盒马生鲜 小程序 sign分析

声明
本文章中所有内容仅供学习交流使用，不用于其他任何目的，抓包内容、敏感网址、数据接口等均已做脱敏处理，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关！
逆向过程

部分python代码

部分代码

headers = {
    "accept": "application/json",
    "accept-language": "zh-CN,zh;q=0.9",
    "sec-fetch-dest": "empty",
    "sec-fetch-mode": "cors",
    "sec-fetch-site": "cross-site",
    "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36",
    "x-tap": "wx",
    "xweb_xhr": "1"
}

................

params = {
    "jsv": "2.4.12",
    "appKey": a,
    "t": c,
    "sign": sign,
    "c": "",
    "api": "mtop.wdk.classify.queryclassifyitemV3.ext",
    "v": "1.0",
    "type": "originaljson",
    "ttid": "",
    "dataType": "json",
    "_bx-m": "1"
}
data = {
    "data": json.dumps(data1,  ensure_ascii=False,separators=(',', ':'))
}
response = requests.post(url, headers=headers, params=params, data=data)

print(response.text)
print(response)

headers = {
    "accept": "application/json",
    "accept-language": "zh-CN,zh;q=0.9",
    "sec-fetch-dest": "empty",
    "sec-fetch-mode": "cors",
    "sec-fetch-site": "cross-site",
    "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36",
    "x-tap": "wx",
    "xweb_xhr": "1"
}
................

params = {
    "jsv": "2.4.12",
    "appKey": a,
    "t": c,
    "sign": sign,
    "c": "",
    "api": "mtop.wdk.classify.queryclassifyitemV3.ext",
    "v": "1.0",
    "type": "originaljson",
    "ttid": "",
    "dataType": "json",
    "_bx-m": "1"
}
data = {
    "data": json.dumps(data1,  ensure_ascii=False,separators=(',', ':'))
}
response = requests.post(url, headers=headers, params=params, data=data)

print(response.text)
print(response)

结果

总结

  1.出于安全考虑,本章未提供完整流程,调试环节省略较多,只提供大致思路,具体细节要你自己还原,相信你也能调试出来。