoJS || (function (Math, undefined) { 200 var C = {}; 201 var C_lib = C.lib = {}; 202 var Base = C_lib.Base = (function () { 203 function F() {}; 204 return { 205 extend: function (overrides) { 206 F.prototype = this; 207 var subtype = new F(); 208 if (overrides) { 209 subtype.mixIn(overrides); 210 } 211 if (!subtype.hasOwnProperty('init') || this.init === subtype.init) { 212 subtype.init = function () { 213 subtype.$super.init.apply(this, arguments); 214 }; 215 } 216 subtype.init.prototype = subtype; 217 subtype.$super = this; 218 return subtype; 219 }, create: function () { 220 var instance = this.extend(); 221 instance.init.apply(instance, arguments); 222 return instance; 223 }, init: function () {}, mixIn: function (properties) { 224 for (var propertyName in properties) { 225 if (properties.hasOwnProperty(propertyName)) { 226 this[propertyName] = properties[propertyName]; 227 } 228 } 229 if (properties.hasOwnProperty('toString')) { 230 this.toString = properties.toString; 231 } 232 }, clone: function () { 233 return this.init.prototype.extend(this); 234 } 235 }; 236 }()); 237 var WordArray = C_lib.WordArray = Base.extend({ 238 init: function (words, sigBytes) { 239 words = this.words = words || []; 240 if (sigBytes != undefined) { 241 this.sigBytes = sigBytes; 242 } else { 243 this.sigBytes = words.length * 4; 244 } 245 }, toString: function (encoder) { 246 return (encoder || Hex).stringify(this); 247 }, concat: function (wordArray) { 248 var thisWords = this.words; 249 var thatWords = wordArray.words; 250 var thisSigBytes = this.sigBytes; 251 var thatSigBytes = wordArray.sigBytes; 252 this.clamp(); 253 if (thisSigBytes % 4) { 254 for (var i = 0; i < thatSigBytes; i++) { 255 var thatByte = (thatWords[i >>> 2] >>> (24 - (i % 4) * 8)) & 0xff; 256 thisWords[(thisSigBytes + i) >>> 2] |= thatByte << (24 - ((thisSigBytes + i) % 4) * 8); 257 } 258 } else if (thatWords.length > 0xffff) { 259 for (var i = 0; i < thatSigBytes; i += 4) { 260 thisWords[(thisSigBytes + i) >>> 2] = thatWords[i >>> 2]; 261 } 262 } else { 263 thisWords.push.apply(thisWords, thatWords); 264 } 265 this.sigBytes += thatSigBytes; 266 return this; 267 }, clamp: function () { 268 var words = this.words; 269 var sigBytes = this.sigBytes; 270 words[sigBytes >>> 2] &= 0xffffffff << (32 - (sigBytes % 4) * 8); 271 words.length = Math.ceil(sigBytes / 4); 272 }, clone: function () { 273 var clone = Base.clone.call(this); 274 clone.words = this.words.slice(0); 275 return clone; 276 }, random: function (nBytes) { 277 var words = []; 278 var r = (function (m_w) { 279 var m_w = m_w; 280 var m_z = 0x3ade68b1; 281 var mask = 0xffffffff; 282 return function () { 283 m_z = (0x9069 * (m_z & 0xFFFF) + (m_z >> 0x10)) & mask; 284 m_w = (0x4650 * (m_w & 0xFFFF) + (m_w >> 0x10)) & mask; 285 var result = ((m_z << 0x10) + m_w) & mask; 286 result /= 0x100000000; 287 result += 0.5; 288 return result * (Math.random() > .5 ? 1 : -1); 289 } 290 }); 291 for (var i = 0, rcache; i < nBytes; i += 4) { 292 var _r = r((rcache || Math.random()) * 0x100000000); 293 rcache = _r() * 0x3ade67b7; 294 words.push((_r() * 0x100000000) | 0); 295 } 296 return new WordArray.init(words, nBytes); 297 } 298 }); 299 var C_enc = C.enc = {}; 300 var Hex = C_enc.Hex = { 301 stringify: function (wordArray) { 302 var words = wordArray.words; 303 var sigBytes = wordArray.sigBytes; 304 var hexChars = []; 305 for (var i = 0; i < sigBytes; i++) { 306 var bite = (words[i >>> 2] >>> (24 - (i % 4) * 8)) & 0xff; 307 hexChars.push((bite >>> 4).toString(16)); 308 hexChars.push((bite & 0x0f).toString(16)); 309 } 310 return hexChars.join(''); 311 }, parse: function (hexStr) { 312 var hexStrLength = hexStr.length; 313 var words = []; 314 for (var i = 0; i < hexStrLength; i += 2) { 315 words[i >>> 3] |= parseInt(hexStr.substr(i, 2), 16) << (24 - (i % 8) * 4); 316 } 317 return new WordArray.init(words, hexStrLength / 2); 318 } 319 }; 320 var Latin1 = C_enc.Latin1 = { 321 stringify: function (wordArray) { 322 var words = wordArray.words; 323 var sigBytes = wordArray.sigBytes; 324 var latin1Chars = []; 325 for (var i = 0; i < sigBytes; i++) { 326 var bite = (words[i >>> 2] >>> (24 - (i % 4) * 8)) & 0xff; 327 latin1Chars.push(String.fromCharCode(bite)); 328 } 329 return latin1Chars.join(''); 330 }, parse: function (latin1Str) { 331 var latin1StrLength = latin1Str.length; 332 var words = []; 333 for (var i = 0; i < latin1StrLength; i++) { 334 words[i >>> 2] |= (latin1Str.charCodeAt(i) & 0xff) << (24 - (i % 4) * 8); 335 } 336 return new WordArray.init(words, latin1StrLength); 337 } 338 }; 339 var Utf8 = C_enc.Utf8 = { 340 stringify: function (wordArray) { 341 try { 342 return decodeURIComponent(escape(Latin1.stringify(wordArray))); 343 } catch (e) { 344 throw new Error('Malformed UTF-8 data'); 345 } 346 }, parse: function (utf8Str) { 347 return Latin1.parse(unescape(encodeURIComponent(utf8Str))); 348 } 349 }; 350 var BufferedBlockAlgorithm = C_lib.BufferedBlockAlgorithm = Base.extend({ 351 reset: function () { 352 this._data = new WordArray.init(); 353 this._nDataBytes = 0; 354 }, _append: function (data) { 355 if (typeof data == 'string') { 356 data = Utf8.parse(data); 357 } 358 this._data.concat(data); 359 this._nDataBytes += data.sigBytes; 360 }, _process: function (doFlush) { 361 var data = this._data; 362 var dataWords = data.words; 363 var dataSigBytes = data.sigBytes; 364 var blockSize = this.blockSize; 365 var blockSizeBytes = blockSize * 4; 366 var nBlocksReady = dataSigBytes / blockSizeBytes; 367 if (doFlush) { 368 nBlocksReady = Math.ceil(nBlocksReady); 369 } else { 370 nBlocksReady = Math.max((nBlocksReady | 0) - this._minBufferSize, 0); 371 } 372 var nWordsReady = nBlocksReady * blockSize; 373 var nBytesReady = Math.min(nWordsReady * 4, dataSigBytes); 374 if (nWordsReady) { 375 for (var offset = 0; offset < nWordsReady; offset += blockSize) { 376 this._doProcessBlock(dataWords, offset); 377 } 378 var processedWords = dataWords.splice(0, nWordsReady); 379 data.sigBytes -= nBytesReady; 380 } 381 return new WordArray.init(processedWords, nBytesReady); 382 }, clone: function () { 383 var clone = Base.clone.call(this); 384 clone._data = this._data.clone(); 385 return clone; 386 }, _minBufferSize: 0 387 }); 388 var Hasher = C_lib.Hasher = BufferedBlockAlgorithm.extend({ 389 cfg: Base.extend(), 390 init: function (cfg) { 391 this.cfg = this.cfg.extend(cfg); 392 this.reset(); 393 }, reset: function () { 394 BufferedBlockAlgorithm.reset.call(this); 395 this._doReset(); 396 }, update: function (messageUpdate) { 397 this._append(messageUpdate); 398 this._process(); 399 return this; 400 }, finalize: function (messageUpdate) { 401 if (messageUpdate) { 402 this._append(messageUpdate); 403 } 404 var hash = this._doFinalize(); 405 return hash; 406 }, blockSize: 512 / 32, 407 _createHelper: function (hasher) { 408 return function (message, cfg) { 409 return new hasher.init(cfg).finalize(message); 410 }; 411 }, _createHmacHelper: function (hasher) { 412 return function (message, key) { 413 return new C_algo.HMAC.init(hasher, key).finalize(message); 414 }; 415 } 416 }); 417 var C_algo = C.algo = {}; 418 return C; 419 }(Math)); 420 421 (function (Math) { 422 var C = CryptoJS; 423 var C_lib = C.lib; 424 var WordArray = C_lib.WordArray; 425 var Hasher = C_lib.Hasher; 426 var C_algo = C.algo; 427 var T = []; 428 (function () { 429 for (var i = 0; i < 64; i++) { 430 T[i] = (Math.abs(Math.sin(i + 1)) * 0x100000000) | 0; 431 } 432 }()); 433 var MD5 = C_algo.MD5 = Hasher.extend({ 434 _doReset: function () { 435 this._hash = new WordArray.init([0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476]); 436 }, _doProcessBlock: function (M, offset) { 437 for (var i = 0; i < 16; i++) { 438 var offset_i = offset + i; 439 var M_offset_i = M[offset_i]; 440 M[offset_i] = ((((M_offset_i << 8) | (M_offset_i >>> 24)) & 0x00ff00ff) | (((M_offset_i << 24) | (M_offset_i >>> 8)) & 0xff00ff00)); 441 } 442 var H = this._hash.words; 443 var M_offset_0 = M[offset + 0]; 444 var M_offset_1 = M[offset + 1]; 445 var M_offset_2 = M[offset + 2]; 446 var M_offset_3 = M[offset + 3]; 447 var M_offset_4 = M[offset + 4]; 448 var M_offset_5 = M[offset + 5]; 449 var M_offset_6 = M[offset + 6]; 450 var M_offset_7 = M[offset + 7]; 451 var M_offset_8 = M[offset + 8]; 452 var M_offset_9 = M[offset + 9]; 453 var M_offset_10 = M[offset + 10]; 454 var M_offset_11 = M[offset + 11]; 455 var M_offset_12 = M[offset + 12]; 456 var M_offset_13 = M[offset + 13]; 457 var M_offset_14 = M[offset + 14]; 458 var M_offset_15 = M[offset + 15]; 459 var a = H[0]; 460 var b = H[1]; 461 var c = H[2]; 462 var d = H[3]; 463 a = FF(a, b, c, d, M_offset_0, 7, T[0]); 464 d = FF(d, a, b, c, M_offset_1, 12, T[1]); 465 c = FF(c, d, a, b, M_offset_2, 17, T[2]); 466 b = FF(b, c, d, a, M_offset_3, 22, T[3]); 467 a = FF(a, b, c, d, M_offset_4, 7, T[4]); 468 d = FF(d, a, b, c, M_offset_5, 12, T[5]); 469 c = FF(c, d, a, b, M_offset_6, 17, T[6]); 470 b = FF(b, c, d, a, M_offset_7, 22, T[7]); 471 a = FF(a, b, c, d, M_offset_8, 7, T[8]); 472 d = FF(d, a, b, c, M_offset_9, 12, T[9]); 473 c = FF(c, d, a, b, M_offset_10, 17, T[10]); 474 b = FF(b, c, d, a, M_offset_11, 22, T[11]); 475 a = FF(a, b, c, d, M_offset_12, 7, T[12]); 476 d = FF(d, a, b, c, M_offset_13, 12, T[13]); 477 c = FF(c, d, a, b, M_offset_14, 17, T[14]); 478 b = FF(b, c, d, a, M_offset_15, 22, T[15]); 479 a = GG(a, b, c, d, M_offset_1, 5, T[16]); 480 d = GG(d, a, b, c, M_offset_6, 9, T[17]); 481 c = GG(c, d, a, b, M_offset_11, 14, T[18]); 482 b = GG(b, c, d, a, M_offset_0, 20, T[19]); 483 a = GG(a, b, c, d, M_offset_5, 5, T[20]); 484 d = GG(d, a, b, c, M_offset_10, 9, T[21]); 485 c = GG(c, d, a, b, M_offset_15, 14, T[22]); 486 b = GG(b, c, d, a, M_offset_4, 20, T[23]); 487 a = GG(a, b, c, d, M_offset_9, 5, T[24]); 488 d = GG(d, a, b, c, M_offset_14, 9, T[25]); 489 c = GG(c, d, a, b, M_offset_3, 14, T[26]); 490 b = GG(b, c, d, a, M_offset_8, 20, T[27]); 491 a = GG(a, b, c, d, M_offset_13, 5, T[28]); 492 d = GG(d, a, b, c, M_offset_2, 9, T[29]); 493 c = GG(c, d, a, b, M_offset_7, 14, T[30]); 494 b = GG(b, c, d, a, M_offset_12, 20, T[31]); 495 a = HH(a, b, c, d, M_offset_5, 4, T[32]); 496 d = HH(d, a, b, c, M_offset_8, 11, T[33]); 497 c = HH(c, d, a, b, M_offset_11, 16, T[34]); 498 b = HH(b, c, d, a, M_offset_14, 23, T[35]); 499 a = HH(a, b, c, d, M_offset_1, 4, T[36]); 500 d = HH(d, a, b, c, M_offset_4, 11, T[37]); 501 c = HH(c, d, a, b, M_offset_7, 16, T[38]); 502 b = HH(b, c, d, a, M_offset_10, 23, T[39]); 503 a = HH(a, b, c, d, M_offset_13, 4, T[40]); 504 d = HH(d, a, b, c, M_offset_0, 11, T[41]); 505 c = HH(c, d, a, b, M_offset_3, 16, T[42]); 506 b = HH(b, c, d, a, M_offset_6, 23, T[43]); 507 a = HH(a, b, c, d, M_offset_9, 4, T[44]); 508 d = HH(d, a, b, c, M_offset_12, 11, T[45]); 509 c = HH(c, d, a, b, M_offset_15, 16, T[46]); 510 b = HH(b, c, d, a, M_offset_2, 23, T[47]); 511 a = II(a, b, c, d, M_offset_0, 6, T[48]); 512 d = II(d, a, b, c, M_offset_7, 10, T[49]); 513 c = II(c, d, a, b, M_offset_14, 15, T[50]); 514 b = II(b, c, d, a, M_offset_5, 21, T[51]); 515 a = II(a, b, c, d, M_offset_12, 6, T[52]); 516 d = II(d, a, b, c, M_offset_3, 10, T[53]); 517 c = II(c, d, a, b, M_offset_10, 15, T[54]); 518 b = II(b, c, d, a, M_offset_1, 21, T[55]); 519 a = II(a, b, c, d, M_offset_8, 6, T[56]); 520 d = II(d, a, b, c, M_offset_15, 10, T[57]); 521 c = II(c, d, a, b, M_offset_6, 15, T[58]); 522 b = II(b, c, d, a, M_offset_13, 21, T[59]); 523 a = II(a, b, c, d, M_offset_4, 6, T[60]); 524 d = II(d, a, b, c, M_offset_11, 10, T[61]); 525 c = II(c, d, a, b, M_offset_2, 15, T[62]); 526 b = II(b, c, d, a, M_offset_9, 21, T[63]); 527 H[0] = (H[0] + a) | 0; 528 H[1] = (H[1] + b) | 0; 529 H[2] = (H[2] + c) | 0; 530 H[3] = (H[3] + d) | 0; 531 }, _doFinalize: function () { 532 var data = this._data; 533 var dataWords = data.words; 534 var nBitsTotal = this._nDataBytes * 8; 535 var nBitsLeft = data.sigBytes * 8; 536 dataWords[nBitsLeft >>> 5] |= 0x80 << (24 - nBitsLeft % 32); 537 var nBitsTotalH = Math.floor(nBitsTotal / 0x100000000); 538 var nBitsTotalL = nBitsTotal; 539 dataWords[(((nBitsLeft + 64) >>> 9) << 4) + 15] = ((((nBitsTotalH << 8) | (nBitsTotalH >>> 24)) & 0x00ff00ff) | (((nBitsTotalH << 24) | (nBitsTotalH >>> 8)) & 0xff00ff00)); 540 dataWords[(((nBitsLeft + 64) >>> 9) << 4) + 14] = ((((nBitsTotalL << 8) | (nBitsTotalL >>> 24)) & 0x00ff00ff) | (((nBitsTotalL << 24) | (nBitsTotalL >>> 8)) & 0xff00ff00)); 541 data.sigBytes = (dataWords.length + 1) * 4; 542 this._process(); 543 var hash = this._hash; 544 var H = hash.words; 545 for (var i = 0; i < 4; i++) { 546 var H_i = H[i]; 547 H[i] = (((H_i << 8) | (H_i >>> 24)) & 0x00ff00ff) | (((H_i << 24) | (H_i >>> 8)) & 0xff00ff00); 548 } 549 return hash; 550 }, clone: function () { 551 var clone = Hasher.clone.call(this); 552 clone._hash = this._hash.clone(); 553 return clone; 554 } 555 }); 556 557 function FF(a, b, c, d, x, s, t) { 558 var n = a + ((b & c) | (~b & d)) + x + t; 559 return ((n << s) | (n >>> (32 - s))) + b; 560 } 561 562 function GG(a, b, c, d, x, s, t) { 563 var n = a + ((b & d) | (c & ~d)) + x + t; 564 return ((n << s) | (n >>> (32 - s))) + b; 565 } 566 567 function HH(a, b, c, d, x, s, t) { 568 var n = a + (b ^ c ^ d) + x + t; 569 return ((n << s) | (n >>> (32 - s))) + b; 570 } 571 572 function II(a, b, c, d, x, s, t) { 573 var n = a + (c ^ (b | ~d)) + x + t; 574 return ((n << s) | (n >>> (32 - s))) + b; 575 } 576 C.MD5 = Hasher._createHelper(MD5); 577 C.HmacMD5 = Hasher._createHmacHelper(MD5); 578 }(Math)); 579 580 function get_as_cp_signature() { 581 var getHoney = function () { 582 var t = Math.floor((new Date).getTime() / 1e3), 583 e = t.toString(16).toUpperCase(), 584 i = CryptoJS.MD5(t + '').toString().toUpperCase(); 585 if (8 != e.length) return { 586 as: "479BB4B7254C150", 587 cp: "7E0AC8874BB0985" 588 }; 589 for (var n = i.slice(0, 5), a = i.slice(-5), s = "", o = 0; 5 > o; o++) 590 s += n.substr(o, 1) + e.substr(o, 1); 591 for (var r = "", c = 0; 5 > c; c++) 592 r += e.substr(c + 3, 1) + a.substr(c, 1); 593 return { 594 as: "A1" + s + e.slice(-3), 595 cp: e.slice(0, 3) + r + "E1" 596 } 597 } 598 599 function e(e, a, r) { 600 return (b[e] || (b[e] = t("x,y", "return x " + e + " y")))(r, a) 601 } 602 603 function a(e, a, r) { 604 return (k[r] || (k[r] = t("x,y", "return new x[y](" + Array(r + 1).join(",x[++y]").substr(1) + ")")))(e, a) 605 } 606 607 function r(e, a, r) { 608 var n, t, s = {}, 609 b = s.d = r ? r.d + 1 : 0; 610 for (s["$" + b] = s, 611 t = 0; t < b; t++) 612 s[n = "$" + t] = r[n]; 613 for (t = 0, 614 b = s.length = a.length; t < b; t++) 615 s[t] = a[t]; 616 return c(e, 0, s) 617 } 618 619 function c(t, b, k) { 620 function u(e) { 621 v[x++] = e 622 } 623 624 function f() { 625 return g = t.charCodeAt(b++) - 32, 626 t.substring(b, b += g) 627 } 628 629 function l() { 630 try { 631 y = c(t, b, k) 632 } catch (e) { 633 h = e, 634 y = l 635 } 636 } 637 638 for (var h, y, d, g, v = [], x = 0;;) 639 switch (g = t.charCodeAt(b++) - 32) { 640 case 1: 641 u(!v[--x]); 642 break; 643 case 4: 644 v[x++] = f(); 645 break; 646 case 5: 647 u(function (e) { 648 var a = 0, 649 r = e.length; 650 return function () { 651 var c = a < r; 652 return c && u(e[a++]), 653 c 654 } 655 }(v[--x])); 656 break; 657 case 6: 658 y = v[--x], 659 u(v[--x](y)); 660 break; 661 case 8: 662 if (g = t.charCodeAt(b++) - 32, 663 l(), 664 b += g, 665 g = t.charCodeAt(b++) - 32, 666 y === c) 667 b += g; 668 else if (y !== l) 669 return y; 670 break; 671 case 9: 672 v[x++] = c; 673 break; 674 case 10: 675 u(s(v[--x])); 676 break; 677 case 11: 678 y = v[--x], 679 u(v[--x] + y); 680 break; 681 case 12: 682 for (y = f(), 683 d = [], 684 g = 0; g < y.length; g++) 685 d[g] = y.charCodeAt(g) ^ g + y.length; 686 u(String.fromCharCode.apply(null, d)); 687 break; 688 case 13: 689 y = v[--x], 690 h = delete v[--x][y]; 691 break; 692 case 14: 693 v[x++] = t.charCodeAt(b++) - 32; 694 break; 695 case 59: 696 u((g = t.charCodeAt(b++) - 32) ? (y = x, 697 v.slice(x -= g, y)) : []); 698 break; 699 case 61: 700 u(v[--x][t.charCodeAt(b++) - 32]); 701 break; 702 case 62: 703 g = v[--x], 704 k[0] = 65599 * k[0] + k[1].charCodeAt(g) >>> 0; 705 break; 706 case 65: 707 h = v[--x], 708 y = v[--x], 709 v[--x][y] = h; 710 break; 711 case 66: 712 u(e(t.substr(b++, 1), v[--x], v[--x])); 713 break; 714 case 67: 715 y = v[--x]; 716 d = v[--x]; 717 g = v[--x]; 718 u(g.x === c ? r(g.y, y, k) : g.apply(d, y)); 719 break; 720 case 68: 721 u(e((g = t.substr(b++, 1)) < "<" ? (b--, 722 f()) : g + g, v[--x], v[--x])); 723 break; 724 case 70: 725 u(!1); 726 break; 727 case 71: 728 v[x++] = n; 729 break; 730 case 72: 731 v[x++] = +f(); 732 break; 733 case 73: 734 u(parseInt(f(), 36)); 735 break; 736 case 75: 737 if (v[--x]) { 738 b++; 739 break 740 } 741 case 74: 742 g = t.charCodeAt(b++) - 32 << 16 >> 16, 743 b += g; 744 break; 745 case 76: 746 u(k[t.charCodeAt(b++) - 32]); 747 break; 748 case 77: 749 y = v[--x], 750 u(v[--x][y]); 751 break; 752 case 78: 753 g = t.charCodeAt(b++) - 32, 754 u(a(v, x -= g + 1, g)); 755 break; 756 case 79: 757 g = t.charCodeAt(b++) - 32, 758 u(k["$" + g]); 759 break; 760 case 81: 761 h = v[--x], 762 v[--x][f()] = h; 763 break; 764 case 82: 765 u(v[--x][f()]); 766 break; 767 case 83: 768 h = v[--x], 769 k[t.charCodeAt(b++) - 32] = h; 770 break; 771 case 84: 772 v[x++] = !0; 773 break; 774 case 85: 775 v[x++] = void 0; 776 break; 777 case 86: 778 u(v[x - 1]); 779 break; 780 case 88: 781 h = v[--x], 782 y = v[--x], 783 v[x++] = h, 784 v[x++] = y; 785 break; 786 case 89: 787 u(function () { 788 function e() { 789 return r(e.y, arguments, k) 790 } 791 return e.y = f(), 792 e.x = c, 793 e 794 }()); 795 break; 796 case 90: 797 v[x++] = null; 798 break; 799 case 91: 800 v[x++] = h; 801 break; 802 case 93: 803 h = v[--x]; 804 break; 805 case 0: 806 return v[--x]; 807 default: 808 u((g << 16 >> 16) - 16) 809 } 810 } 811 var n = window; 812 var t = n.Function, 813 s = Object.keys || function (e) { 814 var a = {}, 815 r = 0; 816 for (var c in e) 817 a[r++] = c; 818 return a.length = r, 819 a 820 }, 821 b = {}, 822 k = {}; 823 r(decodeURIComponent("gr%24Daten%20%D0%98b%2Fs!l%20y%CD%92y%C4%B9g%2C(lfi~ah%60%7Bmv%2C-n%7CjqewVxp%7Brvmmx%2C%26eff%7Fkx%5B!cs%22l%22.Pq%25widthl%22%40q%26heightl%22vr*getContextx%24%222d%5B!cs%23l%23%2C*%3B%3F%7Cu.%7Cuc%7Buq%24fontl%23vr(fillTextx%24%24%E9%BE%98%E0%B8%91%E0%B8%A0%EA%B2%BD2%3C%5B%23c%7Dl%232q*shadowBlurl%231q-shadowOffsetXl%23%24%24limeq%2BshadowColorl%23vr%23arcx88802%5B%25c%7Dl%23vr%26strokex%5B%20c%7Dl%22v%2C)%7DeOmyoZB%5Dmx%5B%20cs!0s%24l%24Pb%3Ck7l%20l!r%26lengthb%25%5El%241%2Bs%24j%02l%20%20s%23i%241ek1s%24gr%23tack4)zgr%23tac%24!%20%2B0o!%5B%23cj%3Fo%20%5D!l%24b%25s%22o%20%5D!l%22l%24b*b%5E0d%23%3E%3E%3Es!0s%25yA0s%22l%22l!r%26lengthb%3Ck%2Bl%22%5El%221%2Bs%22j%05l%20%20s%26l%26z0l!%24%20%2B%5B%22cs'(0l%23i'1ps9wxb%26s()%20%26%7Bs)%2Fs(gr%26Stringr%2CfromCharCodes)0s*yWl%20._b%26s%20o!%5D)l%20l%20Jb%3Ck%24.aj%3Bl%20.Tb%3Ck%24.gj%2Fl%20.%5Eb%3Ck%26i%22-4j!%1F%2B%26%20s%2ByPo!%5D%2Bs!l!l%20Hd%3E%26l!l%20Bd%3E%26%2Bl!l%20%3Cd%3E%26%2Bl!l%206d%3E%26%2Bl!l%20%26%2B%20s%2Cy%3Do!o!%5D%2Fq%2213o!l%20q%2210o!%5D%2Cl%202d%3E%26%20s.%7Bs-yMo!o!%5D0q%2213o!%5D*Ld%3Cl%204d%23%3E%3E%3Eb%7Cs!o!l%20q%2210o!%5D%2Cl!%26%20s%2FyIo!o!%5D.q%2213o!%5D%2Co!%5D*Jd%3Cl%206d%23%3E%3E%3Eb%7C%26o!%5D%2Bl%20%26%2B%20s0l-l!%26l-l!i'1z141z4b%2F%40d%3Cl%22b%7C%26%2Bl-l(l!b%5E%26%2Bl-l%26zl'g%2C)gk%7Dejo%7B%7Fcm%2C)%7Cyn~Lij~em%5B%22cl%24b%25%40d%3Cl%26zl'l%20%24%20%2B%5B%22cl%24b%25b%7C%26%2Bl-l%258d%3C%40b%7Cl!b%5E%26%2B%20q%24sign%20"), [TAC = {}]); 824 var params = getHoney(); 825 params._signature = TAC.sign(xxxxx); 826 return JSON.stringify(params); 827 }
抓取代码如下：
1 import requests 2 import json 3 import execjs 4 5 6 7 class Handle_jrtt(object): 8 def handle_news(self,id,value): 9 print(id,value) 10 while True: 11 js_result = json.loads(self.handle_js(id,value)) 12 as_value = js_result['as'] 13 cp_value = js_result['cp'] 14 signature = js_result['_signature'] 15 url = "https://www.toutiao.com/c/user/article/?page_type=1&user_id=4377795668&max_behot_time=%s&count=20&as=%s&cp=%s&_signature=%s"%(value,as_value,cp_value,signature) 16 # print(url) 17 header = { 18 "Host":"www.toutiao.com", 19 "Connection":"keep-alive", 20 "Accept":"application/json, text/javascript", 21 "X-Requested-With":"XMLHttpRequest", 22 "User-Agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36", 23 "Content-Type":"application/x-www-form-urlencoded", 24 "Referer":"https://www.toutiao.com/c/user/4377795668/", 25 "Accept-Encoding":"gzip, deflate, br", 26 "Accept-Language":"zh-CN,zh;q=0.9", 27 } 28 response = requests.get(url=url,headers=header) 29 result = json.loads(response.text) 30 if result['data']: 31 print(json.dumps(result)) 32 self.handle_news(id,result['next']['max_behot_time']) 33 # else: 34 # time.sleep(random.choice(range(1,5))) 35 36 def handle_js(self,id=None,value=0): 37 with open('test.js','r',encoding='utf-8') as f: 38 f_js = f.read().replace("xxxxx",str(id)+str(value)) 39 ctx = execjs.compile(f_js) 40 return ctx.call('get_as_cp_signature') 41 42 jrtt = Handle_jrtt() 43 result = jrtt.handle_news(4377795668,0)
完整项目在:
https://github.com/freedom-wy/js-reverse
欢迎大家和我一起研究JS逆向，喜欢就给个小星星吧。